@go-to-k/cdkd 0.285.12 → 0.285.14

package/dist/{program-C5evYwxk.js → program-BSanOkkV.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-C3epVkTj.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $r as retryClassificationText, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalMigrateError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Br as StackTerminationProtectionError, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as PartialFailureError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as normalizeAwsError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ProvisioningError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isRetryableTransientError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as withErrorHandling, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceTimeoutError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as MissingCdkCliError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as IntrinsicResolutionRefusalError, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as NestedStackChildDirectDestroyError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as markRedactedCause, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as ResourceUpdateNotSupportedError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as isTransientServerError, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isThrottlingError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markNonRetryable, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jr as LocalStartServiceError, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalInvokeBuildError$1, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isMarkedNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackHasActiveImportsError, zt as applyRoleArnIfSet } from "./deploy-engine-CA50haPO.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CS-eKBJA.js";
-import { t as ASGProvider } from "./asg-provider-CXkE2U3z.js";
+import { t as getCdkdVersion } from "./version-DP5kGlzj.js";
+import { t as ASGProvider } from "./asg-provider-BvIH9Ivw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1098,7 +1098,10 @@ async function resolveSdkDefaultRegion(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	let client;
 	try {
-		client = new STSClient({ ...profile && { profile } });
+		client = new STSClient({
+			...awsClientDefaults({ profile }),
+			...profile && { profile }
+		});
 		return await client.config.region() || void 0;
 	} catch {
 		return;
@@ -1290,6 +1293,7 @@ async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger,
 */
 async function deleteContainerRepo(containerRepo, region, profile, logger) {
 	const ecrClient = new ECRClient({
+		...awsClientDefaults({ profile }),
 		region,
 		...profile && { profile }
 	});
@@ -1390,6 +1394,7 @@ async function bootstrapDestroyCommand(options) {
 	let region = effective.region;
 	if (regionNeedsReconciliation(effective)) {
 		const probeBackend = new S3StateBackend(new S3Client({
+			...awsClientDefaults({ profile: options.profile }),
 			region: effective.region,
 			...options.profile && { profile: options.profile }
 		}), {
@@ -1418,6 +1423,7 @@ async function bootstrapDestroyCommand(options) {
 	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
 	const markerS3Client = new S3Client({
+		...awsClientDefaults({ profile: options.profile }),
 		region,
 		...options.profile && { profile: options.profile }
 	});
@@ -19281,7 +19287,10 @@ var DynamoDBGlobalTableProvider = class {
 	getRegionalClient(region) {
 		const cached = this.regionalClientCache.get(region);
 		if (cached) return cached;
-		const client = new DynamoDBClient({ region });
+		const client = new DynamoDBClient({
+			...awsClientDefaults(),
+			region
+		});
 		this.regionalClientCache.set(region, client);
 		return client;
 	}
@@ -19299,7 +19308,10 @@ var DynamoDBGlobalTableProvider = class {
 	getRegionalAutoScalingClient(region) {
 		const cached = this.regionalAutoScalingClientCache.get(region);
 		if (cached) return cached;
-		const client = new ApplicationAutoScalingClient({ region });
+		const client = new ApplicationAutoScalingClient({
+			...awsClientDefaults(),
+			region
+		});
 		this.regionalAutoScalingClientCache.set(region, client);
 		return client;
 	}
@@ -19314,7 +19326,10 @@ var DynamoDBGlobalTableProvider = class {
 	async getLocalAutoScalingClient() {
 		if (this.localAutoScalingClient) return this.localAutoScalingClient;
 		const region = await this.dynamoDBClient.config.region() ?? "";
-		this.localAutoScalingClient = new ApplicationAutoScalingClient({ region });
+		this.localAutoScalingClient = new ApplicationAutoScalingClient({
+			...awsClientDefaults(),
+			region
+		});
 		return this.localAutoScalingClient;
 	}
 	/**
@@ -20916,7 +20931,10 @@ var DynamoDBGlobalTableProvider = class {
 	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
-			const asClient = client ?? new ApplicationAutoScalingClient({ region: await this.dynamoDBClient.config.region() ?? "" });
+			const asClient = client ?? new ApplicationAutoScalingClient({
+				...awsClientDefaults(),
+				region: await this.dynamoDBClient.config.region() ?? ""
+			});
 			const targets = (await asClient.send(new DescribeScalableTargetsCommand({
 				ServiceNamespace: "dynamodb",
 				ResourceIds: [resourceId],
@@ -30593,7 +30611,10 @@ var ApiGatewayV2Provider = class {
 		["CredentialsArn", "Quick-create shortcut (paired with RouteKey/Target); cdkd models the integration as an explicit AWS::ApiGatewayV2::Integration resource instead."]
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new ApiGatewayV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ApiGatewayV2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -34319,11 +34340,17 @@ var StepFunctionsProvider = class {
 		"EncryptionConfiguration"
 	])]]);
 	getClient() {
-		if (!this.sfnClient) this.sfnClient = new SFNClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.sfnClient) this.sfnClient = new SFNClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.sfnClient;
 	}
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	/**
@@ -34950,7 +34977,10 @@ var ECSProvider = class {
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
-		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.ecsClient) this.ecsClient = new ECSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.ecsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -36738,7 +36768,10 @@ var ELBv2Provider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.elbv2Client;
 	}
 	/**
@@ -38007,7 +38040,10 @@ var RDSProvider = class {
 		["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -38758,7 +38794,10 @@ var RDSDBProxyProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -39090,7 +39129,10 @@ var RDSDBProxyEndpointProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -39396,7 +39438,10 @@ var RDSDBProxyTargetGroupProvider = class {
 		"ConnectionPoolConfigurationInfo"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.rdsClient) this.rdsClient = new RDSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.rdsClient;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -39707,7 +39752,10 @@ var DocDBProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.docdbClient) this.docdbClient = new DocDBClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.docdbClient) this.docdbClient = new DocDBClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.docdbClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -40340,7 +40388,10 @@ var NeptuneProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.neptuneClient) this.neptuneClient = new NeptuneClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.neptuneClient) this.neptuneClient = new NeptuneClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.neptuneClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -41101,7 +41152,10 @@ var Route53Provider = class {
 		"CidrRoutingConfig"
 	])]]);
 	getClient() {
-		if (!this.route53Client) this.route53Client = new Route53Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.route53Client) this.route53Client = new Route53Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.route53Client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -43113,7 +43167,10 @@ var CognitoUserPoolProvider = class {
 		return narrowMfaConfiguration(properties);
 	}
 	getClient() {
-		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.cognitoClient;
 	}
 	/**
@@ -43865,7 +43922,10 @@ var ElastiCacheProvider = class {
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
-		if (!this.client) this.client = new ElastiCacheClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ElastiCacheClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -44394,11 +44454,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ServiceDiscoveryClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	/**
@@ -45444,7 +45510,10 @@ var AppSyncProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new AppSyncClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -45636,7 +45705,10 @@ var AppSyncProvider = class {
 	* implementation).
 	*/
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -47267,7 +47339,10 @@ var GlueProvider = class {
 		"OpenTableFormatInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -48118,7 +48193,10 @@ var GlueWorkflowProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48244,7 +48322,10 @@ var GlueWorkflowProvider = class {
 	}
 	async getAccountId() {
 		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
 		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
 		this.cachedAccountId = identity.Account;
@@ -48269,7 +48350,10 @@ var GlueSecurityConfigurationProvider = class {
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48628,11 +48712,17 @@ var GlueJobProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -48998,11 +49088,17 @@ var GlueCrawlerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49306,7 +49402,10 @@ var GlueConnectionProvider = class {
 	logger = getLogger().child("GlueConnectionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49468,11 +49567,17 @@ var GlueTriggerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new GlueClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getStsClient() {
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.stsClient;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -49686,7 +49791,10 @@ var KMSProvider = class {
 		"BypassPolicyLockoutSafetyCheck"
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
 	getClient() {
-		if (!this.client) this.client = new KMSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KMSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -50125,7 +50233,10 @@ var BudgetsBudgetProvider = class {
 		"ResourceTags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new BudgetsClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new BudgetsClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -50738,7 +50849,10 @@ var KinesisStreamProvider = class {
 		"MaxRecordSizeInKiB"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KinesisClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51210,7 +51324,10 @@ var KinesisStreamConsumerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new KinesisClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51494,7 +51611,10 @@ var SchedulerScheduleProvider = class {
 		"Target"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new SchedulerClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new SchedulerClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -51787,7 +51907,10 @@ var EFSProvider = class {
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
-		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EFSClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -52701,7 +52824,10 @@ var FSxFileSystemProvider = class {
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map();
 	getClient() {
-		if (!this.client) this.client = new FSxClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new FSxClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -53809,7 +53935,10 @@ var EMRClusterProvider = class {
 		"VisibleToAllUsers"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -54571,7 +54700,10 @@ var EMRInstanceGroupConfigProvider = class {
 		"Name"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getMinResourceTimeoutMs() {
@@ -54884,7 +55016,10 @@ var EMRInstanceFleetConfigProvider = class {
 		"TargetSpotCapacity"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new EMRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getMinResourceTimeoutMs() {
@@ -55182,7 +55317,10 @@ var FirehoseProvider = class {
 		"DeliveryStreamEncryptionConfigurationInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new FirehoseClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new FirehoseClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -56527,7 +56665,10 @@ var CloudTrailProvider = class {
 		"IsOrganizationTrail"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CloudTrailClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CloudTrailClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -56869,7 +57010,10 @@ var CodeBuildProvider = class {
 		"AutoRetryLimit"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CodeBuildClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CodeBuildClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -57430,11 +57574,17 @@ var CodeCommitRepositoryProvider = class {
 		"Triggers"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new CodeCommitClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	getS3Client() {
-		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3Client;
 	}
 	/**
@@ -57864,7 +58014,10 @@ var DLMLifecyclePolicyProvider = class {
 		"Exclusions"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new DLMClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new DLMClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -58156,7 +58309,10 @@ var S3VectorsProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new S3VectorsClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new S3VectorsClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties) {
@@ -58406,7 +58562,10 @@ var S3DirectoryBucketProvider = class {
 		this.stsClient = awsClients.sts;
 	}
 	getEc2Client() {
-		if (!this.ec2Client) this.ec2Client = new EC2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.ec2Client;
 	}
 	/**
@@ -58417,7 +58576,10 @@ var S3DirectoryBucketProvider = class {
 	* `s3express:UntagResource` / `s3express:ListTagsForResource` permissions).
 	*/
 	getS3ControlClient() {
-		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.s3ControlClient;
 	}
 	/**
@@ -58829,7 +58991,10 @@ var S3TablesProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new S3TablesClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new S3TablesClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -59622,7 +59787,10 @@ var ECRProvider = class {
 		"ImageTagMutabilityExclusionFilters"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new ECRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		if (!this.client) this.client = new ECRClient({
+			...awsClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
 		return this.client;
 	}
 	/**
@@ -62194,7 +62362,10 @@ async function deployCommand(stacks, options) {
 		});
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const stsClient = new STSClient({ region: namedCliRegion(options.region) ?? "us-east-1" });
+		const stsClient = new STSClient({
+			...awsClientDefaults(),
+			region: namedCliRegion(options.region) ?? "us-east-1"
+		});
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 		stsClient.destroy();
 		const assetPublisher = new AssetPublisher();
@@ -65220,15 +65391,14 @@ const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 * unactionable for prose. Requiring the service makes the count a count of
 * SECRET references rather than of the characters `{{resolve:`.
 *
-* `secretsmanager` / `ssm` mirror `REPLAY_SECRET_SERVICES` in
-* `rollback-executor.ts`, whose {@link classifyReplaySecretRegion} is what
-* classifies the tokens below — the same set on both sides, so the count and
-* the classification never disagree about what is in scope. `ssm-secure` is
-* added on top: it IS a CloudFormation secret spelling, and although cdkd does
-* not resolve it today (the resolver's unsupported-service arm leaves it
-* verbatim, so it can never become a wrong-region needle), counting it costs
-* only an assembled `ssm-secure` reference in a cross-region stack and keeps
-* the guard correct the day that arm changes.
+* All three mirror `REPLAY_SECRET_SERVICES` in
+* `secret-region-classification.ts`, whose {@link classifyReplaySecretRegion}
+* is what classifies the tokens below — the same set on both sides, so the
+* count and the classification never disagree about what is in scope. Until
+* issue #2482 `ssm-secure` was counted here AHEAD of that set (cdkd did not
+* resolve it, so it could never become a wrong-region needle, and counting it
+* kept the guard correct for the day the resolver's arm changed); that day
+* came, and the two lists agree again.
 *
 * THE TRADE, stated rather than hidden: an `Fn::Join` that splits BEFORE the
 * service name (`['{{resolve:', 'secretsmanager:db:SecretString:pw}}']`) has no
@@ -67580,9 +67750,9 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 *
 * SCOPED TO THE CLEARABLE CAUSES, not to everything the report calls
 * `notCompared`. The roll-up also contains resources whose only problem is a
-* surviving `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
-* for nobody, which can never clear on a re-run, and which this change did not
-* create. Exiting non-zero for them would break `cdkd drift` in CI forever over
+* surviving `{{resolve:...}}` token cdkd resolves for nobody — a look-alike
+* spelling, since issue #2482 moved `ssm-secure` onto the `ssm` path — which
+* can never clear on a re-run, and which this change did not create. Exiting non-zero for them would break `cdkd drift` in CI forever over
 * an unrelated defect, so the exit reads `refused` and `readFailed` while the
 * report covers all three. See `NotComparedCause` and `outcomeExitSignal`.
 *
@@ -67616,12 +67786,15 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * honest SENTENCE, since their no-drift line claimed a clean bill of health for
 * a stack they had not read. See {@link incompleteRemediationMessage}.
 *
-* WHAT DOES NOT TRIGGER IT: a stack whose properties reference
-* `{{resolve:ssm-secure:...}}` still exits 0. Those properties genuinely are not
-* compared and the report says so, but nothing REFUSED them — cdkd has never
-* resolved that spelling — so the condition is permanent, unclearable by any
-* action the user can take, and predates this change. It is reported as
-* information and kept out of the exit code.
+* WHAT DOES NOT TRIGGER IT: a stack whose properties carry a `{{resolve:...}}`
+* spelling cdkd resolves for nobody still exits 0. Those properties genuinely
+* are not compared and the report says so, but nothing REFUSED them — cdkd has
+* never resolved that spelling — so the condition is permanent, unclearable by
+* any action the user can take, and predates this change. It is reported as
+* information and kept out of the exit code. (`ssm-secure` was that spelling
+* when this was written; since issue #2482 it resolves like `ssm`, and a
+* lookup that fails for it lands with the other resolution failures, not
+* here.)
 *
 * Carries no message of its own for the same reason {@link DriftDetectedError}
 * does -- the report was already printed.
@@ -67692,8 +67865,7 @@ function notComparedOutcomes(report) {
 * code covers only the CLEARABLE ones — `refused` (the population #2108 created)
 * and `readFailed` (issues #2151 / #1945). Exiting non-zero on
 * `unresolvedToken` would break `cdkd drift` in CI forever for every stack
-* holding an `{{resolve:ssm-secure:...}}` reference — permanent, unclearable,
-* and unrelated. See {@link NotComparedCause}.
+* holding such a spelling — permanent, unclearable, and unrelated. See {@link NotComparedCause}.
 *
 * A `drifted` outcome reports `drifted` even when its own comparison was
 * refused: drift is the stronger, actionable signal and the caller ranks it
@@ -67829,7 +68001,7 @@ function uncomparedTally(reports) {
 *
 *   - The TRIGGER is `anyIncomplete`, i.e. {@link outcomeExitSignal}'s
 *     `incomplete`. It is narrow on purpose: a stack whose ONLY uncompared
-*     resource holds a `{{resolve:ssm-secure:...}}` token must not start
+*     resource holds a `{{resolve:...}}` token cdkd resolves for nobody must not start
 *     shouting on every run about a comparison no action of the user's can ever
 *     complete -- the same CI-forever hazard that cause is kept out of the exit
 *     code on.
@@ -68114,25 +68286,6 @@ function carriesRecordedSecret(value, secrets) {
 	return false;
 }
 /**
-* Is this unresolvable token one whose value is a SECRET by definition?
-*
-* `ssm-secure` is the only such spelling, and it is decidable with no lookup:
-* CloudFormation defines exactly three dynamic-reference services (`ssm`,
-* `ssm-secure`, `secretsmanager`), cdkd resolves the other two, and
-* `ssm-secure` is the encrypted one.
-*
-* Anything else reaching the survivor arm is not a CloudFormation dynamic
-* reference at all — it is text that merely looks like one — and treating it as
-* secret is not the safe direction it appears to be: the path would be masked
-* to `***`, refused by `--accept`, and pinned to the live value by
-* {@link preserveLiveValuesAtUnresolvedTokens}, which is permanently stuck
-* drift with no remedy the user can apply. Such a token is still REPORTED; it
-* just does not claim to be a secret.
-*/
-function isSecretBySpelling(token) {
-	return token.startsWith("{{resolve:ssm-secure:");
-}
-/**
 * Every `{{resolve:...}}` token still present in `value`.
 *
 * Used to NAME an unresolvable reference without quoting the string it sits in.
@@ -68285,10 +68438,13 @@ var DriftSecretRefusalError = class DriftSecretRefusalError extends CdkdError {
 /**
 * Whether an error thrown out of `resolveStateSecretExpressions` is a
 * deliberate REFUSAL rather than a failed read. See
-* {@link DriftSecretRefusalError}.
+* {@link DriftSecretRefusalError} — drift's own region refusal — and
+* `IntrinsicResolutionRefusalError`, the resolver's: since issue #2482 the
+* `ssm-secure` arm refuses a definitive `String` / `StringList` parameter with
+* the latter, and that is a decision, not an IAM problem to go hunting for.
 */
 function isDriftSecretRefusal(err) {
-	return err instanceof DriftSecretRefusalError;
+	return err instanceof DriftSecretRefusalError || err instanceof IntrinsicResolutionRefusalError;
 }
 /**
 * One-line human phrasing for a {@link NotComparedCause}, used per entry in the
@@ -68467,17 +68623,19 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 *
 * A `{{resolve:...}}` token that SURVIVES the pass is reported through
 * `onUnresolved` and left in place — it is not an error. The resolver's
-* unsupported-service arm (`ssm-secure:` is the live example) warns and returns
-* the literal, and `cdkd deploy` resolves through the very same code, so AWS is
-* ALREADY holding that literal string and state records it. Replaying it is
-* therefore a correct no-op, and failing the resource over it would take every
-* other drifted property on that resource down with it (plus exit 2). The
-* report exists so the user learns cdkd is shipping a token it cannot resolve,
-* which is a real thing to know and not a reason to stop.
+* unsupported-service arm warns and returns the literal (`ssm-secure:` was the
+* live example until issue #2482 gave it an arm; what reaches it now is text
+* that merely looks like a reference), and `cdkd deploy` resolves through the
+* very same code, so AWS is ALREADY holding that literal string and state
+* records it. Replaying it is therefore a correct no-op, and failing the
+* resource over it would take every other drifted property on that resource
+* down with it (plus exit 2). The report exists so the user learns cdkd is
+* shipping a token it cannot resolve, which is a real thing to know and not a
+* reason to stop.
 *
 * Only the TOKENS are reported, never the leaf that held them: the leaf is
 * partially substituted by this point, so a mixed `secretsmanager` +
-* `ssm-secure` string comes back carrying real plaintext.
+* look-alike string comes back carrying real plaintext.
 *
 * Returns the input by identity when it holds no dynamic reference, so the
 * non-secret path is unchanged down to object identity.
@@ -68500,10 +68658,7 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 			if (!v.includes("{{resolve:")) return v;
 			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions, resolvers, ctx);
 			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
-			if (survivors.length > 0) {
-				if (survivors.some(isSecretBySpelling)) secretPaths?.add(path);
-				onUnresolved?.(survivors, path);
-			}
+			if (survivors.length > 0) onUnresolved?.(survivors, path);
 			if (carriesRecordedSecret(resolved, secrets)) secretPaths?.add(path);
 			return resolved;
 		}
@@ -68763,7 +68918,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					secrets.clear();
 				}
-				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
+				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager', 'ssm' and 'ssm-secure' references; anything else is left as written.`);
 				const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
 				const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
 				const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
@@ -69334,19 +69489,24 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 * warning, on the premise that `cdkd deploy` resolves through the
 * resolver's same unsupported-service arm — so AWS already holds the literal
 * and replaying it is a no-op. **That premise holds only for records cdkd
-* deployed.** CloudFormation resolves `ssm-secure` SERVER-side, so a record
-* adopted by `cdkd import --migrate-from-cloudformation` has the literal token
-* in state while the live resource holds the PLAINTEXT. `diffAt` skips such a
-* leaf, so it never drifts — but `buildRevertNewProperties` overlays the whole
-* top-level subtree when any SIBLING key drifts, which would push the literal
-* token over a resolved value. That is defect 1 of this issue surviving in a
-* narrower case, on a live AWS write.
+* deployed.** A record adopted by `cdkd import --migrate-from-cloudformation`,
+* or one whose position was edited out of band, holds something ELSE there.
+* `diffAt` skips such a leaf, so it never drifts — but
+* `buildRevertNewProperties` overlays the whole top-level subtree when any
+* SIBLING key drifts, which would push the literal token over that value. That
+* is defect 1 of this issue surviving in a narrower case, on a live AWS write.
+*
+* (When this was written the population was `ssm-secure`, which CloudFormation
+* resolves SERVER-side, so a migrated record held the PLAINTEXT on AWS. Since
+* issue #2482 cdkd resolves that spelling itself and the token never reaches
+* this pass; what survives is a spelling nobody resolves, so the live value
+* here is whatever the user or another tool put at that position.)
 *
 * Deciding by PROVENANCE would need a flag state does not carry. Deciding by
 * what AWS actually holds needs nothing and is exact in both directions: for a
 * cdkd-deployed record AWS holds the token, so copying it back is the same
-* no-op the premise described; for a migrated record AWS holds the resolved
-* value, which is left untouched.
+* no-op the premise described; for any other record AWS holds a value cdkd
+* cannot compare, which is left untouched.
 *
 * Falls back to KEEPING the token wherever AWS has nothing at that position —
 * that is what `cdkd deploy` sends, so it is the safe residual rather than
@@ -69354,12 +69514,11 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 * and bails to that same residual on any length mismatch, since a reordered
 * readback cannot be positioned against.
 */
-function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
+function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 	const walk = (value, live) => {
 		if (typeof value === "string" && value.includes("{{resolve:")) {
 			if (!isSingleDynamicReferenceToken(value)) return value;
 			if (live === void 0) return value;
-			if (typeof live === "string" && live.length >= MIN_SECRET_NEEDLE_LENGTH && isSecretBySpelling(value)) secrets.set(live, value);
 			return live;
 		}
 		if (Array.isArray(value)) {
@@ -69713,7 +69872,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				let newProperties;
 				try {
 					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid, outcome.awsProperties, secrets);
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties) : overlaid, outcome.awsProperties, secrets);
 					if (maskPreserved.unpreservablePaths.length > 0) {
 						totalUnresolvable++;
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskPreserved.unpreservablePaths.join(", ")} — the recorded baseline holds only the redaction mask there (a NoEcho custom-resource value), and AWS reports nothing to preserve, so cdkd has no value it may write. Force that custom resource to update (change one of its properties, e.g. a nonce) and re-deploy, so its handler runs again and supplies the value — an ordinary re-deploy leaves it unchanged and the mask stays.`);
@@ -70485,7 +70644,11 @@ async function stateMigrateCommand(options) {
 		logger.info("Migrating state bucket:");
 		logger.info(`  source:      ${legacyBucket} (resolved for --region ${region})`);
 		logger.info(`  destination: ${newBucket}`);
-		const probe = new S3Client({ region: "us-east-1" });
+		const probeRegion = "us-east-1";
+		const probe = new S3Client({
+			...awsClientDefaults(),
+			region: probeRegion
+		});
 		let sourceExists;
 		try {
 			sourceExists = await bucketExists(probe, legacyBucket);
@@ -70495,7 +70658,10 @@ async function stateMigrateCommand(options) {
 		if (!sourceExists) throw new Error(`Source bucket '${legacyBucket}' does not exist. Nothing to migrate. (Tip: run \`cdkd state info\` to confirm which bucket cdkd is reading from.)`);
 		const legacyRegion = await resolveBucketRegion(legacyBucket);
 		logger.info(`  source bucket actual region: ${legacyRegion}`);
-		const legacyS3 = new S3Client({ region: legacyRegion });
+		const legacyS3 = new S3Client({
+			...awsClientDefaults(),
+			region: legacyRegion
+		});
 		try {
 			await assertNoActiveLocks(legacyS3, legacyBucket);
 			const sourceObjects = await listAllObjects(legacyS3, legacyBucket);
@@ -70595,7 +70761,10 @@ async function assertNoActiveLocks(s3, bucket) {
 	}
 }
 async function ensureDestinationBucket(bucketName, region, accountId, logger) {
-	const probe = new S3Client({ region });
+	const probe = new S3Client({
+		...awsClientDefaults(),
+		region
+	});
 	let exists;
 	try {
 		exists = await bucketExists(probe, bucketName);
@@ -70606,10 +70775,16 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 		logger.info(`Destination bucket ${bucketName} already exists; reusing it.`);
 		const actual = await resolveBucketRegion(bucketName);
 		if (actual !== region) logger.warn(`Destination bucket lives in ${actual}, but source is in ${region}. Cross-region copy is supported but slower; objects will be replicated to ${actual}.`);
-		return new S3Client({ region: actual });
+		return new S3Client({
+			...awsClientDefaults(),
+			region: actual
+		});
 	}
 	logger.info(`Creating destination bucket ${bucketName} in ${region}...`);
-	const s3 = new S3Client({ region });
+	const s3 = new S3Client({
+		...awsClientDefaults(),
+		region
+	});
 	const createParams = { Bucket: bucketName };
 	if (region !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: region };
 	await s3.send(new CreateBucketCommand(createParams));
@@ -71871,7 +72046,7 @@ const PRE_DELETE_HANDLERS = {
 		const { ApiGatewayV2Client, DeleteStageCommand, NotFoundException } = await import("@aws-sdk/client-apigatewayv2");
 		const apiId = entry.properties["ApiId"];
 		if (typeof apiId !== "string" || !apiId) throw new Error(`cdkd state's properties for ${entry.logicalId} (${entry.resourceType}) is missing 'ApiId'`);
-		const client = new ApiGatewayV2Client({});
+		const client = new ApiGatewayV2Client({ ...awsClientDefaults() });
 		try {
 			await client.send(new DeleteStageCommand({
 				ApiId: apiId,
@@ -71890,7 +72065,7 @@ const PRE_DELETE_HANDLERS = {
 		const users = entry.properties["Users"];
 		const groups = entry.properties["Groups"];
 		if (!((roles?.length ?? 0) + (users?.length ?? 0) + (groups?.length ?? 0) > 0)) throw new Error(`cdkd state's properties for ${entry.logicalId} (${entry.resourceType}) has no Roles/Users/Groups attachment recorded — cannot pre-delete the inline policy. State may be from a pre-v0.74 cdkd binary; re-run \`cdkd state refresh-observed\` before export.`);
-		const client = new IAMClient({});
+		const client = new IAMClient({ ...awsClientDefaults() });
 		const deleteSafely = async (op) => {
 			try {
 				await op();
@@ -74316,7 +74491,7 @@ async function confirmPrompt$3(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd export confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal." });
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (AWS::ApiGatewayV2::Stage and AWS::IAM::Policy). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -77488,6 +77663,7 @@ async function gcCommand(options) {
 	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
+		...awsClientDefaults({ profile: options.profile }),
 		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
@@ -77512,6 +77688,7 @@ async function gcCommand(options) {
 	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
 	const ecrClient = new ECRClient({
+		...awsClientDefaults({ profile: options.profile }),
 		region,
 		...options.profile && { profile: options.profile }
 	});
@@ -78401,7 +78578,10 @@ async function publishAssetsCommand(stacks, options) {
 	if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
 	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const stsClient = new STSClient({ region: baseRegion });
+	const stsClient = new STSClient({
+		...awsClientDefaults(),
+		region: baseRegion
+	});
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 	stsClient.destroy();
 	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
@@ -82150,7 +82330,10 @@ async function pullEcrImage(imageUri, options) {
 	const callerIdentityKey = callerRegion ?? "_unset";
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
 	if (callerAccount === void 0) {
-		const sts = new STSClient({ ...callerRegion && { region: callerRegion } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...callerRegion && { region: callerRegion }
+		});
 		try {
 			const identity = await sts.send(new GetCallerIdentityCommand({}));
 			if (!identity.Account) throw new LocalInvokeBuildError$1("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
@@ -82177,6 +82360,7 @@ async function pullEcrImage(imageUri, options) {
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
 	const ecr = new ECRClient({
+		...awsClientDefaults(),
 		region: parsed.region,
 		...assumed && { credentials: assumed }
 	});
@@ -82202,7 +82386,10 @@ async function pullEcrImage(imageUri, options) {
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient({ ...callerRegion && { region: callerRegion } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...callerRegion && { region: callerRegion }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -84531,7 +84718,10 @@ function forwardAwsEnv$2(env) {
 */
 async function resolveProfileCredentials(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ profile });
+	const sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		profile
+	});
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
@@ -84552,7 +84742,10 @@ async function resolveProfileCredentials(profile) {
 */
 async function assumeLambdaExecutionRole$1(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -84831,7 +85024,10 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient({ ...region && { region } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...region && { region }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -85106,8 +85302,14 @@ var EcsSecretsResolutionError = class EcsSecretsResolutionError extends Error {
 async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
-	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({ ...options.region && { region: options.region } });
-	const ssmClient = options.ssmClient ?? new SSMClient({ ...options.region && { region: options.region } });
+	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
+		...awsClientDefaults(),
+		...options.region && { region: options.region }
+	});
+	const ssmClient = options.ssmClient ?? new SSMClient({
+		...awsClientDefaults(),
+		...options.region && { region: options.region }
+	});
 	const ownsSecretsClient = options.secretsManagerClient === void 0;
 	const ownsSsmClient = options.ssmClient === void 0;
 	try {
@@ -85901,7 +86103,10 @@ async function localRunTaskCommand(target, options) {
 async function resolvePlaceholderAccount(arn, region) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
@@ -85916,7 +86121,10 @@ async function resolvePlaceholderAccount(arn, region) {
 */
 async function assumeTaskRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -86055,7 +86263,10 @@ function pickCandidateStack(stackPattern, stacks) {
 }
 async function resolveCallerAccountId$1(region) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -87215,6 +87426,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 async function resolveCallerAccountId(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
+		...awsClientDefaults({ profile }),
 		...region && { region },
 		...profile && { profile }
 	});
@@ -87407,7 +87619,10 @@ function forwardAwsEnv$1(env) {
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -88194,7 +88409,10 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient({ ...region && { region } });
+		const sts = new STSClient({
+			...awsClientDefaults(),
+			...region && { region }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -88337,7 +88555,10 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 */
 async function assumeLambdaExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient({ ...region && { region } });
+	const sts = new STSClient({
+		...awsClientDefaults(),
+		...region && { region }
+	});
 	try {
 		const creds = (await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
@@ -89660,4 +89881,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C5evYwxk.js.map
+//# sourceMappingURL=program-BSanOkkV.js.map