@cdkd/cli 0.326.0 → 0.326.2

package/dist/{program-ml6yCB64.js → program-BY7FvEwy.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, l as s3ClientDefault
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, G as cutMarker, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, Q as plainIdentOr, S as explicitNamePropertyFor, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, c as isStdoutReservedForPayload, d as runStackBuffered, et as stringifyJsonPayload, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, j as isNameGeneration, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, q as displayIdent, s as getLogger, tt as terminalSafe, w as generateResourceName, x as derivesPatternBName } from "./aws-failure-text-DiHodi76.js";
 import { $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, Bn as formatError, Dn as LocalStartServiceError, Dr as retryClassificationText, En as LocalInvokeBuildError$1, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Gn as TIMEOUT_FLAG_RESOURCE_TYPE, I as VALUE_NOT_SHOWN, In as StackHasActiveImportsError, Ln as StackTerminationProtectionError, M as RESOURCE_NOT_FOUND, Mn as PartialFailureError, N as isMarkedNotGone, Nn as ProvisioningError, Ot as resourceTypeShown, Pn as ResourceTimeoutError, Qn as pasteableCommand, Qt as forceQuitRecoveryClause, Rn as StateError, Sn as DeployCancelledError, Sr as isAmbiguousOutcomeError, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, U as remedyLogicalId, Un as normalizeAwsError, Wn as withErrorHandling, Xt as buildForceUnlockCommand, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, Zt as buildLockContentionMessage, _r as stripControlChars, _t as beginCommandInterruptScope, an as DEFAULT_STATE_PREFIX, ar as setPasteableRunFlags, bn as CrossAccountSecretRefusalError, bt as isInterruptedWaitError, c as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, cn as producerCoordinateKey, dn as withPasteableAwsProfile, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, gn as AccountIdUnavailableError, gr as escapeRegExp, hn as credentialFingerprint, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, jn as NestedStackChildDirectDestroyError, jr as markNonRetryable, kr as isMarkedNonRetryable, ln as producerRecordKey, mn as clientDefaultsFor, nr as shellBoundedDisplay, on as injectiveKey, or as setPasteableVerbFlags, p as readRecordedPrincipals, pn as ambientCredentialConfig, qn as SHELL_ACTIVE_WHY, rr as shellQuote, s as IAM_PRINCIPAL_NAME, tn as formatLockOwner, tr as quotedOrDescribed, un as setPasteableAwsProfile, ut as isAwsCliLiteral, vn as CdkdError, vr as stripForDisplay, vt as endCommandInterruptScope, wn as DynamicReferenceRegionAmbiguousError, yt as interruptWatchListenerCount, zn as SynthesisError } from "./created-resource-sink-DMf6WEao.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BLXFsfMa.js";
-import { $a as recordedReferenceRegions, $c as createUnionSecretMasker, $l as exportNamesCarriedFrom, $n as nameGenerationCarriedFrom, $o as malformedOrphanRecordsWarning, $r as addSuperseded, $s as findReplacedReadersOfRecreateTargets, $t as deleteJournaledOrphans, $u as synthesisStatusMessage, Ad as defineOwnKey, Ai as createPreDeleteFinalSnapshot, Al as recordMaskOnlyValue, An as equalModuloMarkedMask, Ao as parameterInputsFor, Ar as formatDestructiveChange, As as refuseMalformedResourcePropertiesForExport, At as isSecretBearingReferenceString, Au as validateContainerRepoName, Ba as poisonRenderedSpellingsCollidingIn, Bc as noEchoLeavesOf, Bd as injectAwsRegion, Bi as DeploymentEventsReader, Bl as S3StateBackend, Bn as replacementNeverSwapped, Bo as displayLogicalId, Br as proposeRenames, Bs as repairMalformedResourcePropertiesForReadOnly, Bt as NESTED_PENDING_PARENT_REASON, Bu as getDockerCmd, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Ci as secretNamedRecordNeedles, Cn as replayFailedOperations, Co as AWS_NO_VALUE, Cr as isExportAliasCollision, Cs as refuseMalformedResourceEntriesForDeploy, Ct as conditionInputsFrom, Cu as assertAssetBucketRegion, Dd as describeJsonParseFailure, Di as PRE_DELETE_SNAPSHOT_TYPES, Dl as splitGetAttStringForm, Dn as settleUnsettledPrevious, Do as refStateLookupFromResource, Dr as maskingRetryLogger, Ds as refuseMalformedResourceEntriesForOrphan, Du as parseBootstrapMarker, Ed as processStackMessages, Ei as ATOMIC_FINAL_SNAPSHOT_TYPES, El as recordPhysicalNameCopy, En as recordAfterRollbackUpdate, Eo as lacksRecordedTableArn, Er as DEFAULT_RESOURCE_WARN_AFTER_MS, Es as refuseMalformedResourceEntriesForImportSave, Eu as isCrossRegionRedirect, Fa as unsettledItemsOf, Fc as maskAtCoordinates, Fd as absoluteAssemblyPathEscape, Fl as wholeStringLeavesOf, Fn as isReplacementOrphan, Fo as STATE_RESOURCES_MALFORMED, Fr as withMovedTo, Fs as refuseMalformedState, Ft as planOrphanAdoption, Fu as describeDockerExecFailure, Gc as recordedNoEchoValuesOf, Gl as crossPrefixDeniedWarning, Go as isReadableResourceEntry, Gr as withStackRecords, Gs as withheldAccountClause, Gt as nestedChildStackName$1, Gu as redactedCause, Hi as extractDeploymentEventError, Hl as CrossPrefixReadError, Hn as seedsDeleteFirstGuard, Ho as hasReadableOutputs, Hs as unpreviewableOrphanRecords, Ht as displacedPhysicalIdShown, Hu as isMalformedEnvKey, Ia as unsettledPropertiesOf, Ic as maskReadbackAtCoordinates, Id as describeFileReadFailure, Ii as ledgerForStack, Il as WHOLE_DYNAMIC_REFERENCE_PATTERN, In as planFailedOps, Io as UNREADABLE_ORPHANS_CONTAINER_ROW, Ir as isPairableType, Is as repairMalformedOrphanRecordsForReadOnly, It as pendingRequestCount, Iu as describeDockerFailure, Ja as producerLookupOver, Jl as stackInstanceIdOf, Jo as malformedExportSourceWarning, Jr as cyan, Jt as revertedNestedRowIds, Ju as runDockerStreaming, Kc as valueAtCoordinate, Kl as isAccessDenied, Kn as inheritProducerRegions, Ko as malformedDriftResourcePropertiesWarning, Ks as findActionableSdkUnwired, Kt as recordDisplacedSkips, Ku as redactedDockerCause, La as withUnsettledProperties, Lc as maskWholeValue, Ld as displayAssemblyPath, Ll as isSingleDynamicReferenceToken, Ln as planRollback, Lo as UNREADABLE_RESOURCES_MAP_ROW, Lr as looselyEqual, Ls as repairMalformedOrphansForReadOnly, Lt as resolvePendingCloudControlRequests, Lu as dockerSpawnEnvWithSensitive, Ma as INTRINSIC_KEYS, Mc as TemplateParser, Md as hasPlainPrototype, Mi as isFinalSnapshotError, Ml as recordNoEchoAttributeValues, Mn as undeclaredEmptyObservedKeys, Mo as declaresNoEcho, Mr as hintSidesOf, Ms as refuseMalformedResourcesForDeploy, Mt as mergeNoChangeOutputs, Mu as buildDockerImage, Nc as canonicalCoordinates, Nd as nullPrototypeRecord, Ni as refusesFinalSnapshot, Nl as recordNoEchoParameterFreshValue, Nn as demoteSupersededOrphans, No as JSON_LISTING_HOLE_VALUE, Nr as movedToHint, Ns as refuseMalformedResourcesForDestroy, Nt as makeCanonicalizePropertiesFn, Nu as resolveDockerContextDirectory, Od as parseFailureDebugDetail, Oi as buildFinalSnapshotIdentifier, Ol as carriesSecretMask, On as withUnprovenUnsettled, Or as constructPathOf$1, Os as refuseMalformedResourcePropertiesForDestroy, Ot as withResourceDeadline, Ou as readBootstrapMarkerBody, Pa as unsettledItemsField, Pc as isMarkedCoordinate, Pd as ownValue, Pi as unsupportedFinalSnapshotError, Pl as recordProvenPublicExpression, Pn as isJournaledOrphan, Po as STATE_REGION_DIVERGED, Pr as rollbackOrphanIds, Ps as refuseMalformedResourcesForExport, Pt as makeSiblingClaimReader, Pu as describeDockerCapturedOutput, Qa as recordedOutputReferenceRegions, Qc as carryLogOnlyValues, Ql as describeRegionValueKind, Qn as updatePartialReason, Qo as malformedOrphanRecordsRefusalMessage, Qr as yellow, Qs as hasNoCloudControlHandlers, Qt as withNestedStackContext, Qu as Synthesizer, Ra as withoutUnsettledProperties, Rc as maskedLeafCoordinatesOf, Rd as renderAssemblyPathEscape, Ri as withCreateTokenLedger, Rl as LockManager, Rn as recheckFailedPlan, Ro as accountArgs, Rr as mappingPairs, Rs as repairMalformedOutputsForReadOnly, Rt as keptForRetainedRecord, Ru as finchSecretArgvRefusal, Sa as deleteSkipReason, Sc as describeTypeWithThrottleRetry, Sd as canonicalizeRegion, Sl as recordNestedStackParameterExpressions, Sn as refusePendingMovesOut, So as keepsSecretReferenceToken, Sr as collectPublishedOutputNames, Ss as refuseMalformedResourceEntries, St as conditionFingerprint, Su as BOOTSTRAP_MARKER_PREFIX, Td as StageLoadError, Ti as storedSecretNameNeedles, Tn as removeProtectionTypeList, To as isStalePlaceholderArnAttribute, Tr as DEFAULT_RESOURCE_TIMEOUT_MS, Ts as refuseMalformedResourceEntriesForImport, Tt as readRecordedConditionVerdicts, Tu as getBootstrapMarkerKey, Uc as readbackPathFor, Ud as resolveBucketRegion, Ul as CrossPrefixScanCache, Un as orphanNeedsIdentity, Uo as hasReadableResources, Ur as destroyStackRecordsView, Us as unreadableOrphanRecords, Ut as dropSettledNestedJournals, Uu as partitionSensitiveEnv, Vc as noEchoOutputsComparison, Vd as injectedAwsRegionValue, Vi as DeploymentEventsStore, Vl as rebuildClientForBucketRegion, Vn as resolveReplacementOldType, Vo as hasReadableOrphans, Vs as repairMalformedResourcesForReadOnly, Vt as displacedOpClause, Vu as isDockerClientEnvKey, Wc as readsNoEchoSource, Wl as applyCrossPrefixScan, Wn as findNestedStackTypeChanges, Wo as isReadableOrphanRecord, Ws as unreadableResourceEntries, Wu as redactDockerArgvValues, Xa as keepHeldTokenProvenance, Xl as splitImportedOps, Xo as malformedLocalResourceEntriesWarning, Xr as green, Xt as collectNestedChildUnaddressed, Xu as AssetManifestLoader, Ya as refuseUnreadableCdkCrossAccountRefs, Yc as redactForState, Yl as withStackInstanceIdWithheld, Yo as malformedLocalOutputsWarning, Yr as gray, Ys as unwrittenCreateOnlyReplacement, Yt as withNestedRevertRun, Yu as warnFinchArgvExposure, Zl as acceptedCreateOnlyDropsOf, Zn as updatePartialMessage, Zo as malformedLocalResourcesWarning, Zr as red, Zs as NO_CC_HANDLERS_REASON, Zt as getCurrentNestedStackContext, Zu as getDockerImageBySourceHash, _d as uploadCfnTemplate, _i as maskEventTextWithBoundBags, _l as isUncertifiedBaselineMaskPosition, _n as sameMove, _o as getAccountInfo, _r as exportNameNoEchoParameters, _s as refuseMalformedOrphansForDestroy, _t as findNestedTemplateTreeDefect, _u as buildAssetRedirectMap, a as isProtectionValueActive, ad as resolveCaptureObservedState, ai as supersededHeldByOtherTypeWarning, al as recordLogOnlyValue, an as makeForeignHolderScan, ao as sendableAssumeRoleCommand, ar as withNameGenerationReached, as as malformedRenderedContainersWarning, au as isReadableBag, ba as deleteIndeterminateGuards, bc as prefetchCreateOnlyPropertyPaths, bd as expectedOwnerParam, bi as secretNamePrintingBag, bl as identityKeyFor, bn as pendingMovesOutOf, bo as carriesFetchableDynamicReference, br as noEchoParameterValueSeed, bs as refuseMalformedOutputsForDestroy, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, ca as isCustomResourceType$1, cd as resolveStateBucketWithDefaultAndSource, ci as withoutSuperseded, cl as createSecretMasker, co as callerEnvCredentials, cr as reachableDivergentParameters, cs as malformedResourcesWarning, cu as shouldRetainResource, da as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, dd as warnDeprecatedNoPrefixCliFlag, di as noEchoExactEchoLeavesOf, dl as maskSecretsInText, do as classifyReplaySecretRegion, dr as displayTextOrWithheld, ds as previewableOrphanRecords, dt as crossStackOutputProvenanceSource, du as renderPhaseTimings, ea as CC_BROKEN_REASON, ec as shownType, ed as getDefaultStateBucketName, ei as deleteSupersededEntry, el as hasMaskableValues, en as dropFailedCommands, eo as applyRoleArnIfSet, er as nameGenerationHighWaterOf, es as malformedOrphanRowsKeptWarning, eu as hasReadableExportSet, fa as applyCustomResourceResponseExpiration, fd as ssmResolvedValueType, fi as noEchoParameterNamesOf, fl as scrubResourceRecord, fn as readRefactorMarker, fo as producerRegionsFromState, fr as exportAliasCollisionScrubWarning, fs as refuseDivergentRecordRegionForDestroy, ft as inheritedProvenanceForChildDiff, fu as timePhase, gd as findLargeInlineResources, gi as journaledOrphanPrintingBag, gl as dynamicReferenceTokens, gn as refuseRefactorMarker, go as parameterTypeMayLoseSecretIdentity, gr as carriedExportAliasExposure, gs as refuseMalformedOrphans, gt as childTemplateLoader, gu as WorkGraph, ha as slowCcOperationTimeoutMs, hd as MIGRATE_TMP_PREFIX, hi as completedReplayEntries, hl as DYNAMIC_REFERENCE_TOKEN_SCAN, hn as refactorMarkerRefusalMessage, ho as isUnboundTemplateParameter, hr as secretSafeKeyDisplay, hs as refuseMalformedOrphanRecordsForDestroy, ht as serviceTokenBlockingReason, hu as stringifyValue, i as PROTECTION_PROPERTY_BY_TYPE, ia as wouldReturnToSdkProvider, ic as renderStatefulReason, id as resolveAutoAssetStorage, ii as supersededAfterRollback, il as recordLogOnlyParameterValue, in as loadJournaledOrphans, io as isIamRoleArn, ir as retiredNameGenerationsLeaving, is as malformedOutputsWarning, iu as importableOutputs, j as setResolvedResourceTimeouts, ja as DiffCalculator, jc as DagBuilder, jd as hasOwnKey, ji as effectiveDeletionPolicy, jl as recordMaskOnlyValuesIn, jn as equalModuloMask, jr as findRefactorHints, js as refuseMalformedResourcePropertiesForOrphan, jt as keptWholeReasonText, ju as buildDenyExternalAccessPolicy, kd as utf8ByteLength, ki as ccRoutedFinalSnapshotError, kl as provenPublicValue, kn as calculateResourceDrift, ko as withSharedDrainBudget, kr as findDestructiveChanges, ks as refuseMalformedResourcePropertiesForDrift, kt as diffSecurity, ku as validateAssetBucketName, ld as resolveUseCdkBootstrapAssets, li as noEchoAttributeNamesOf, ll as errorCauseChain, lo as envCredentialsAreAssumedRole, lr as resourcesNamingDeclaredParameter, ls as malformedScrubResourceEntriesRefusalMessage, lt as IMPLICIT_DELETE_DEPENDENCIES, lu as stackInstanceIdCarriedFrom, ma as CloudControlProvider, md as CFN_TEMPLATE_URL_LIMIT, mi as createReadOnlyAttributeHealerFactory, mn as refactorMarkerMovesOf, mo as coerceParameterTypedValue, mr as secretBearingStateKeyWarning, ms as refuseMalformedOrphanRecords, mt as findServiceTokenRefusals, mu as isSensitiveAttributeName, n as recordedProtectionEvidence, na as ccBrokenReason, nc as isStatefulRecreateTargetForReplace, nd as loadCdkJson, ni as isSupersededResourceRecord, nl as logOnlyValueCount, nn as isHandledOrphan, no as assertSendableRoleArn, nr as retiredAfterRollback, ns as malformedOrphansWarning, nu as hasUnverifiableParameterRefusal, o as perType, oa as TemplateNoEchoReresolver, od as resolveSkipPrefix, oi as supersededHolderOf, ol as shareLogOnlyValues, on as sameJournaledOrphans, oo as AWS_CREDENTIAL_ENV_KEYS, or as computeParameterTaint, os as malformedResourceEntriesWarning, ou as orphansAfterRollback, pa as customResourceResponseExpirationWarning, pd as CFN_TEMPLATE_BODY_LIMIT, pi as withAttemptedItemsMasked, pl as withPhysicalNameCopies, pn as readRefactorMarkerOnce, po as regionLessSecretName, pr as secretBearing, pt as deferredServiceTokenWarning, pu as AssetPublisher, qa as resolveDynamicReferences, qc as liveMatchesUnresolvedTokenFrame, ql as isNotImplemented, qo as malformedExportNamesWarning, qr as bold, qs as findHandledUnwrittenCreateOnly, qu as runDockerForeground, r as recordedProtectionNote, ra as isCustomResource, rc as isStatefulRecreateTargetSync, rd as resolveApp, ri as removeSuperseded, rl as printingCorpusOf, rn as journaledOrphanLines, ro as explicitRoleArnOrThrow, rr as retiredNameGenerationsAfter, rs as malformedOutputsRefusalMessage, ru as importableOutputKeys, s as readProtection, sa as readsNoEchoDeleteValues, sd as resolveStateBucketWithDefault, si as supersededResourcesOf, sl as unionOfSecretBags, sn as formatResourceLine, so as applyCallerIdentityCredentials, sr as namesAnyDeclaredParameter, ss as malformedResourcePropertiesWarning, su as orphansCarriedFrom, t as DeployEngine, ta as ProviderRegistry, tc as MULTI_REGION_RECREATE_BLOCKED_TYPES, td as getLegacyStateBucketName, ti as holdsSupersededResources, tl as literalSplitDelimitersOf, tn as dropFailedHint, to as assertFlagRoleArn, tr as nameScopeOf, ts as malformedOrphansRefusalMessage, tu as hasReasonlessBaselineRefusal, ua as withPrintingSecrets, uc as coerceCfnBoolean, ud as stateBucketExistenceConfirmed, ui as noEchoComparisonForTemplate, ul as maskSecretsInError, uo as classifyRecordedSecretRegion, ur as WITHHELD_NAME_DISPLAY, us as malformedStateRefusalMessage, ut as computeImplicitDeleteEdges, uu as PhaseClock, va as RollbackInlinePolicyWriters, vd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vi as namingSecretsWithRecordedNoEcho, vl as pathCrossesDottedKey, vn as updateRefactorMarker, vo as isImpossibleEmptyStoredAttribute, vr as exportNameSecretExposure, vs as refuseMalformedOrphansForOrphan, vt as isAbsoluteAssetPath, vu as createAssetRedirectResolver, wa as isWaitAbandonedError, wd as AssemblyReader, wi as stateSecretNameNeedles, wl as physicalNameCopiesOf, wn as replayRollback, wo as cfnRefValueFromPhysicalId, wr as bindingSkippedOutputs, ws as refuseMalformedResourceEntriesForDestroy, wt as parentSuppliedValues, wu as ensureAssetStorage, xa as deleteLeftInPlace, xc as templateResourceTypes, xd as PARTITION_TABLE, xi as secretNamePrintingBags, xl as inheritNestedStackParameterAssociations, xn as pendingMovesRefusalMessage, xo as isNamelessDynamicReferenceError, xr as collectDeclaredOutputNames, xs as refuseMalformedResourceAttributesForOrphan, xt as templateIdentity, xu as AssetModeResolver, ya as UNSPECIFIED_SKIP_REASON, yd as decodeListingKey, yi as orphanRecordsPrintingBag, yl as spelledKeysOf, yn as hasPendingMovesOut, yo as carriesDynamicReference, yr as isWholeDynamicReferenceValue, ys as refuseMalformedOutputs, yt as listNestedTemplateRows, yu as loadPublishableAssetManifest, za as IntrinsicFunctionResolver, zc as noEchoCoordinatesOf, zd as resolveAssemblyPath, zl as isLockInfoExpired, zn as recordUnderIdIsNotOwn, zo as deployRefusesOrphanRowsReason, zr as parseMappingFile, zs as repairMalformedResourceEntriesForReadOnly, zt as recordRetainedForReadoption, zu as formatDockerLoginError } from "./deploy-engine-l-wZygYT.js";
-import { t as getCdkdVersion } from "./version-C8PfUSmt.js";
+import { $a as recordedReferenceRegions, $c as createUnionSecretMasker, $l as exportNamesCarriedFrom, $n as nameGenerationCarriedFrom, $o as malformedOrphanRecordsWarning, $r as addSuperseded, $s as findReplacedReadersOfRecreateTargets, $t as deleteJournaledOrphans, $u as synthesisStatusMessage, Ad as defineOwnKey, Ai as createPreDeleteFinalSnapshot, Al as recordMaskOnlyValue, An as equalModuloMarkedMask, Ao as parameterInputsFor, Ar as formatDestructiveChange, As as refuseMalformedResourcePropertiesForExport, At as isSecretBearingReferenceString, Au as validateContainerRepoName, Ba as poisonRenderedSpellingsCollidingIn, Bc as noEchoLeavesOf, Bd as injectAwsRegion, Bi as DeploymentEventsReader, Bl as S3StateBackend, Bn as replacementNeverSwapped, Bo as displayLogicalId, Br as proposeRenames, Bs as repairMalformedResourcePropertiesForReadOnly, Bt as NESTED_PENDING_PARENT_REASON, Bu as getDockerCmd, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Ci as secretNamedRecordNeedles, Cn as replayFailedOperations, Co as AWS_NO_VALUE, Cr as isExportAliasCollision, Cs as refuseMalformedResourceEntriesForDeploy, Ct as conditionInputsFrom, Cu as assertAssetBucketRegion, Dd as describeJsonParseFailure, Di as PRE_DELETE_SNAPSHOT_TYPES, Dl as splitGetAttStringForm, Dn as settleUnsettledPrevious, Do as refStateLookupFromResource, Dr as maskingRetryLogger, Ds as refuseMalformedResourceEntriesForOrphan, Du as parseBootstrapMarker, Ed as processStackMessages, Ei as ATOMIC_FINAL_SNAPSHOT_TYPES, El as recordPhysicalNameCopy, En as recordAfterRollbackUpdate, Eo as lacksRecordedTableArn, Er as DEFAULT_RESOURCE_WARN_AFTER_MS, Es as refuseMalformedResourceEntriesForImportSave, Eu as isCrossRegionRedirect, Fa as unsettledItemsOf, Fc as maskAtCoordinates, Fd as absoluteAssemblyPathEscape, Fl as wholeStringLeavesOf, Fn as isReplacementOrphan, Fo as STATE_RESOURCES_MALFORMED, Fr as withMovedTo, Fs as refuseMalformedState, Ft as planOrphanAdoption, Fu as describeDockerExecFailure, Gc as recordedNoEchoValuesOf, Gl as crossPrefixDeniedWarning, Go as isReadableResourceEntry, Gr as withStackRecords, Gs as withheldAccountClause, Gt as nestedChildStackName$1, Gu as redactedCause, Hi as extractDeploymentEventError, Hl as CrossPrefixReadError, Hn as seedsDeleteFirstGuard, Ho as hasReadableOutputs, Hs as unpreviewableOrphanRecords, Ht as displacedPhysicalIdShown, Hu as isMalformedEnvKey, Ia as unsettledPropertiesOf, Ic as maskReadbackAtCoordinates, Id as describeFileReadFailure, Ii as ledgerForStack, Il as WHOLE_DYNAMIC_REFERENCE_PATTERN, In as planFailedOps, Io as UNREADABLE_ORPHANS_CONTAINER_ROW, Ir as isPairableType, Is as repairMalformedOrphanRecordsForReadOnly, It as pendingRequestCount, Iu as describeDockerFailure, Ja as producerLookupOver, Jl as stackInstanceIdOf, Jo as malformedExportSourceWarning, Jr as cyan, Jt as revertedNestedRowIds, Ju as runDockerStreaming, Kc as valueAtCoordinate, Kl as isAccessDenied, Kn as inheritProducerRegions, Ko as malformedDriftResourcePropertiesWarning, Ks as findActionableSdkUnwired, Kt as recordDisplacedSkips, Ku as redactedDockerCause, La as withUnsettledProperties, Lc as maskWholeValue, Ld as displayAssemblyPath, Ll as isSingleDynamicReferenceToken, Ln as planRollback, Lo as UNREADABLE_RESOURCES_MAP_ROW, Lr as looselyEqual, Ls as repairMalformedOrphansForReadOnly, Lt as resolvePendingCloudControlRequests, Lu as dockerSpawnEnvWithSensitive, Ma as INTRINSIC_KEYS, Mc as TemplateParser, Md as hasPlainPrototype, Mi as isFinalSnapshotError, Ml as recordNoEchoAttributeValues, Mn as undeclaredEmptyObservedKeys, Mo as declaresNoEcho, Mr as hintSidesOf, Ms as refuseMalformedResourcesForDeploy, Mt as mergeNoChangeOutputs, Mu as buildDockerImage, Nc as canonicalCoordinates, Nd as nullPrototypeRecord, Ni as refusesFinalSnapshot, Nl as recordNoEchoParameterFreshValue, Nn as demoteSupersededOrphans, No as JSON_LISTING_HOLE_VALUE, Nr as movedToHint, Ns as refuseMalformedResourcesForDestroy, Nt as makeCanonicalizePropertiesFn, Nu as resolveDockerContextDirectory, Od as parseFailureDebugDetail, Oi as buildFinalSnapshotIdentifier, Ol as carriesSecretMask, On as withUnprovenUnsettled, Or as constructPathOf$1, Os as refuseMalformedResourcePropertiesForDestroy, Ot as withResourceDeadline, Ou as readBootstrapMarkerBody, Pa as unsettledItemsField, Pc as isMarkedCoordinate, Pd as ownValue, Pi as unsupportedFinalSnapshotError, Pl as recordProvenPublicExpression, Pn as isJournaledOrphan, Po as STATE_REGION_DIVERGED, Pr as rollbackOrphanIds, Ps as refuseMalformedResourcesForExport, Pt as makeSiblingClaimReader, Pu as describeDockerCapturedOutput, Qa as recordedOutputReferenceRegions, Qc as carryLogOnlyValues, Ql as describeRegionValueKind, Qn as updatePartialReason, Qo as malformedOrphanRecordsRefusalMessage, Qr as yellow, Qs as hasNoCloudControlHandlers, Qt as withNestedStackContext, Qu as Synthesizer, Ra as withoutUnsettledProperties, Rc as maskedLeafCoordinatesOf, Rd as renderAssemblyPathEscape, Ri as withCreateTokenLedger, Rl as LockManager, Rn as recheckFailedPlan, Ro as accountArgs, Rr as mappingPairs, Rs as repairMalformedOutputsForReadOnly, Rt as keptForRetainedRecord, Ru as finchSecretArgvRefusal, Sa as deleteSkipReason, Sc as describeTypeWithThrottleRetry, Sd as canonicalizeRegion, Sl as recordNestedStackParameterExpressions, Sn as refusePendingMovesOut, So as keepsSecretReferenceToken, Sr as collectPublishedOutputNames, Ss as refuseMalformedResourceEntries, St as conditionFingerprint, Su as BOOTSTRAP_MARKER_PREFIX, Td as StageLoadError, Ti as storedSecretNameNeedles, Tn as removeProtectionTypeList, To as isStalePlaceholderArnAttribute, Tr as DEFAULT_RESOURCE_TIMEOUT_MS, Ts as refuseMalformedResourceEntriesForImport, Tt as readRecordedConditionVerdicts, Tu as getBootstrapMarkerKey, Uc as readbackPathFor, Ud as resolveBucketRegion, Ul as CrossPrefixScanCache, Un as orphanNeedsIdentity, Uo as hasReadableResources, Ur as destroyStackRecordsView, Us as unreadableOrphanRecords, Ut as dropSettledNestedJournals, Uu as partitionSensitiveEnv, Vc as noEchoOutputsComparison, Vd as injectedAwsRegionValue, Vi as DeploymentEventsStore, Vl as rebuildClientForBucketRegion, Vn as resolveReplacementOldType, Vo as hasReadableOrphans, Vs as repairMalformedResourcesForReadOnly, Vt as displacedOpClause, Vu as isDockerClientEnvKey, Wc as readsNoEchoSource, Wl as applyCrossPrefixScan, Wn as findNestedStackTypeChanges, Wo as isReadableOrphanRecord, Ws as unreadableResourceEntries, Wu as redactDockerArgvValues, Xa as keepHeldTokenProvenance, Xl as splitImportedOps, Xo as malformedLocalResourceEntriesWarning, Xr as green, Xt as collectNestedChildUnaddressed, Xu as AssetManifestLoader, Ya as refuseUnreadableCdkCrossAccountRefs, Yc as redactForState, Yl as withStackInstanceIdWithheld, Yo as malformedLocalOutputsWarning, Yr as gray, Ys as unwrittenCreateOnlyReplacement, Yt as withNestedRevertRun, Yu as warnFinchArgvExposure, Zl as acceptedCreateOnlyDropsOf, Zn as updatePartialMessage, Zo as malformedLocalResourcesWarning, Zr as red, Zs as NO_CC_HANDLERS_REASON, Zt as getCurrentNestedStackContext, Zu as getDockerImageBySourceHash, _d as uploadCfnTemplate, _i as maskEventTextWithBoundBags, _l as isUncertifiedBaselineMaskPosition, _n as sameMove, _o as getAccountInfo, _r as exportNameNoEchoParameters, _s as refuseMalformedOrphansForDestroy, _t as findNestedTemplateTreeDefect, _u as buildAssetRedirectMap, a as isProtectionValueActive, ad as resolveCaptureObservedState, ai as supersededHeldByOtherTypeWarning, al as recordLogOnlyValue, an as makeForeignHolderScan, ao as sendableAssumeRoleCommand, ar as withNameGenerationReached, as as malformedRenderedContainersWarning, au as isReadableBag, ba as deleteIndeterminateGuards, bc as prefetchCreateOnlyPropertyPaths, bd as expectedOwnerParam, bi as secretNamePrintingBag, bl as identityKeyFor, bn as pendingMovesOutOf, bo as carriesFetchableDynamicReference, br as noEchoParameterValueSeed, bs as refuseMalformedOutputsForDestroy, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, ca as isCustomResourceType$1, cd as resolveStateBucketWithDefaultAndSource, ci as withoutSuperseded, cl as createSecretMasker, co as callerEnvCredentials, cr as reachableDivergentParameters, cs as malformedResourcesWarning, cu as shouldRetainResource, da as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, dd as warnDeprecatedNoPrefixCliFlag, di as noEchoExactEchoLeavesOf, dl as maskSecretsInText, do as classifyReplaySecretRegion, dr as displayTextOrWithheld, ds as previewableOrphanRecords, dt as crossStackOutputProvenanceSource, du as renderPhaseTimings, ea as CC_BROKEN_REASON, ec as shownType, ed as getDefaultStateBucketName, ei as deleteSupersededEntry, el as hasMaskableValues, en as dropFailedCommands, eo as applyRoleArnIfSet, er as nameGenerationHighWaterOf, es as malformedOrphanRowsKeptWarning, eu as hasReadableExportSet, fa as applyCustomResourceResponseExpiration, fd as ssmResolvedValueType, fi as noEchoParameterNamesOf, fl as scrubResourceRecord, fn as readRefactorMarker, fo as producerRegionsFromState, fr as exportAliasCollisionScrubWarning, fs as refuseDivergentRecordRegionForDestroy, ft as inheritedProvenanceForChildDiff, fu as timePhase, gd as findLargeInlineResources, gi as journaledOrphanPrintingBag, gl as dynamicReferenceTokens, gn as refuseRefactorMarker, go as parameterTypeMayLoseSecretIdentity, gr as carriedExportAliasExposure, gs as refuseMalformedOrphans, gt as childTemplateLoader, gu as WorkGraph, ha as slowCcOperationTimeoutMs, hd as MIGRATE_TMP_PREFIX, hi as completedReplayEntries, hl as DYNAMIC_REFERENCE_TOKEN_SCAN, hn as refactorMarkerRefusalMessage, ho as isUnboundTemplateParameter, hr as secretSafeKeyDisplay, hs as refuseMalformedOrphanRecordsForDestroy, ht as serviceTokenBlockingReason, hu as stringifyValue, i as PROTECTION_PROPERTY_BY_TYPE, ia as wouldReturnToSdkProvider, ic as renderStatefulReason, id as resolveAutoAssetStorage, ii as supersededAfterRollback, il as recordLogOnlyParameterValue, in as loadJournaledOrphans, io as isIamRoleArn, ir as retiredNameGenerationsLeaving, is as malformedOutputsWarning, iu as importableOutputs, j as setResolvedResourceTimeouts, ja as DiffCalculator, jc as DagBuilder, jd as hasOwnKey, ji as effectiveDeletionPolicy, jl as recordMaskOnlyValuesIn, jn as equalModuloMask, jr as findRefactorHints, js as refuseMalformedResourcePropertiesForOrphan, jt as keptWholeReasonText, ju as buildDenyExternalAccessPolicy, kd as utf8ByteLength, ki as ccRoutedFinalSnapshotError, kl as provenPublicValue, kn as calculateResourceDrift, ko as withSharedDrainBudget, kr as findDestructiveChanges, ks as refuseMalformedResourcePropertiesForDrift, kt as diffSecurity, ku as validateAssetBucketName, ld as resolveUseCdkBootstrapAssets, li as noEchoAttributeNamesOf, ll as errorCauseChain, lo as envCredentialsAreAssumedRole, lr as resourcesNamingDeclaredParameter, ls as malformedScrubResourceEntriesRefusalMessage, lt as IMPLICIT_DELETE_DEPENDENCIES, lu as stackInstanceIdCarriedFrom, ma as CloudControlProvider, md as CFN_TEMPLATE_URL_LIMIT, mi as createReadOnlyAttributeHealerFactory, mn as refactorMarkerMovesOf, mo as coerceParameterTypedValue, mr as secretBearingStateKeyWarning, ms as refuseMalformedOrphanRecords, mt as findServiceTokenRefusals, mu as isSensitiveAttributeName, n as recordedProtectionEvidence, na as ccBrokenReason, nc as isStatefulRecreateTargetForReplace, nd as loadCdkJson, ni as isSupersededResourceRecord, nl as logOnlyValueCount, nn as isHandledOrphan, no as assertSendableRoleArn, nr as retiredAfterRollback, ns as malformedOrphansWarning, nu as hasUnverifiableParameterRefusal, o as perType, oa as TemplateNoEchoReresolver, od as resolveSkipPrefix, oi as supersededHolderOf, ol as shareLogOnlyValues, on as sameJournaledOrphans, oo as AWS_CREDENTIAL_ENV_KEYS, or as computeParameterTaint, os as malformedResourceEntriesWarning, ou as orphansAfterRollback, pa as customResourceResponseExpirationWarning, pd as CFN_TEMPLATE_BODY_LIMIT, pi as withAttemptedItemsMasked, pl as withPhysicalNameCopies, pn as readRefactorMarkerOnce, po as regionLessSecretName, pr as secretBearing, pt as deferredServiceTokenWarning, pu as AssetPublisher, qa as resolveDynamicReferences, qc as liveMatchesUnresolvedTokenFrame, ql as isNotImplemented, qo as malformedExportNamesWarning, qr as bold, qs as findHandledUnwrittenCreateOnly, qu as runDockerForeground, r as recordedProtectionNote, ra as isCustomResource, rc as isStatefulRecreateTargetSync, rd as resolveApp, ri as removeSuperseded, rl as printingCorpusOf, rn as journaledOrphanLines, ro as explicitRoleArnOrThrow, rr as retiredNameGenerationsAfter, rs as malformedOutputsRefusalMessage, ru as importableOutputKeys, s as readProtection, sa as readsNoEchoDeleteValues, sd as resolveStateBucketWithDefault, si as supersededResourcesOf, sl as unionOfSecretBags, sn as formatResourceLine, so as applyCallerIdentityCredentials, sr as namesAnyDeclaredParameter, ss as malformedResourcePropertiesWarning, su as orphansCarriedFrom, t as DeployEngine, ta as ProviderRegistry, tc as MULTI_REGION_RECREATE_BLOCKED_TYPES, td as getLegacyStateBucketName, ti as holdsSupersededResources, tl as literalSplitDelimitersOf, tn as dropFailedHint, to as assertFlagRoleArn, tr as nameScopeOf, ts as malformedOrphansRefusalMessage, tu as hasReasonlessBaselineRefusal, ua as withPrintingSecrets, uc as coerceCfnBoolean, ud as stateBucketExistenceConfirmed, ui as noEchoComparisonForTemplate, ul as maskSecretsInError, uo as classifyRecordedSecretRegion, ur as WITHHELD_NAME_DISPLAY, us as malformedStateRefusalMessage, ut as computeImplicitDeleteEdges, uu as PhaseClock, va as RollbackInlinePolicyWriters, vd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vi as namingSecretsWithRecordedNoEcho, vl as pathCrossesDottedKey, vn as updateRefactorMarker, vo as isImpossibleEmptyStoredAttribute, vr as exportNameSecretExposure, vs as refuseMalformedOrphansForOrphan, vt as isAbsoluteAssetPath, vu as createAssetRedirectResolver, wa as isWaitAbandonedError, wd as AssemblyReader, wi as stateSecretNameNeedles, wl as physicalNameCopiesOf, wn as replayRollback, wo as cfnRefValueFromPhysicalId, wr as bindingSkippedOutputs, ws as refuseMalformedResourceEntriesForDestroy, wt as parentSuppliedValues, wu as ensureAssetStorage, xa as deleteLeftInPlace, xc as templateResourceTypes, xd as PARTITION_TABLE, xi as secretNamePrintingBags, xl as inheritNestedStackParameterAssociations, xn as pendingMovesRefusalMessage, xo as isNamelessDynamicReferenceError, xr as collectDeclaredOutputNames, xs as refuseMalformedResourceAttributesForOrphan, xt as templateIdentity, xu as AssetModeResolver, ya as UNSPECIFIED_SKIP_REASON, yd as decodeListingKey, yi as orphanRecordsPrintingBag, yl as spelledKeysOf, yn as hasPendingMovesOut, yo as carriesDynamicReference, yr as isWholeDynamicReferenceValue, ys as refuseMalformedOutputs, yt as listNestedTemplateRows, yu as loadPublishableAssetManifest, za as IntrinsicFunctionResolver, zc as noEchoCoordinatesOf, zd as resolveAssemblyPath, zl as isLockInfoExpired, zn as recordUnderIdIsNotOwn, zo as deployRefusesOrphanRowsReason, zr as parseMappingFile, zs as repairMalformedResourceEntriesForReadOnly, zt as recordRetainedForReadoption, zu as formatDockerLoginError } from "./deploy-engine-CykA53H2.js";
+import { t as getCdkdVersion } from "./version-BUANWGDH.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -27,7 +27,7 @@ import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLError, YAMLMap, YAMLSeq, isScalar, parse, parseDocument, stringify, visit } from "yaml";
 import { emitKeypressEvents } from "node:readline";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, recordAssumedRole, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addImageOverrideOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, canonicalizeImageOverrideKeys, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, enforceImageOverrideOrphans, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseImageOverrideFlags, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, recordAssumedRole, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveImageOverrides, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStartMicrovmCommand, createLocalStartWebFunctionCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -2690,7 +2690,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 // src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-D60y4umw.js");
+	providerClasses ??= import("./provider-classes-DDQoh7PA.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -25341,6 +25341,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	if (user !== void 0) out.user = user;
 	if (privileged !== void 0) out.privileged = privileged;
 	if (readonlyRootFilesystem !== void 0) out.readonlyRootFilesystem = readonlyRootFilesystem;
+	if (droppedSecretKeys.length > 0) out.droppedSecretNames = droppedSecretKeys.map((d) => d.key);
 	return out;
 }
 function buildSubstitutionContextFromImageContext(context) {
@@ -25369,10 +25370,11 @@ function isCdkAssetImageUri(uri, cdkAssetContainerRepo) {
 }
 function parseContainerImage(raw, containerName, taskLogicalId, resources, _stack, context) {
 	const getAttImage = tryResolveImageGetAtt(raw, resources, context);
-	if (getAttImage) return classifyResolvedImage(getAttImage, context?.cdkAssetContainerRepo);
+	if (getAttImage?.kind === "resolved") return classifyResolvedImage(getAttImage.uri, context?.cdkAssetContainerRepo);
+	if (getAttImage?.kind === "needs-state") return sameStackEcrImage(containerName, taskLogicalId, getAttImage.repoLogicalId);
 	const joinResolved = tryResolveImageFnJoin(raw, resources, context);
 	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri, context?.cdkAssetContainerRepo);
-	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local run-task cannot resolve the repository URI without state — pass --from-state (the stack must have been deployed via cdkd deploy), build via ContainerImage.fromAsset, or pin a public image.`);
+	if (joinResolved.kind === "needs-state") return sameStackEcrImage(containerName, taskLogicalId, joinResolved.repoLogicalId, " via Fn::Join");
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. cdkd local run-task recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. cdkd local run-task v1 supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
@@ -25385,7 +25387,7 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	const substituted = substituteImagePlaceholders(flat, resources, context);
 	if (substituted.includes("${")) {
 		const unresolvedRepoRef = findUnresolvedEcrRepositoryRef(substituted, resources);
-		if (unresolvedRepoRef) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${unresolvedRepoRef}'. cdkd local run-task v1 cannot resolve the repository URI without state — pass --from-state (the stack must have been deployed via cdkd deploy), build via ContainerImage.fromAsset, or pin a public image.`);
+		if (unresolvedRepoRef) return sameStackEcrImage(containerName, taskLogicalId, unresolvedRepoRef);
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). cdkd could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). cdkd local run-task v1 only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
@@ -25432,6 +25434,21 @@ function classifyResolvedImage(uri, cdkAssetContainerRepo) {
 		uri
 	};
 }
+function sameStackEcrImage(containerName, taskLogicalId, repoLogicalId, via = "") {
+	return {
+		kind: "same-stack-ecr",
+		repoLogicalId,
+		unresolvedReason: `Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${repoLogicalId}'${via}. cdkd local run-task cannot resolve the repository URI without state — pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed), build via ContainerImage.fromAsset, pin a public image, or pass --image-override to build it from a local Dockerfile.`
+	};
+}
+function assertEcsTaskImagesResolvable(task, coveredContainers = /* @__PURE__ */ new Set()) {
+	const reasons = [];
+	for (const c of task.containers) {
+		if (c.image.kind !== "same-stack-ecr" || coveredContainers.has(c.name)) continue;
+		reasons.push(c.image.unresolvedReason);
+	}
+	if (reasons.length > 0) throw new EcsTaskResolutionError(reasons.join("\n"));
+}
 function tryResolveImageGetAtt(raw, resources, context) {
 	if (!raw || typeof raw !== "object") return void 0;
 	const arg = raw["Fn::GetAtt"];
@@ -25452,7 +25469,14 @@ function tryResolveImageGetAtt(raw, resources, context) {
 	if (resources[logicalId]?.Type !== "AWS::ECR::Repository") return void 0;
 	if (attr !== "RepositoryUri" && attr !== "Arn") return void 0;
 	const cached = context?.stateResources?.[logicalId]?.attributes?.[attr];
-	if (typeof cached === "string" && cached.length > 0) return cached;
+	if (typeof cached === "string" && cached.length > 0) return {
+		kind: "resolved",
+		uri: cached
+	};
+	if (attr === "RepositoryUri") return {
+		kind: "needs-state",
+		repoLogicalId: logicalId
+	};
 }
 function extractImageString(value) {
 	if (typeof value === "string" && value.length > 0) return value;
@@ -25640,6 +25664,7 @@ async function applyCrossStackResolverToTask(task, context) {
 					valueFrom: sub.value
 				});
 				resolvedSecretNames.add(sName);
+				if (container.droppedSecretNames) container.droppedSecretNames = container.droppedSecretNames.filter((n) => n !== sName);
 			}
 		}
 		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
@@ -28244,6 +28269,7 @@ function createLocalStartApiCommand() {
 const execFileAsync$2 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
+const TASK_ROLE_CREDENTIALS_PATH = "/creds";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
 function buildEndpointSubnet(subnetOctet) {
 	if (subnetOctet < 1 || subnetOctet > 254 || !Number.isInteger(subnetOctet)) throw new Error(`buildEndpointSubnet: subnetOctet must be an integer in 1..254 (got ${subnetOctet}).`);
@@ -28269,7 +28295,7 @@ async function createNetworkAndSidecar(args) {
 	try {
 		await execFileAsync$2(getDockerCmd(), createArgs);
 	} catch (err) {
-		throw new DockerRunnerError(`docker network create failed: ${describeDockerFailure(err, createArgs)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local start-service\` shares one network across every service in the run; bare \`cdkd local run-task\` uses a per-task network so only one run can be active at a time.`);
+		throw new DockerRunnerError(`docker network create failed: ${describeDockerFailure(err, createArgs)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local run-task\` always uses 169.254.170.0/24, where AWS SDKs read task-role credentials, as does a \`cdkd local start-service\` / \`start-alb\` run with \`--assume-role\`, so only one of them can be active at a time.`);
 	}
 	const sidecarArgs = [
 		"run",
@@ -28337,7 +28363,10 @@ function buildMetadataEnv(opts) {
 		ECS_CONTAINER_METADATA_URI_V4: `http://${ip}/v4/${opts.containerName}`,
 		ECS_CONTAINER_METADATA_URI: `http://${ip}/v3/${opts.containerName}`
 	};
-	if (opts.roleArn) env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = `/role/${encodeURIComponent(opts.roleArn)}`;
+	if (opts.roleArn) {
+		if (ip !== "169.254.170.2") throw new DockerRunnerError(`A task role needs the metadata sidecar at ${METADATA_ENDPOINT_IP} (SDKs read task-role credentials only from there), but this task's network put it at ${ip}.`);
+		env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = TASK_ROLE_CREDENTIALS_PATH;
+	}
 	if (opts.region) env["AWS_REGION"] = opts.region;
 	return env;
 }
@@ -28615,6 +28644,7 @@ async function runEcsTask(task, options, state) {
 	for (const c of task.containers) {
 		const refusal = finchSecretArgvRefusal([
 			...c.secrets.map((s) => s.name),
+			...(c.droppedSecretNames ?? []).filter((n) => overriddenEnvKeys(options.envOverrides, c.name).includes(n)),
 			...c.resolvedDynamicReferenceKeys ?? [],
 			...dynamicReferenceEnvKeys(c, options.envOverrides)
 		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
@@ -28634,11 +28664,20 @@ async function runEcsTask(task, options, state) {
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
-	for (const c of task.containers) for (const s of c.secrets) allSecrets.push({
-		containerName: c.name,
-		name: s.name,
-		valueFrom: s.valueFrom
-	});
+	for (const c of task.containers) {
+		const overridden = new Set(overriddenEnvKeys(options.envOverrides, c.name));
+		for (const s of c.secrets) {
+			if (overridden.has(s.name)) {
+				logger.debug(safeMsg`Secret ${displayIdent(c.name)}.${displayIdent(s.name)} not fetched: --env-vars gives this key.`);
+				continue;
+			}
+			allSecrets.push({
+				containerName: c.name,
+				name: s.name,
+				valueFrom: s.valueFrom
+			});
+		}
+	}
 	const secretsByContainer = groupSecretsByContainer(await resolveEcsSecrets(allSecrets, { ...options.region !== void 0 && { region: options.region } }));
 	const dynamicEnvByContainer = /* @__PURE__ */ new Map();
 	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
@@ -28670,7 +28709,7 @@ async function runEcsTask(task, options, state) {
 		};
 		if (options.taskCredentials) netCreateOpts.credentials = options.taskCredentials;
 		if (options.cluster) netCreateOpts.cluster = options.cluster;
-		if (options.subnetOctet !== void 0) netCreateOpts.subnetOctet = options.subnetOctet;
+		if (options.subnetOctet !== void 0 && !options.taskRoleArn) netCreateOpts.subnetOctet = options.subnetOctet;
 		await runDockerStep(state, () => createTaskNetwork(netCreateOpts), (net) => {
 			state.network = net;
 		}, () => destroyTaskNetwork({
@@ -28928,6 +28967,12 @@ function writePrefixed(prefix, buffer, out) {
 async function prepareImages(task, out, options) {
 	const logger = getLogger().child("ecs-runner");
 	for (const container of task.containers) {
+		const overrideTag = options.imageOverrideByContainer?.get(container.name);
+		if (overrideTag !== void 0) {
+			out.set(container.name, overrideTag);
+			logger.debug(safeMsg`Container ${displayIdent(container.name)} image=${displayIdent(overrideTag)} (--image-override)`);
+			continue;
+		}
 		const image = await prepareOneImage(task, container, options);
 		out.set(container.name, image);
 		logger.debug(`Container '${container.name}' image=${image}`);
@@ -28936,6 +28981,7 @@ async function prepareImages(task, out, options) {
 async function prepareOneImage(task, container, options) {
 	const image = container.image;
 	switch (image.kind) {
+		case "same-stack-ecr": throw new EcsTaskRunnerError(image.unresolvedReason);
 		case "public":
 			await pullImage(image.uri, options.skipPull);
 			return image.uri;
@@ -29109,6 +29155,8 @@ function buildDockerRunArgs(opts) {
 	const sensitiveKeys = /* @__PURE__ */ new Set([
 		...SENSITIVE_ENV_KEYS,
 		...secrets.map((s) => s.name),
+		...container.secrets.map((s) => s.name),
+		...container.droppedSecretNames ?? [],
 		...opts.plaintextEnvKeys ?? []
 	]);
 	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys, { subject: `Container '${container.name}'` });
@@ -29222,6 +29270,8 @@ async function localRunTaskCommand(target, options) {
 		stateProvider = createLocalStateProvider$1(options, candidate?.stackName ?? "", candidate?.region);
 		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
+		const canPrompt = options.interactiveOverrides !== false && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+		if (!options.imageOverride?.length && !canPrompt) assertEcsTaskImagesResolvable(task);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
 		const taskStack = stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack;
 		const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
@@ -29285,6 +29335,15 @@ async function localRunTaskCommand(target, options) {
 		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
+		const imageOverrideResult = await resolveRunTaskImageOverride({
+			task,
+			target,
+			options,
+			cwd: process.cwd()
+		});
+		if (imageOverrideResult.imageOverrideByContainer) runOpts.imageOverrideByContainer = imageOverrideResult.imageOverrideByContainer;
+		assertEcsTaskImagesResolvable(task, runOpts.imageOverrideByContainer);
+		if (!imageOverrideResult.imageOverrideByContainer && imageOverrideResult.pinnedUncovered) logger.warn("Task definition image is pinned to a deployed registry; local source edits will not take effect. Pass --image-override <dockerfile> to rebuild it from local source.");
 		let result;
 		try {
 			result = await runEcsTask(task, runOpts, state);
@@ -29412,8 +29471,9 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 			ctx.stateResources = loaded.resources;
 			stateRecordRegion = loaded.region;
 		}
-	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
-	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	} else if (!stateProvider && needs.needsStateResources) {
+		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the run stops before any container starts.");
+	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	if (needs.needsAssetRepoMarker && options.fromState) {
 		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
 			statePrefix: options.statePrefix,
@@ -29525,6 +29585,7 @@ function buildRunEcsTaskOptions(options, channels, extra = {}) {
 }
 function createLocalRunTaskCommand() {
 	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
+	addImageOverrideOptions(cmd);
 	[
 		...commonOptions,
 		...appOptions,
@@ -29534,6 +29595,57 @@ function createLocalRunTaskCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+function runTaskOverrideKeyAliases(task) {
+	const id = task.taskDefinitionLogicalId;
+	const out = /* @__PURE__ */ new Set([id, `${task.stack.stackName}:${id}`]);
+	const metadata = task.resource.Metadata;
+	const cdkPath = typeof metadata?.["aws:cdk:path"] === "string" ? metadata["aws:cdk:path"] : "";
+	if (cdkPath.length > 0) {
+		const segments = cdkPath.split("/");
+		while (segments.length > 1 && [
+			"Service",
+			"Resource",
+			"Default"
+		].includes(segments[segments.length - 1])) segments.pop();
+		const tail = segments[segments.length - 1];
+		if (tail) out.add(tail);
+	}
+	out.delete("");
+	return [...out];
+}
+async function resolveRunTaskImageOverride(args) {
+	const { task, target, options, cwd } = args;
+	const essential = task.containers.find((c) => c.essential) ?? task.containers[0];
+	const pinned = essential !== void 0 && essential.image.kind !== "cdk-asset";
+	const pinnedTargets = pinned ? [target] : [];
+	const pinnedLabels = /* @__PURE__ */ new Map();
+	if (pinned) pinnedLabels.set(target, `${task.stack.stackName}/${task.taskDefinitionLogicalId}`);
+	const pinnedAliases = /* @__PURE__ */ new Map();
+	if (pinned) pinnedAliases.set(target, runTaskOverrideKeyAliases(task));
+	const rawFlags = canonicalizeImageOverrideKeys(parseImageOverrideFlags({
+		...options.imageOverride && { imageOverride: options.imageOverride },
+		...options.imageBuildArg && { imageBuildArg: options.imageBuildArg },
+		...options.imageBuildSecret && { imageBuildSecret: options.imageBuildSecret },
+		...options.imageTarget && { imageTarget: options.imageTarget },
+		...options.imageContext && { imageContext: options.imageContext }
+	}), pinnedAliases, [target]);
+	if (pinnedTargets.length === 0 && rawFlags.explicit.size === 0 && rawFlags.pickerPaths.length === 0 && rawFlags.perService.size === 0) return {};
+	const overrides = await resolveImageOverrides({
+		rawFlags,
+		pinnedTargets,
+		pinnedLabels,
+		interactiveBootPrompt: true,
+		noInteractive: options.interactiveOverrides === false,
+		...cwd !== void 0 ? { cwd } : {}
+	});
+	enforceImageOverrideOrphans(rawFlags, overrides);
+	const uncovered = pinnedTargets.filter((t) => !overrides.has(t));
+	if (options.strictOverrides === true && uncovered.length > 0) throw new CdkdError("--strict-overrides set, but the task definition image is pinned to a deployed registry and no --image-override covered it. Pass --image-override <dockerfile> to rebuild it from local source, or drop --strict-overrides to run the pinned image as-is.", "LOCAL_RUN_TASK_STRICT_OVERRIDES");
+	if (overrides.size === 0) return { pinnedUncovered: pinned };
+	const tag = (await runImageOverrideBuilds(overrides)).get(target);
+	if (tag !== void 0 && essential !== void 0) return { imageOverrideByContainer: /* @__PURE__ */ new Map([[essential.name, tag]]) };
+	return { pinnedUncovered: pinned && uncovered.length > 0 };
+}
 
 // src/cli/commands/local-host-synthesizer.ts
 function cdkdHostSynthesizer(readOptions) {
@@ -31586,4 +31698,4 @@ function collectVerbFlags(program) {
 }
 
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-ml6yCB64.js.map
+//# sourceMappingURL=program-BY7FvEwy.js.map