@go-to-k/cdkd 0.285.11 → 0.285.13

package/dist/{program-BeYoZQIP.js → program-DHJ4G_ZZ.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-CJdl4I5l.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-DhMm2M33.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CHHsJMqE.js";
-import { t as ASGProvider } from "./asg-provider--XFrKRbw.js";
+import { t as getCdkdVersion } from "./version-FLW4rE5A.js";
+import { t as ASGProvider } from "./asg-provider-DcFgnQQO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -45,6 +45,7 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
+import { isDeepStrictEqual, promisify } from "node:util";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
@@ -73,7 +74,6 @@ import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
 import { createServer } from "node:net";
-import { promisify } from "node:util";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
@@ -1098,7 +1098,10 @@ async function resolveSdkDefaultRegion(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	let client;
 	try {
-		client = new STSClient({ ...profile && { profile } });
+		client = new STSClient({
+			...awsClientDefaults({ profile }),
+			...profile && { profile }
+		});
 		return await client.config.region() || void 0;
 	} catch {
 		return;
@@ -1290,6 +1293,7 @@ async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger,
 */
 async function deleteContainerRepo(containerRepo, region, profile, logger) {
 	const ecrClient = new ECRClient({
+		...awsClientDefaults({ profile }),
 		region,
 		...profile && { profile }
 	});
@@ -1390,6 +1394,7 @@ async function bootstrapDestroyCommand(options) {
 	let region = effective.region;
 	if (regionNeedsReconciliation(effective)) {
 		const probeBackend = new S3StateBackend(new S3Client({
+			...awsClientDefaults({ profile: options.profile }),
 			region: effective.region,
 			...options.profile && { profile: options.profile }
 		}), {
@@ -1418,6 +1423,7 @@ async function bootstrapDestroyCommand(options) {
 	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
 	const markerS3Client = new S3Client({
+		...awsClientDefaults({ profile: options.profile }),
 		region,
 		...options.profile && { profile: options.profile }
 	});
@@ -19281,7 +19287,10 @@ var DynamoDBGlobalTableProvider = class {
 	getRegionalClient(region) {
 		const cached = this.regionalClientCache.get(region);
 		if (cached) return cached;
-		const client = new DynamoDBClient({ region });
+		const client = new DynamoDBClient({
+			...awsClientDefaults(),
+			region
+		});
 		this.regionalClientCache.set(region, client);
 		return client;
 	}
@@ -19299,7 +19308,10 @@ var DynamoDBGlobalTableProvider = class {
 	getRegionalAutoScalingClient(region) {
 		const cached = this.regionalAutoScalingClientCache.get(region);
 		if (cached) return cached;
-		const client = new ApplicationAutoScalingClient({ region });
+		const client = new ApplicationAutoScalingClient({
+			...awsClientDefaults(),
+			region
+		});
 		this.regionalAutoScalingClientCache.set(region, client);
 		return client;
 	}
@@ -19314,7 +19326,10 @@ var DynamoDBGlobalTableProvider = class {
 	async getLocalAutoScalingClient() {
 		if (this.localAutoScalingClient) return this.localAutoScalingClient;
 		const region = await this.dynamoDBClient.config.region() ?? "";
-		this.localAutoScalingClient = new ApplicationAutoScalingClient({ region });
+		this.localAutoScalingClient = new ApplicationAutoScalingClient({
+			...awsClientDefaults(),
+			region
+		});
 		return this.localAutoScalingClient;
 	}
 	/**
@@ -20916,7 +20931,10 @@ var DynamoDBGlobalTableProvider = class {
 	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
-			const asClient = client ?? new ApplicationAutoScalingClient({ region: await this.dynamoDBClient.config.region() ?? "" });
+			const asClient = client ?? new ApplicationAutoScalingClient({
+				...awsClientDefaults(),
+				region: await this.dynamoDBClient.config.region() ?? ""
+			});
 			const targets = (await asClient.send(new DescribeScalableTargetsCommand({
 				ServiceNamespace: "dynamodb",
 				ResourceIds: [resourceId],
@@ -23673,6 +23691,27 @@ function hasDescriptor(params) {
 //#endregion
 //#region src/provisioning/providers/secretsmanager-secret-provider.ts
 /**
+* `value` after a JSON round-trip: `undefined` members dropped, exactly the
+* shape state.json can hold. Used so the two sides of the issue-#2472
+* comparison in {@link SecretsManagerSecretProvider.changedSecretValue} are
+* spelled the same way, and so a null-prototype object (what
+* `redactSecretsForState` builds) compares equal to a plain one —
+* `isDeepStrictEqual` checks prototypes. `undefined` round-trips to `undefined`.
+*/
+function asJson(value) {
+	return value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
+}
+/**
+* A `SecretString` about to go on the wire must be a string. Pre-#2472 a
+* non-string was forwarded through a cast and left to AWS; a silent drop is
+* the worse failure for a value the user wrote, so the SHAPE is named — never
+* the value. Shared by `create()` and `update()` so the two cannot disagree.
+*/
+function requireSecretStringShape(literal) {
+	if (typeof literal === "string") return literal;
+	throw new Error(`SecretString must be a string, got ${literal === null ? "null" : Array.isArray(literal) ? "array" : typeof literal}`);
+}
+/**
 * AWS Secrets Manager Secret Provider
 *
 * Implements resource provisioning for AWS::SecretsManager::Secret using the Secrets Manager SDK.
@@ -23709,7 +23748,7 @@ var SecretsManagerSecretProvider = class {
 			let secretString;
 			const generateConfig = properties["GenerateSecretString"];
 			if (generateConfig) secretString = this.generateSecretString(generateConfig);
-			else if (properties["SecretString"]) secretString = properties["SecretString"];
+			else if (properties["SecretString"] !== void 0 && properties["SecretString"] !== "") secretString = requireSecretStringShape(properties["SecretString"]);
 			const createParams = { Name: name };
 			if (secretString) createParams.SecretString = secretString;
 			if (properties["Description"]) createParams.Description = properties["Description"];
@@ -23738,12 +23777,9 @@ var SecretsManagerSecretProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating secret ${logicalId}: ${physicalId}`);
 		try {
-			let secretString;
-			const generateConfig = properties["GenerateSecretString"];
-			if (generateConfig) secretString = this.generateSecretString(generateConfig);
-			else if (properties["SecretString"]) secretString = properties["SecretString"];
+			const secretString = this.changedSecretValue(properties, previousProperties);
 			const updateParams = { SecretId: physicalId };
-			if (secretString) updateParams.SecretString = secretString;
+			if (secretString !== void 0) updateParams.SecretString = secretString;
 			const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
 			if (description !== void 0) updateParams.Description = description;
 			const newKmsKeyId = properties["KmsKeyId"];
@@ -23825,6 +23861,104 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	/**
+	* The `SecretString` an in-place update must send, or `undefined` when the
+	* value's SOURCE is unchanged (issue #2472).
+	*
+	* The source is `GenerateSecretString` when present (CloudFormation gives it
+	* precedence over a literal) and `SecretString` otherwise. A generated value
+	* is minted only when the `GenerateSecretString` block differs from the
+	* previous one — every in-place update re-runs this method, so comparing
+	* the block rather than the (never persisted, never read back) value is
+	* the only way to keep an unrelated update from re-rolling the password. A
+	* literal is sent only when it differs from the previous literal. Switching
+	* source in either direction counts as a change (the previous side of the
+	* new source is `undefined`), and a bag that carries NEITHER source keeps
+	* the live value untouched, as CloudFormation does.
+	*
+	* One consequence of the precedence: a PREVIOUS bag carrying both a block
+	* and an ignored `SecretString: 'x'` masks a block-to-literal switch whose
+	* literal is still `'x'` (the literal compares equal, nothing is sent).
+	* CloudFormation rejects a template declaring both, so such a record is
+	* cdkd-created only and the miss is accepted.
+	*
+	* THE PREVIOUS BAG IS WHAT STATE PERSISTED, so the block is compared in
+	* that spelling. On the deploy path a `{{resolve:...}}` inside
+	* `SecretStringTemplate` reaches this method as plaintext while state holds
+	* the redacted expression (GHSA-p5qg-v9gv-hc7w); compared raw, such a block
+	* ALWAYS differs and every Tags-only update re-rolls the password — the
+	* defect this method exists to close, for exactly the shape that embeds a
+	* secret. {@link asPersisted} rewrites the desired block through the same
+	* redaction the state writer uses, so the two sides meet. A pre-GHSA record
+	* still holding plaintext matches the raw comparison instead; either match
+	* means "unchanged".
+	*
+	* The same rewrite means an upstream ROTATION behind an unchanged reference
+	* in `SecretStringTemplate` does NOT regenerate (the expression is the same
+	* on both sides), where CloudFormation, which re-resolves at update time,
+	* would. That is the intended trade for the generated source: the harmful
+	* direction is the unrequested re-roll.
+	*
+	* RESIDUAL, permanent rather than one-shot: two references in the block
+	* that resolve to the SAME plaintext. The resolver records one pair per
+	* plaintext (last expression wins), so this value scan rewrites BOTH leaves
+	* to the survivor expression, while the persisted previous holds each
+	* leaf's own expression (the state writer redacts by POSITION, with the
+	* template as its source) — the two spellings differ on every in-place
+	* update, and that shape re-rolls on every Tags-only deploy. Threading a
+	* position source through here would close it, but the only source this
+	* method holds is the PREVIOUS block, and substituting its leaves would
+	* also erase a genuine reference switch in a secret leaf; left open for a
+	* shape that is rare (two secrets with identical plaintext in one block).
+	*
+	* A LITERAL IS DELIBERATELY NOT REDACTED BEFORE COMPARING. A
+	* `SecretString: '{{resolve:...}}'` (a secret mirroring another one) is
+	* re-sent on every in-place update: cdkd cannot tell whether the REFERENCED
+	* value changed since the last deploy — state holds only the expression —
+	* and CloudFormation re-applies it when the resolved value changed. A
+	* redundant version is the milder failure; a stale copy is a wrong value.
+	*
+	* `isDeepStrictEqual` over a JSON round-trip rather than `JSON.stringify`
+	* equality: the previous bag comes back from state.json while the new one
+	* comes from the resolver, so a key-order difference is not a change, and
+	* an explicit `undefined` member (which state.json cannot hold) must not
+	* read as one either — that failure direction is a silent re-roll.
+	*
+	* KNOWN EDGE, accepted: the redaction is a VALUE scan, so a literal in the
+	* block that happens to EQUAL a plaintext this resource resolved from a
+	* reference elsewhere in its bag is rewritten to that reference's
+	* expression too. Replacing a `{{resolve:...}}` in the template with the
+	* literal it currently resolves to therefore compares equal and does NOT
+	* regenerate, where CloudFormation would. This is the same rewrite the
+	* state writer applies to that literal when it persists the record, so the
+	* two sides stay consistent, and the miss is in the safe direction (no
+	* unrequested re-roll) for an edit that puts a secret's plaintext into a
+	* template.
+	*/
+	changedSecretValue(properties, previousProperties) {
+		const generateConfig = properties["GenerateSecretString"];
+		if (generateConfig) {
+			const previous = previousProperties["GenerateSecretString"];
+			return isDeepStrictEqual(asJson(generateConfig), asJson(previous)) || isDeepStrictEqual(asJson(this.asPersisted(generateConfig)), asJson(previous)) ? void 0 : this.generateSecretString(generateConfig);
+		}
+		const literal = properties["SecretString"];
+		if (literal === void 0) return void 0;
+		if (isDeepStrictEqual(asJson(literal), asJson(previousProperties["SecretString"]))) return;
+		return requireSecretStringShape(literal);
+	}
+	/**
+	* `bag` as the state writer would persist it: every plaintext this
+	* provider call resolved from a `{{resolve:...}}` reference is rewritten
+	* back to its expression. The pairs come from the per-resource scope the
+	* deploy engine / rollback executor bind around the provider call
+	* (`resource-secrets-scope.ts`); absent (drift `--revert`, import, tests)
+	* the bag is returned as-is. The map is handed to the redaction helper
+	* only — never enumerated, never logged.
+	*/
+	asPersisted(bag) {
+		const secrets = getCurrentResourceSecrets();
+		return secrets !== void 0 && secrets.size > 0 ? redactSecretsForState(bag, secrets) : bag;
+	}
+	/**
 	* Generate a secret string from GenerateSecretString configuration
 	*
 	* Simple implementation that generates a random string based on the config.
@@ -30477,7 +30611,10 @@ var ApiGatewayV2Provider = class {
 		["CredentialsArn", "Quick-create shortcut (paired with RouteKey/Target); cdkd models the integration as an explicit AWS::ApiGatewayV2::Integration resource instead."]
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new ApiGatewayV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ApiGatewayV2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -34203,11 +34340,17 @@ var StepFunctionsProvider = class {
 		"EncryptionConfiguration"
 	])]]);
 	getClient() {
-		if (!this.sfnClient) this.sfnClient = new SFNClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.sfnClient) this.sfnClient = new SFNClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.sfnClient;
 	}
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	/**
@@ -34834,7 +34977,10 @@ var ECSProvider = class {
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
-		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.ecsClient) this.ecsClient = new ECSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.ecsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -36622,7 +36768,10 @@ var ELBv2Provider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.elbv2Client;
 	}
 	/**
@@ -37891,7 +38040,10 @@ var RDSProvider = class {
 		["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -38642,7 +38794,10 @@ var RDSDBProxyProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -38974,7 +39129,10 @@ var RDSDBProxyEndpointProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -39280,7 +39438,10 @@ var RDSDBProxyTargetGroupProvider = class {
 		"ConnectionPoolConfigurationInfo"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -39591,7 +39752,10 @@ var DocDBProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.docdbClient) this.docdbClient = new DocDBClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.docdbClient) this.docdbClient = new DocDBClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.docdbClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -40224,7 +40388,10 @@ var NeptuneProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.neptuneClient) this.neptuneClient = new NeptuneClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.neptuneClient) this.neptuneClient = new NeptuneClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.neptuneClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -40985,7 +41152,10 @@ var Route53Provider = class {
 		"CidrRoutingConfig"
 	])]]);
 	getClient() {
-		if (!this.route53Client) this.route53Client = new Route53Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.route53Client) this.route53Client = new Route53Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.route53Client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -42997,7 +43167,10 @@ var CognitoUserPoolProvider = class {
 		return narrowMfaConfiguration(properties);
 	}
 	getClient() {
-		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.cognitoClient;
 	}
 	/**
@@ -43749,7 +43922,10 @@ var ElastiCacheProvider = class {
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
-		if (!this.client) this.client = new ElastiCacheClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ElastiCacheClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -44278,11 +44454,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ServiceDiscoveryClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	/**
@@ -45328,7 +45510,10 @@ var AppSyncProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new AppSyncClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -45520,7 +45705,10 @@ var AppSyncProvider = class {
 	* implementation).
 	*/
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -47151,7 +47339,10 @@ var GlueProvider = class {
 		"OpenTableFormatInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -48002,7 +48193,10 @@ var GlueWorkflowProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48128,7 +48322,10 @@ var GlueWorkflowProvider = class {
 	}
 	async getAccountId() {
 		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
 		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
 		this.cachedAccountId = identity.Account;
@@ -48153,7 +48350,10 @@ var GlueSecurityConfigurationProvider = class {
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48512,11 +48712,17 @@ var GlueJobProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48882,11 +49088,17 @@ var GlueCrawlerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49190,7 +49402,10 @@ var GlueConnectionProvider = class {
 	logger = getLogger().child("GlueConnectionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49352,11 +49567,17 @@ var GlueTriggerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49570,7 +49791,10 @@ var KMSProvider = class {
 		"BypassPolicyLockoutSafetyCheck"
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
 	getClient() {
-		if (!this.client) this.client = new KMSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KMSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -50009,7 +50233,10 @@ var BudgetsBudgetProvider = class {
 		"ResourceTags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new BudgetsClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new BudgetsClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -50622,7 +50849,10 @@ var KinesisStreamProvider = class {
 		"MaxRecordSizeInKiB"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KinesisClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51094,7 +51324,10 @@ var KinesisStreamConsumerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KinesisClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51378,7 +51611,10 @@ var SchedulerScheduleProvider = class {
 		"Target"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new SchedulerClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new SchedulerClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51671,7 +51907,10 @@ var EFSProvider = class {
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
-		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EFSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -52585,7 +52824,10 @@ var FSxFileSystemProvider = class {
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map();
 	getClient() {
-		if (!this.client) this.client = new FSxClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new FSxClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -53693,7 +53935,10 @@ var EMRClusterProvider = class {
 		"VisibleToAllUsers"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -54455,7 +54700,10 @@ var EMRInstanceGroupConfigProvider = class {
 		"Name"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getMinResourceTimeoutMs() {
@@ -54768,7 +55016,10 @@ var EMRInstanceFleetConfigProvider = class {
 		"TargetSpotCapacity"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getMinResourceTimeoutMs() {
@@ -55066,7 +55317,10 @@ var FirehoseProvider = class {
 		"DeliveryStreamEncryptionConfigurationInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new FirehoseClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new FirehoseClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -56411,7 +56665,10 @@ var CloudTrailProvider = class {
 		"IsOrganizationTrail"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CloudTrailClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CloudTrailClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -56753,7 +57010,10 @@ var CodeBuildProvider = class {
 		"AutoRetryLimit"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CodeBuildClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CodeBuildClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -57314,11 +57574,17 @@ var CodeCommitRepositoryProvider = class {
 		"Triggers"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CodeCommitClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	/**
@@ -57748,7 +58014,10 @@ var DLMLifecyclePolicyProvider = class {
 		"Exclusions"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new DLMClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new DLMClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -58040,7 +58309,10 @@ var S3VectorsProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new S3VectorsClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new S3VectorsClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -58290,7 +58562,10 @@ var S3DirectoryBucketProvider = class {
 		this.stsClient = awsClients.sts;
 	}
 	getEc2Client() {
-		if (!this.ec2Client) this.ec2Client = new EC2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.ec2Client;
 	}
 	/**
@@ -58301,7 +58576,10 @@ var S3DirectoryBucketProvider = class {
 	* `s3express:UntagResource` / `s3express:ListTagsForResource` permissions).
 	*/
 	getS3ControlClient() {
-		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3ControlClient;
 	}
 	/**
@@ -58713,7 +58991,10 @@ var S3TablesProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new S3TablesClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new S3TablesClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -59506,7 +59787,10 @@ var ECRProvider = class {
 		"ImageTagMutabilityExclusionFilters"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new ECRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ECRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -62078,7 +62362,10 @@ async function deployCommand(stacks, options) {
 		});
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const stsClient = new STSClient({ region: namedCliRegion(options.region) ?? "us-east-1" });
+		const stsClient = new STSClient({
+			...awsClientDefaults(),
+			region: namedCliRegion(options.region) ?? "us-east-1"
+		});
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 		stsClient.destroy();
 		const assetPublisher = new AssetPublisher();
@@ -70369,7 +70656,11 @@ async function stateMigrateCommand(options) {
 		logger.info("Migrating state bucket:");
 		logger.info(`  source:      ${legacyBucket} (resolved for --region ${region})`);
 		logger.info(`  destination: ${newBucket}`);
-		const probe = new S3Client({ region: "us-east-1" });
+		const probeRegion = "us-east-1";
+		const probe = new S3Client({
+			...awsClientDefaults(),
+			region: probeRegion
+		});
 		let sourceExists;
 		try {
 			sourceExists = await bucketExists(probe, legacyBucket);
@@ -70379,7 +70670,10 @@ async function stateMigrateCommand(options) {
 		if (!sourceExists) throw new Error(`Source bucket '${legacyBucket}' does not exist. Nothing to migrate. (Tip: run \`cdkd state info\` to confirm which bucket cdkd is reading from.)`);
 		const legacyRegion = await resolveBucketRegion(legacyBucket);
 		logger.info(`  source bucket actual region: ${legacyRegion}`);
-		const legacyS3 = new S3Client({ region: legacyRegion });
+		const legacyS3 = new S3Client({
+			...awsClientDefaults(),
+			region: legacyRegion
+		});
 		try {
 			await assertNoActiveLocks(legacyS3, legacyBucket);
 			const sourceObjects = await listAllObjects(legacyS3, legacyBucket);
@@ -70479,7 +70773,10 @@ async function assertNoActiveLocks(s3, bucket) {
 	}
 }
 async function ensureDestinationBucket(bucketName, region, accountId, logger) {
-	const probe = new S3Client({ region });
+	const probe = new S3Client({
+		...awsClientDefaults(),
+		region
+	});
 	let exists;
 	try {
 		exists = await bucketExists(probe, bucketName);
@@ -70490,10 +70787,16 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 		logger.info(`Destination bucket ${bucketName} already exists; reusing it.`);
 		const actual = await resolveBucketRegion(bucketName);
 		if (actual !== region) logger.warn(`Destination bucket lives in ${actual}, but source is in ${region}. Cross-region copy is supported but slower; objects will be replicated to ${actual}.`);
-		return new S3Client({ region: actual });
+		return new S3Client({
+			...awsClientDefaults(),
+			region: actual
+		});
 	}
 	logger.info(`Creating destination bucket ${bucketName} in ${region}...`);
-	const s3 = new S3Client({ region });
+	const s3 = new S3Client({
+		...awsClientDefaults(),
+		region
+	});
 	const createParams = { Bucket: bucketName };
 	if (region !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: region };
 	await s3.send(new CreateBucketCommand(createParams));
@@ -71755,7 +72058,7 @@ const PRE_DELETE_HANDLERS = {
 		const { ApiGatewayV2Client, DeleteStageCommand, NotFoundException } = await import("@aws-sdk/client-apigatewayv2");
 		const apiId = entry.properties["ApiId"];
 		if (typeof apiId !== "string" || !apiId) throw new Error(`cdkd state's properties for ${entry.logicalId} (${entry.resourceType}) is missing 'ApiId'`);
-		const client = new ApiGatewayV2Client({});
+		const client = new ApiGatewayV2Client({ ...awsClientDefaults() });
 		try {
 			await client.send(new DeleteStageCommand({
 				ApiId: apiId,
@@ -71774,7 +72077,7 @@ const PRE_DELETE_HANDLERS = {
 		const users = entry.properties["Users"];
 		const groups = entry.properties["Groups"];
 		if (!((roles?.length ?? 0) + (users?.length ?? 0) + (groups?.length ?? 0) > 0)) throw new Error(`cdkd state's properties for ${entry.logicalId} (${entry.resourceType}) has no Roles/Users/Groups attachment recorded — cannot pre-delete the inline policy. State may be from a pre-v0.74 cdkd binary; re-run \`cdkd state refresh-observed\` before export.`);
-		const client = new IAMClient({});
+		const client = new IAMClient({ ...awsClientDefaults() });
 		const deleteSafely = async (op) => {
 			try {
 				await op();
@@ -77372,6 +77675,7 @@ async function gcCommand(options) {
 	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
+		...awsClientDefaults({ profile: options.profile }),
 		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
@@ -77396,6 +77700,7 @@ async function gcCommand(options) {
 	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
 	const ecrClient = new ECRClient({
+		...awsClientDefaults({ profile: options.profile }),
 		region,
 		...options.profile && { profile: options.profile }
 	});
@@ -78285,7 +78590,10 @@ async function publishAssetsCommand(stacks, options) {
 	if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
 	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const stsClient = new STSClient({ region: baseRegion });
+	const stsClient = new STSClient({
+		...awsClientDefaults(),
+		region: baseRegion
+	});
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 	stsClient.destroy();
 	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
@@ -82034,7 +82342,10 @@ async function pullEcrImage(imageUri, options) {
 	const callerIdentityKey = callerRegion ?? "_unset";
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
 	if (callerAccount === void 0) {
-		const sts = new STSClient({ ...callerRegion && { region: callerRegion } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...callerRegion && { region: callerRegion }
+		});
 		try {
 			const identity = await sts.send(new GetCallerIdentityCommand({}));
 			if (!identity.Account) throw new LocalInvokeBuildError$1("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
@@ -82061,6 +82372,7 @@ async function pullEcrImage(imageUri, options) {
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
 	const ecr = new ECRClient({
+		...awsClientDefaults(),
 		region: parsed.region,
 		...assumed && { credentials: assumed }
 	});
@@ -82086,7 +82398,10 @@ async function pullEcrImage(imageUri, options) {
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient({ ...callerRegion && { region: callerRegion } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...callerRegion && { region: callerRegion }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -84415,7 +84730,10 @@ function forwardAwsEnv$2(env) {
 */
 async function resolveProfileCredentials(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ profile });
+	const sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		profile
+	});
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
@@ -84436,7 +84754,10 @@ async function resolveProfileCredentials(profile) {
 */
 async function assumeLambdaExecutionRole$1(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -84715,7 +85036,10 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient({ ...region && { region } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...region && { region }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -84990,8 +85314,14 @@ var EcsSecretsResolutionError = class EcsSecretsResolutionError extends Error {
 async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
-	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({ ...options.region && { region: options.region } });
-	const ssmClient = options.ssmClient ?? new SSMClient({ ...options.region && { region: options.region } });
+	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
+		...awsClientDefaults(),
+		...options.region && { region: options.region }
+	});
+	const ssmClient = options.ssmClient ?? new SSMClient({
+		...awsClientDefaults(),
+		...options.region && { region: options.region }
+	});
 	const ownsSecretsClient = options.secretsManagerClient === void 0;
 	const ownsSsmClient = options.ssmClient === void 0;
 	try {
@@ -85785,7 +86115,10 @@ async function localRunTaskCommand(target, options) {
 async function resolvePlaceholderAccount(arn, region) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
@@ -85800,7 +86133,10 @@ async function resolvePlaceholderAccount(arn, region) {
 */
 async function assumeTaskRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -85939,7 +86275,10 @@ function pickCandidateStack(stackPattern, stacks) {
 }
 async function resolveCallerAccountId$1(region) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -87099,6 +87438,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 async function resolveCallerAccountId(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
+		...awsClientDefaults({ profile }),
 		...region && { region },
 		...profile && { profile }
 	});
@@ -87291,7 +87631,10 @@ function forwardAwsEnv$1(env) {
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -88078,7 +88421,10 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient({ ...region && { region } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...region && { region }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -88221,7 +88567,10 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 */
 async function assumeLambdaExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -89544,4 +89893,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BeYoZQIP.js.map
+//# sourceMappingURL=program-DHJ4G_ZZ.js.map