@go-to-k/cdkd 0.290.29 → 0.290.31

package/dist/{program-PCCyP9-O.js → program-CnSaRdY9.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-Bcwb9_mO.js";
-import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS } from "./logger-6LP1UiFA.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-21iNqwR3.js";
+import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BjWM-UVj.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-snXN__f1.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dwnb3CES.js";
+import { t as getCdkdVersion } from "./version-IwTfNQ-K.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DNzgk-BS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1089,6 +1089,21 @@ const deployOptions = [
 * -c / --context can be specified multiple times to pass context key=value pairs
 */
 const contextOptions = [new Option("-c, --context <key=value...>", "Set context values (can be specified multiple times)")];
+/**
+* ANCHORED AT THE START ONLY, and that is what makes the renders below a
+* display boundary rather than a formality (issue
+* [#3397](https://github.com/go-to-k/cdkd/issues/3397)).
+*
+* A value CLEARING this test is constrained in its first ~30 characters and in
+* nothing after `role/` — `arn:aws:iam::1:role/` followed by an ESC, a
+* newline, or 10 MB of anything is a PASS. So `normalizeStartApiAssumeRole`'s
+* mutual-exclusion error, which renders an ARN this regex already accepted,
+* needs sanitizing exactly as much as the three REFUSALS that render one it
+* rejected. Tightening the regex instead was considered and is the wrong tool:
+* `src/utils/role-arn.ts`'s `IAM_ROLE_ARN_RE` is the strict parse, it runs
+* later and on a different path, and a stricter argparse here would start
+* refusing role-name shapes the deploy path accepts.
+*/
 const IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
 /**
 * Argparse for the repeatable `--assume-role` flag.
@@ -1102,16 +1117,17 @@ const IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
 function parseAssumeRoleToken(raw, previous) {
 	const acc = previous ?? { perLambda: {} };
 	if (!acc.perLambda) acc.perLambda = {};
+	const shownRaw = displayIdent(raw, { maxCodePoints: 613 });
 	const eqIndex = raw.indexOf("=");
 	if (eqIndex === -1) {
-		if (!IAM_ROLE_ARN_REGEX.test(raw)) throw new Error(`Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
+		if (!IAM_ROLE_ARN_REGEX.test(raw)) throw new Error(`Invalid --assume-role value "${shownRaw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
 		acc.globalArn = raw;
 		return acc;
 	}
 	const logicalId = raw.substring(0, eqIndex).trim();
 	const arn = raw.substring(eqIndex + 1).trim();
-	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new Error(`Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
-	if (!IAM_ROLE_ARN_REGEX.test(arn)) throw new Error(`Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
+	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new Error(`Invalid --assume-role value "${shownRaw}": left-hand side "${displayIdent(logicalId)}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
+	if (!IAM_ROLE_ARN_REGEX.test(arn)) throw new Error(`Invalid --assume-role value "${shownRaw}": right-hand side "${displayIdent(arn, { maxCodePoints: 613 })}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
 	acc.perLambda[logicalId] = arn;
 	return acc;
 }
@@ -1140,7 +1156,7 @@ function normalizeStartApiAssumeRole(raw, autoResolve) {
 		perLambda: {},
 		bareAutoResolve: true
 	} : void 0;
-	if (autoResolve && raw.globalArn) throw new Error(`--assume-role-auto auto-resolves EACH routed Lambda's own execution role, but --assume-role ${raw.globalArn} also names a single global default. These are mutually exclusive on the global slot. Either drop the global ARN to keep --assume-role-auto for every Lambda, or drop --assume-role-auto to keep the global default. Per-Lambda overrides (--assume-role <LogicalId>=<arn>) are compatible with either side.`);
+	if (autoResolve && raw.globalArn) throw new Error(`--assume-role-auto auto-resolves EACH routed Lambda's own execution role, but --assume-role ${displayIdent(raw.globalArn, { maxCodePoints: 613 })} also names a single global default. These are mutually exclusive on the global slot. Either drop the global ARN to keep --assume-role-auto for every Lambda, or drop --assume-role-auto to keep the global default. Per-Lambda overrides (--assume-role <LogicalId>=<arn>) are compatible with either side.`);
 	if (autoResolve) raw.bareAutoResolve = true;
 	return raw;
 }
@@ -12149,6 +12165,16 @@ function isSqsQueueUrl(value) {
 //#endregion
 //#region src/provisioning/providers/sns-topic-provider.ts
 /**
+* The value SNS enforces for a topic that never set `MaximumMessageSize`
+* (256 KiB, the standard maximum), and therefore what a template REMOVAL of
+* the member resets the attribute to — SNS refuses the `''` the other
+* `SetTopicAttributes` removals send (`MaximumMessageSize:  is not an integer
+* between 1024 and 1048576 bytes`, measured us-east-1 2026-09-18). A fresh
+* topic REPORTS no value at all, which `readCurrentState` folds to this value;
+* see there. Exported for the unit tests that pin both halves (issue #3413).
+*/
+const SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT = "262144";
+/**
 * AWS SNS Topic Provider
 *
 * Implements resource provisioning for AWS::SNS::Topic using the SNS SDK.
@@ -12172,7 +12198,8 @@ var SNSTopicProvider = class {
 		"DataProtectionPolicy",
 		"DeliveryStatusLogging",
 		"Subscription",
-		"FifoThroughputScope"
+		"FifoThroughputScope",
+		"MaximumMessageSize"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -12207,6 +12234,7 @@ var SNSTopicProvider = class {
 			if (properties["TracingConfig"]) topicAttributes["TracingConfig"] = properties["TracingConfig"];
 			if (properties["SignatureVersion"]) topicAttributes["SignatureVersion"] = stringifyValue(properties["SignatureVersion"]);
 			if (properties["FifoThroughputScope"]) topicAttributes["FifoThroughputScope"] = properties["FifoThroughputScope"];
+			if (properties["MaximumMessageSize"] != null) topicAttributes["MaximumMessageSize"] = stringifyValue(properties["MaximumMessageSize"]);
 			let tags;
 			if (properties["Tags"]) tags = properties["Tags"];
 			const createParams = {
@@ -12293,7 +12321,7 @@ var SNSTopicProvider = class {
 	}
 	async applyUpdate(logicalId, physicalId, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating SNS topic ${logicalId}: ${physicalId}`);
-		for (const attr of [
+		const mutableAttributes = [
 			{
 				name: "DisplayName",
 				prop: "DisplayName"
@@ -12327,13 +12355,19 @@ var SNSTopicProvider = class {
 				name: "DataProtectionPolicy",
 				prop: "DataProtectionPolicy",
 				serialize: true
+			},
+			{
+				name: "MaximumMessageSize",
+				prop: "MaximumMessageSize",
+				resetValue: SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT
 			}
-		]) {
+		];
+		for (const attr of mutableAttributes) {
 			const newVal = properties[attr.prop];
 			const oldVal = previousProperties[attr.prop];
 			if (JSON.stringify(newVal) !== JSON.stringify(oldVal)) {
 				let value;
-				if (newVal === void 0 || newVal === null) value = "";
+				if (newVal === void 0 || newVal === null) value = attr.resetValue ?? "";
 				else if (attr.serialize && typeof newVal !== "string") value = JSON.stringify(newVal);
 				else value = stringifyValue(newVal);
 				await this.snsClient.send(new SetTopicAttributesCommand({
@@ -12568,6 +12602,9 @@ var SNSTopicProvider = class {
 			"SignatureVersion"
 		]) result[key] = attrs[key] ?? "";
 		if (attrs["FifoTopic"] === "true") result["FifoThroughputScope"] = attrs["FifoThroughputScope"] ?? "";
+		const liveMaxSize = attrs["MaximumMessageSize"] || "262144";
+		const maxSizeNumber = Number(liveMaxSize);
+		result["MaximumMessageSize"] = Number.isFinite(maxSizeNumber) ? maxSizeNumber : liveMaxSize;
 		for (const key of ["ArchivePolicy", "DataProtectionPolicy"]) {
 			const v = attrs[key];
 			if (v) try {
@@ -69713,6 +69750,19 @@ function isTemplateShapeResolutionFailure(err) {
 *
 * Per-pattern throw sites, and the fence that keeps them true, are in
 * `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
+*
+* ONE CLASSIFICATION CHANGE, recorded because it is a GATE and this file does
+* not otherwise mention it. go-to-k/cdkd#3426 routed the `Ref <id> not found`
+* throw through the resolver's display builder, which strips control
+* characters and trims — so an id carrying a CR or padding, which `\S+` could
+* not match before, matches now, and such a unit moves from `count` (gateable
+* by `cdkd scrub --dry-run --fail`) to `warn` (not). The SAFE direction would
+* have been the other one, and it is accepted for a reason: a plain dangling
+* `Ref` already warned, so this adds no NEW bypass — it extends an existing
+* classification to ids that differ from an ordinary one only by characters
+* nobody can see. The alternative is a gate whose verdict depends on invisible
+* bytes in a logical id, which is worse to reason about. Pinned by
+* `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
 */
 const TEMPLATE_SHAPE_FAILURE_PATTERNS = [
 	/^Ref \S+ not found$/,
@@ -72197,7 +72247,7 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 				entityId = user?.UserId;
 			}
 			if (entityArn !== void 0 && entityArn.toLowerCase() === arn.toLowerCase()) uniqueId = entityId;
-			else getLogger().debug(`Principal ${arn} resolved to ${entityArn ?? "no entity"} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
+			else getLogger().debug(`Principal ${displayIdent(arn, { maxCodePoints: 613 })} resolved to ${entityArn === void 0 ? "no entity" : displayIdent(entityArn, { maxCodePoints: 613 })} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			const name = error instanceof Error ? error.name : "";
@@ -72207,7 +72257,7 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 				warnedOnDenied = true;
 				getLogger().warn(`Cannot read IAM principals (${name || "access denied"}). A resource policy whose principal AWS rendered as a unique id (AROA…/AIDA…) may therefore report drift that is only a spelling difference; grant iam:GetRole / iam:GetUser to resolve it, or re-run with --verbose for the full error.`);
 			}
-			getLogger().debug(`Could not resolve the unique id of principal ${arn} (${message}); leaving the policy principal comparison untouched.`);
+			getLogger().debug(`Could not resolve the unique id of principal ${displayIdent(arn, { maxCodePoints: 613 })} (${displayAwsMessage(message)}); leaving the policy principal comparison untouched.`);
 			if (isThrottlingError(error)) return void 0;
 		}
 		cache.set(arn, uniqueId);
@@ -81455,6 +81505,30 @@ function safeStack(value) {
 	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 }
 /**
+* `safe()` for an IAM ROLE ARN, the SECOND value class in this file whose
+* legitimate grammar runs past `displayIdent`'s 255-code-point default (issue
+* go-to-k/cdkd#3397 review).
+*
+* An AWS-legal role ARN reaches 613 code points — a 512-character path plus a
+* 64-character name — so `safe()` cut the one ARN this file renders at 255 and
+* appended `[cut: N more characters withheld]` INSIDE
+* `pass --role-arn to match`, the sentence whose only job is to say which role
+* to pass back. That is verbatim the failure `ROLE_ARN_MAX_CODE_POINTS`'s own
+* doc exists to prevent, and the display fence could not see it: it checks that
+* a sanitizer was CALLED, never which cap the call passed.
+*
+* A NAMED helper rather than a `maxCodePoints` argument at the site, for the
+* reason {@link safeStack} records about itself — a per-site spelling of
+* exactly this rule is what issue #3164 exists to stop, and a first cut of this
+* fix wrote one before the reference-count fence in
+* `tests/unit/cli/commands/rollback.test.ts` refused it. That refusal is the
+* fence working: it forces the question "which helper does this value belong
+* in" to be answered in code rather than in a diff.
+*/
+function safeRoleArn(value) {
+	return displayIdent(value, { maxCodePoints: 613 });
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -81574,7 +81648,7 @@ async function rollbackCommand(stackArg, options) {
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
 			const newestSegment = journal.segments[journal.segments.length - 1];
-			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safe(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
+			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safeRoleArn(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
 			logger.info(`\nRollback plan for '${safeStack(stackName)}' (${safe(region)}):`);
 			const planStateView = { ...stateResources };
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
@@ -88552,11 +88626,11 @@ async function pullEcrImage(imageUri, options) {
 		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })}`);
+			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })}`);
 		} else {
 			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
 			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
@@ -88587,7 +88661,7 @@ async function pullEcrImage(imageUri, options) {
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
-	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull...`);
+	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull...`);
 	const sts = new STSClient({
 		...awsClientDefaults(),
 		...callerRegion && { region: callerRegion }
@@ -88598,7 +88672,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 			RoleSessionName: `cdkd-local-ecr-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -88608,7 +88682,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -90987,7 +91061,7 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -92350,7 +92424,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 612 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} finally {
 		sts.destroy();
@@ -92372,7 +92446,7 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -93854,7 +93928,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -93911,7 +93985,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 */
 function assumeRoleFallbackWarning(args) {
 	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
-	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
 }
 /**
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
@@ -94072,7 +94146,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94685,7 +94759,7 @@ async function localInvokeCommand(target, options) {
 				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
 				if (arn) {
 					resolvedAssumeRoleArn = arn;
-					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 612 })}`);
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 613 })}`);
 				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 			}
 		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
@@ -95153,7 +95227,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -95191,7 +95265,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -95312,7 +95386,7 @@ function materializeInlineCode(handler, source, fileExtension) {
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 612 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 613 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Emit the "re-run with `--assume-role`" hint, if it applies.
@@ -95472,4 +95546,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-PCCyP9-O.js.map
+//# sourceMappingURL=program-CnSaRdY9.js.map