@go-to-k/cdkd 0.291.12 → 0.291.14

package/dist/{program-BwCSQ51f.js → program-D7aismcf.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as isMarkedNonRetryable, $i as injectiveKeyPrefix, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as AssetManifestLoader, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as ProvisioningError, Bi as resolveStateBucketWithDefault, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as resetAwsClients, Ci as partitionSensitiveEnv, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as CdkdError, Di as warnFinchArgvExposure, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as runDockerStreaming, En as malformedLocalOutputsWarning, Er as LockManager, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as LocalStartServiceError, Fi as getLegacyStateBucketName, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as ssmResolvedValueType, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as ResourceUpdateNotSupportedError, Hi as resolveUseCdkBootstrapAssets, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as resolveApp, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ji as MIGRATE_TMP_PREFIX, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as SynthesisError, Ki as CFN_TEMPLATE_BODY_LIMIT, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as MalformedProducerRecordRefusalError, Li as resolveAutoAssetStorage, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as DynamicReferenceRegionAmbiguousError, Mi as Synthesizer, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as IntrinsicResolutionRefusalError, Ni as synthesisStatusMessage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oi as escapeRegExp, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as LocalInvokeBuildError$1, Pi as getDefaultStateBucketName, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as shellQuote, Qi as injectiveKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as NestedStackChildDirectDestroyError, Ri as resolveCaptureObservedState, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as getAwsClients, Si as isMalformedEnvKey, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as setAwsClients, Ti as runDockerForeground, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as StackHasActiveImportsError, Ui as stateBucketExistenceConfirmed, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as ResourceTimeoutError, Vi as resolveStateBucketWithDefaultAndSource, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as StackTerminationProtectionError, Wi as warnDeprecatedNoPrefixCliFlag, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as withErrorHandling, Xi as uploadCfnTemplate, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as normalizeAwsError, Yi as findLargeInlineResources, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as pasteableCommand, Zi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as renderAssemblyPathEscape, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as canonicalizeRegion, ai as parseBootstrapMarker, an as s3BucketDomainName, ao as retryClassificationText, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as resolveBucketRegion, bi as getDockerCmd, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as failedStageNote, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as defineOwnKey, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as producerCoordinateKey, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as isRetryableTransientError, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as hasOwnKey, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as absoluteAssemblyPathEscape, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ownValue, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as PARTITION_TABLE, ii as isCrossRegionRedirect, in as s3BucketArn, io as markRedactedCause, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as DeployCancelledError, ji as getDockerImageBySourceHash, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as CrossAccountSecretRefusalError, ki as stripControlChars, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as globMatches, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as nullPrototypeRecord, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as decodeListingKey, ni as ensureAssetStorage, nn as producerRegionsFromState, no as isTransientServerError, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as derivePartitionAndUrlSuffix, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, oo as describeAwsFailure, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as hasPlainPrototype, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qi as CFN_TEMPLATE_URL_LIMIT, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as expectedOwnerParam, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, ro as markNonRetryable, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as AssemblyReader, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, so as safeStringify, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as producerRecordKey, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as isThrottlingError, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as processStackMessages, ui as assertCdkLocalDockerContextContained, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as resolveAssemblyPath, vi as finchSecretArgvRefusal, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as runWithStackAwsClients, wi as redactDockerArgvValues, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as AwsClients, xi as isDockerClientEnvKey, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, yi as formatDockerLoginError, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as PartialFailureError, zi as resolveSkipPrefix, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-CqKbD4yk.js";
+import { $ as yellow, $a as normalizeAwsError, $i as uploadCfnTemplate, $n as repairMalformedResourcePropertiesForReadOnly, $r as createAssetRedirectResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as warnFinchArgvExposure, An as malformedOutputsRefusalMessage, Ar as S3StateBackend, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as resolveAutoAssetStorage, Bn as refuseMalformedOrphansForDestroy, Br as hasReadableExportSet, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as getDockerCmd, Cn as isReadableResourceEntry, Cr as pathCrossesDottedKey, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as resetAwsClients, Di as redactDockerArgvValues, Dn as malformedOrphanRecordsWarning, Dr as redactSecretsForState, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as getAwsClients, Ei as partitionSensitiveEnv, En as malformedLocalOutputsWarning, Er as recoverMaskedOutput, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as DeployCancelledError, Fi as Synthesizer, Fn as malformedResourcesWarning, Fr as forceQuitRecoveryClause, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as ResourceTimeoutError, Gi as resolveUseCdkBootstrapAssets, Gn as refuseMalformedResourceEntries, Gr as isReadableBag, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as NestedStackChildDirectDestroyError, Hi as resolveSkipPrefix, Hn as refuseMalformedOutputs, Hr as hasUnverifiableParameterRefusal, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as DynamicReferenceRegionAmbiguousError, Ii as synthesisStatusMessage, In as malformedStateRefusalMessage, Ir as formatLockExpiry, It as isNamelessDynamicReferenceError, J as bold, Ja as StackTerminationProtectionError, Ji as ssmResolvedValueType, Jn as refuseMalformedResourcesForDestroy, Jr as shouldRetainResource, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as ResourceUpdateNotSupportedError, Ki as stateBucketExistenceConfirmed, Kn as refuseMalformedResourceEntriesForOrphan, Kr as orphansAfterRollback, Kt as coerceCfnInteger, L as planOrphanAdoption, La as IntrinsicResolutionRefusalError, Li as getDefaultStateBucketName, Ln as refuseDivergentRecordRegionForDestroy, Lr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as stripControlChars, Mn as malformedRenderedContainersWarning, Mr as UNREPRODUCIBLE_LOCK_CLAUSE, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as CrossAccountSecretRefusalError, Ni as AssetManifestLoader, Nn as malformedResourceEntriesWarning, Nr as buildForceUnlockCommand, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as runWithStackAwsClients, Oi as runDockerForeground, On as malformedOrphansRefusalMessage, Or as scrubResourceRecord, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as getDockerImageBySourceHash, Pn as malformedResourcePropertiesWarning, Pr as buildLockContentionMessage, Pt as getAccountInfo, Q as red, Qi as findLargeInlineResources, Qn as repairMalformedResourceEntriesForReadOnly, Qr as buildAssetRedirectMap, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as LocalInvokeBuildError$1, Ri as getLegacyStateBucketName, Rn as refuseMalformedNestedChildOutputs, Rr as DEFAULT_STATE_PREFIX, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as resolveAssemblyPath, Si as formatDockerLoginError, Sn as hasReadableResources, Sr as maskSecretsInText, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as AwsClients, Ti as isMalformedEnvKey, Tn as malformedExportSourceWarning, Tr as recordMaskOnlyValuesIn, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as PartialFailureError, Ui as resolveStateBucketWithDefault, Un as refuseMalformedOutputsForDestroy, Ur as importableOutputKeys, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as MalformedProducerRecordRefusalError, Vi as resolveCaptureObservedState, Vn as refuseMalformedOrphansForOrphan, Vr as hasReasonlessBaselineRefusal, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as ProvisioningError, Wi as resolveStateBucketWithDefaultAndSource, Wn as refuseMalformedResourceAttributesForOrphan, Wr as importableOutputs, Wt as assertRegionMatch, X as gray, Xa as SynthesisError, Xi as CFN_TEMPLATE_URL_LIMIT, Xn as repairMalformedOrphansForReadOnly, Xr as stringifyValue, Xt as readConfigString, Y as cyan, Yi as CFN_TEMPLATE_BODY_LIMIT, Yn as refuseMalformedState, Yr as AssetPublisher, Yt as configStringRefusal, Z as green, Zi as MIGRATE_TMP_PREFIX, Zn as repairMalformedOutputsForReadOnly, Zr as WorkGraph, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as nullPrototypeRecord, _i as describeDockerCapturedOutput, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as decodeListingKey, ai as ensureAssetStorage, an as s3BucketDomainName, ao as isThrottlingError, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as displayAssemblyPath, bi as dockerSpawnEnvWithSensitive, bn as hasReadableOrphans, br as markSameGenerationBag, bt as startInterruptWatch, c as replayFailedOperations, ca as canonicalizeRegion, ci as parseBootstrapMarker, cn as s3BucketWebsiteUrl, co as markRedactedCause, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as failedStageNote, di as validateContainerRepoName, dn as applyCallerIdentityCredentials, do as safeStringify, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ei as loadPublishableAssetManifest, en as requireConfigString, eo as withErrorHandling, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as globMatches, fi as buildDenyExternalAccessPolicy, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as hasPlainPrototype, gi as warnManifestExecutable, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as hasOwnKey, hi as resolveDockerContextDirectory, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as producerRecordKey, ii as assertAssetBucketRegion, in as s3BucketArn, io as isRetryableTransientError, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as CdkdError, ji as escapeRegExp, jn as malformedOutputsWarning, jr as rebuildClientForBucketRegion, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as setAwsClients, ki as runDockerStreaming, kn as malformedOrphansWarning, kr as LockManager, kt as IntrinsicFunctionResolver, l as replayRollback, la as derivePartitionAndUrlSuffix, li as readBootstrapMarkerBody, ln as applyRoleArnIfSet, lo as retryClassificationText, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as defineOwnKey, mi as buildDockerImage, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKeyPrefix, ni as AssetModeResolver, nn as producerRegionsFromState, no as shellQuote, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as expectedOwnerParam, oi as getBootstrapMarkerKey, on as s3BucketDualStackDomainName, oo as isTransientServerError, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as processStackMessages, pi as assertCdkLocalDockerContextContained, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as StackHasActiveImportsError, qi as warnDeprecatedNoPrefixCliFlag, qn as refuseMalformedResourcePropertiesForOrphan, qr as orphansCarriedFrom, qt as configBooleanRefusal, r as DeployEngine, ra as producerCoordinateKey, ri as BOOTSTRAP_MARKER_PREFIX, rn as withSharedDrainBudget, ro as isMarkedNonRetryable, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as PARTITION_TABLE, si as isCrossRegionRedirect, sn as s3BucketRegionalDomainName, so as markNonRetryable, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as injectiveKey, ti as rewriteTemplateAssetReferences, tn as classifyReplaySecretRegion, to as pasteableCommand, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as AssemblyReader, ui as validateAssetBucketName, un as AWS_CREDENTIAL_ENV_KEYS, uo as describeAwsFailure, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as ownValue, vi as describeDockerExecFailure, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as resolveBucketRegion, wi as isDockerClientEnvKey, wn as malformedExportNamesWarning, wr as recordMaskOnlyValue, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as renderAssemblyPathEscape, xi as finchSecretArgvRefusal, xn as hasReadableOutputs, xr as maskSecretsInError, xt as CloudControlProvider, y as keptWholeReasonText, ya as absoluteAssemblyPathEscape, yi as describeDockerFailure, yn as displayLogicalId, yr as isUncertifiedBaselineMaskPosition, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as LocalStartServiceError, zi as resolveApp, zn as refuseMalformedOrphans, zr as exportNamesCarriedFrom, zt as refStateLookupFromResource } from "./deploy-engine-WVUZ-Jm8.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CdZXcCGn.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTiCRWQZ.js";
+import { t as getCdkdVersion } from "./version-DHj4zq1f.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-EkJQ0mD9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2397,7 +2397,7 @@ function resolveVerboseTemplatePath(outputDir, stackName) {
 	try {
 		linked = lstatSync(resolved.path).isSymbolicLink();
 	} catch {}
-	if (linked) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template over a symbolic link at '${displaySafe(resolved.path)}'. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
+	if (linked) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template over a symbolic link at ${displayAssemblyPath(resolved.path)}. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
 	return resolved.path;
 }
 /**
@@ -3797,7 +3797,7 @@ const MAX_RENDERED_HOPS = 8;
 * the two a reader needs.
 */
 function renderChain(chain) {
-	const hop = (h) => `'${displaySafe(h.logicalId)}' (${displaySafe(h.templatePath)})`;
+	const hop = (h) => `'${displaySafe(h.logicalId)}' (${displayAssemblyPath(h.templatePath)})`;
 	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" -> ");
 	const keep = MAX_RENDERED_HOPS / 2;
 	return [
@@ -3828,8 +3828,8 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	}
 	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
 	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
-	if (defect.kind === "escaping-path") return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
-	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which is absolute. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
+	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
 }
 
 //#endregion
@@ -15261,8 +15261,7 @@ var LambdaUrlProvider = class {
 		}
 		if (!changed) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		let authTypeUnusable = false;
 		const requestedAuthType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", { onUnusable: (message) => {
@@ -15404,13 +15403,31 @@ var LambdaUrlProvider = class {
 	* Users adopting an existing function URL should pass
 	* `--resource <logicalId>=<functionArnOrName>` (matching the physical id
 	* format returned by `create()`).
+	*
+	* The override is read back with `GetFunctionUrlConfig` so the record gets
+	* the same `FunctionUrl` / `FunctionArn` attributes `create()` records
+	* (issue #3624). Neither can be built from the physical id, so without them
+	* a sibling's `Fn::GetAtt [<Url>, FunctionUrl]` (a CloudFront
+	* `FunctionUrlOrigin`) stays an unresolved intrinsic in its imported record.
+	* The deploy-time stale-attribute heal (#1852) re-reads through this method
+	* too. Returns `null` when no URL config exists behind the id.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return {
+		if (!input.knownPhysicalId) return null;
+		let resp;
+		try {
+			resp = await this.lambdaClient.send(new GetFunctionUrlConfigCommand({ FunctionName: input.knownPhysicalId }));
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException) return null;
+			throw err;
+		}
+		return {
 			physicalId: input.knownPhysicalId,
-			attributes: {}
+			attributes: definedAttributes({
+				FunctionUrl: resp.FunctionUrl,
+				FunctionArn: resp.FunctionArn
+			})
 		};
-		return null;
 	}
 	/**
 	* Build CORS configuration from CDK properties.
@@ -58787,7 +58804,10 @@ var EMRInstanceGroupConfigProvider = class {
 			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
 			return {
 				physicalId: groupId,
-				attributes: { Id: groupId }
+				attributes: {
+					Id: groupId,
+					InstanceGroupId: groupId
+				}
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -58858,7 +58878,10 @@ var EMRInstanceGroupConfigProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Id: physicalId }
+				attributes: {
+					Id: physicalId,
+					InstanceGroupId: physicalId
+				}
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
@@ -58891,7 +58914,7 @@ var EMRInstanceGroupConfigProvider = class {
 		this.logger.debug(`EMR instance group ${physicalId} (role ${role ?? "unknown"}) has no standalone delete API; its instances are released when the parent cluster terminates. Removing cdkd state only.`);
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
-		if (attributeName === "Id") return physicalId;
+		if (attributeName === "Id" || attributeName === "InstanceGroupId") return physicalId;
 	}
 	/**
 	* Poll until the group is `RUNNING` AND its `RunningInstanceCount` equals
@@ -65439,18 +65462,18 @@ var NestedStackProvider = class {
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+			throw new Error(`Failed to read nested template at ${displayAssemblyPath(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
 		let template;
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+			throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
 		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
 			const n = rewriteTemplateAssetReferences(template, assetRedirect);
-			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${displaySafe(templatePath)}`);
+			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${displayAssemblyPath(templatePath)}`);
 		}
 		return {
 			template,
@@ -65461,9 +65484,9 @@ var NestedStackProvider = class {
 		const dir = path.dirname(childTemplatePath);
 		const result = Object.create(null);
 		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
-			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
+			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
 			const resolved = resolveAssemblyPath(dir, assetPath);
-			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`));
+			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`));
 			result[grandLogicalId] = resolved.path;
 		}
 		return result;
@@ -68375,9 +68398,9 @@ function indexNestedChildTemplates(template, templatePath) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 		const resolved = resolveAssemblyPath(dir, assetPath);
-		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
 		result[logicalId] = resolved.path;
 	}
 	return result;
@@ -68770,7 +68793,7 @@ async function buildDiffTree(args) {
 		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
 		const resolvedChildPath = path.resolve(childTemplatePath);
-		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template '${displaySafe(resolvedChildPath)}', which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
+		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template ${displayAssemblyPath(resolvedChildPath)}, which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
 		const childAncestorTemplatePaths = new Set(ancestorTemplatePaths ?? []).add(resolvedChildPath);
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
@@ -72863,6 +72886,36 @@ function deepEqual(a, b) {
 	}
 	return true;
 }
+/**
+* {@link deepEqual}, except that a `mask` STRING on the state side matches any
+* STRING on the AWS side (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Answers "do these two differ ANYWHERE other than at a masked position?" —
+* the question that separates a baseline cdkd could not certify from real
+* drift beside it. Positional and shape-strict on purpose: an array whose
+* length changed or whose elements AWS reordered is NOT equal, because a mask
+* cannot say which element it stood for, and treating a reorder as equal would
+* hide an edit. Only a string can match a mask, since the redaction masks
+* string leaves alone.
+*/
+function equalModuloMask(state, aws, mask) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (a === mask && typeof b === "string") return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMask(v, b[i], mask));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
+}
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -73608,6 +73661,10 @@ const UNCOMPARED_REASONS = {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: cdkd refused to resolve a dynamic reference their state records"
 	},
+	uncertifiedBaseline: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: their recorded baseline holds the redaction mask where cdkd could not tell which live value a secret reference became"
+	},
 	unresolvedToken: {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: their state records a `{{resolve:...}}` spelling cdkd resolves for nobody, which no re-run can clear"
@@ -73644,6 +73701,7 @@ const UNCOMPARED_REASONS = {
 const ANY_OF_IT_COMPARED = {
 	refused: true,
 	unresolvedToken: true,
+	uncertifiedBaseline: true,
 	readFailed: false,
 	baselineRefused: false,
 	unreadableRecord: false
@@ -74182,7 +74240,8 @@ function notComparedReason(cause) {
 		unresolvedToken: "its state records a `{{resolve:...}}` spelling cdkd resolves for nobody (permanent; a re-run cannot clear it)",
 		readFailed: "the read or comparison threw, so NONE of its properties were compared",
 		unreadableRecord: "its state record is not readable as a resource — not an object, or carrying no resource type — so there was nothing to compare (repair or re-import the record)",
-		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)"
+		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)",
+		uncertifiedBaseline: "its recorded baseline holds the redaction mask at a position cdkd could not pair with the secret reference there, so that position was not compared — every other property was (deploy a change to this resource to re-capture the baseline)"
 	}[cause];
 }
 /**
@@ -74399,6 +74458,54 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 	return await walk(props, "");
 }
 /**
+* Split off the changes that exist ONLY because the observed baseline holds an
+* uncertified-position mask (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Issue [#2852](https://github.com/go-to-k/cdkd/issues/2852) writes
+* {@link SECRET_MASK} into `observedProperties` at every position the readback
+* walk could not pair with a dynamic reference in the source. No live value
+* equals the mask, so before this every such resource read `drifted` on every
+* run — a change nobody made, which `--accept` refused and no no-change deploy
+* cleared. The position is not drifted; it is UNKNOWN, and is reported that
+* way (`uncertifiedBaseline`, exit 2) instead.
+*
+* A change qualifies only when all three hold:
+*
+* - its state side carries a mask;
+* - the mask is the fail-closed class, not a `NoEcho` one
+*   ({@link isUncertifiedBaselineMaskPosition}) — a `NoEcho` mask keeps the
+*   issue #2274 disposition;
+* - the two sides are equal once each masked string is allowed to match any
+*   live string ({@link equalModuloMask}). Anything else — a length change, a
+*   reorder, an edit beside the mask — stays real drift.
+*
+* Runs on the COMPARISON values, before {@link redactDriftChanges}: after it
+* the AWS side is itself a mask or an expression and the equality means
+* nothing. The split-off changes reach no printer, no `--json` payload and
+* neither remediation path; nothing about them is persisted or pushed.
+*
+* Accepted residuals, both inherent to a position cdkd cannot name: a secret
+* rotated (or edited) AT a masked position is not seen, and a masked element of
+* a declared-unordered array is sorted apart from its live counterpart and so
+* stays `drifted`.
+*/
+function partitionUncertifiedBaselineChanges(changes, properties, baseline) {
+	const kept = [];
+	const uncertifiedPaths = [];
+	for (const change of changes) {
+		if (carriesSecretMask(change.stateValue) && isUncertifiedBaselineMaskPosition(properties, change.path) && !pathCrossesDottedKey(baseline, change.path) && equalModuloMask(change.stateValue, change.awsValue, "***")) {
+			uncertifiedPaths.push(change.path);
+			continue;
+		}
+		kept.push(change);
+	}
+	return {
+		kept,
+		uncertifiedPaths
+	};
+}
+/**
 * Is a drift reported at `path` positioned on, or above, a known secret?
 *
 * The PREFIX direction is the one that matters: a secret sits at a leaf (or at
@@ -74472,7 +74579,7 @@ function acceptRefusalReason(change, maskedPaths) {
 	if (!maskedPaths.has(change.path)) return void 0;
 	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
 	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
-	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. Re-deploy to refresh it";
+	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. A `cdkd deploy` that CHANGES this resource re-captures the baseline (a deploy that changes nothing does not); where the value came from a `NoEcho` custom resource, that custom resource must update too, so its handler supplies the value again";
 	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
 }
 /**
@@ -74681,12 +74788,13 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
 					aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
 				} : protocolNormalized;
-				const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
+				const partitioned = partitionUncertifiedBaselineChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
 					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 					unionWalkObjects: useObserved,
 					unorderedPaths
-				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
-				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+				}), resource.properties ?? {}, baseline);
+				const reported = redactDriftChanges(partitioned.kept, secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
+				const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
 				if (reported.changes.length === 0) {
 					if (notComparedCause !== void 0) outcomes.push({
 						kind: "notCompared",
@@ -74706,6 +74814,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					...reported,
 					awsProperties: aws,
 					secrets,
+					uncertifiedPaths: partitioned.uncertifiedPaths,
+					secretsIncomplete: secretResolutionFailed || unresolvedTokens.size > 0,
 					notComparedCause
 				});
 			} catch (err) {
@@ -75713,6 +75823,108 @@ function corroboratedLeafCount(send, live, wildcardLeaf = isMaskLeaf) {
 	return deepEqualUnordered(send, live) ? 1 : void 0;
 }
 /**
+* Send AWS's OWN value at every uncertified-baseline position (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Detection split those positions off because the baseline's `***` was the
+* only difference there, so there is nothing to revert at them. But
+* {@link buildRevertNewProperties} overlays whole TOP-LEVEL keys: a real change
+* elsewhere under the same key carries the baseline subtree — masks included —
+* into the send bag, and {@link preserveLiveValuesAtMaskedLeaves} then cannot
+* pair an anchor-less list and refuses the whole resource. Detection already
+* certified the alignment ({@link equalModuloMask} held on these very
+* positions), so the live subtree is copied in wholesale.
+*
+* Every live STRING standing where the baseline held the mask is registered as
+* a mask-only needle — at EVERY uncertified path, overlaid or not — as the mask
+* walk does for the leaves it copies: the value cdkd could not name may be a
+* secret, and the send bag is what the provider's log lines see. Registration
+* is POSITIONAL where the two sides line up, and covers every live string under
+* the path where they do not (over-masking fails safe). It is only the OVERLAY
+* that leaves a non-aligned path untouched, so the mask walk after this one
+* still refuses rather than guesses. The #1644 narrowing write does not rely on
+* the needles alone: {@link keepBaselineAtUncertifiedPaths} keeps the masked
+* baseline value at these paths whatever the value's length.
+*/
+function overlayLiveAtUncertifiedPaths(send, uncertifiedPaths, awsProperties, baseline, secrets, overlaidTopLevelKeys) {
+	if (uncertifiedPaths.length === 0) return send;
+	let out = send;
+	for (const path of uncertifiedPaths) {
+		const live = getAtPath(awsProperties, path);
+		const masked = getAtPath(baseline, path);
+		if (!(live !== void 0 && equalModuloMask(masked, live, "***"))) {
+			if (live !== void 0) recordMaskOnlyValuesIn(live, secrets);
+			continue;
+		}
+		const needles = [];
+		const collect = (b, l) => {
+			if (b === "***" && typeof l === "string") {
+				needles.push(l);
+				return;
+			}
+			if (Array.isArray(b) && Array.isArray(l)) {
+				b.forEach((item, i) => collect(item, l[i]));
+				return;
+			}
+			if (b !== null && typeof b === "object" && l !== null && typeof l === "object") {
+				for (const key of Object.keys(b)) if (hasOwnKey(l, key)) collect(b[key], ownValue(l, key));
+			}
+		};
+		collect(masked, live);
+		for (const needle of needles) recordMaskOnlyValue(secrets, needle);
+		const topLevelKey = path.split(".", 1)[0] ?? "";
+		if (overlaidTopLevelKeys.has(topLevelKey)) out = withValueAtPath(out, path, live);
+	}
+	return out;
+}
+/**
+* Put the BASELINE's own value back at every uncertified-baseline path of a
+* #1644 narrowing delta (issue [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* The delta is the provider's echo of what it delivered, and at such a path
+* that is a live value cdkd could not name: the position source holds `***`
+* rather than a reference, so the fail-closed walk never fires there, and a
+* needle shorter than the substitution floor is never registered. Keeping the
+* masked baseline value there persists nothing new — the position was unknown
+* before the revert and stays unknown — whatever the value's length. A path
+* the delta does not reach (its top-level key was not narrowed, or was
+* dropped) is left alone. The WHOLE baseline subtree comes back, so a real
+* narrowing of an unmasked neighbour inside it is undone too; the next run
+* then reports that as drift (the comparison is shape-strict), which is the
+* safe side of persisting a value cdkd cannot name.
+*/
+function keepBaselineAtUncertifiedPaths(delta, uncertifiedPaths, baseline) {
+	let out = delta;
+	for (const path of uncertifiedPaths) {
+		if (getAtPath(out, path) === void 0) continue;
+		const kept = getAtPath(baseline, path);
+		if (kept === void 0) continue;
+		out = withValueAtPath(out, path, kept);
+	}
+	return out;
+}
+/**
+* `bag` with `value` at the dotted `path`, rebuilding each ancestor rather than
+* writing into it, so the caller's bag — shared with the detection outcome —
+* is never mutated. Own keys throughout, for `getAtPath`'s reason. A path whose
+* ancestor is not a plain object returns `bag` unchanged.
+*/
+function withValueAtPath(bag, path, value) {
+	const [head, ...rest] = path.split(".");
+	if (head === void 0) return bag;
+	const out = {};
+	for (const [k, v] of Object.entries(bag)) defineOwnKey(out, k, v);
+	if (rest.length === 0) {
+		defineOwnKey(out, head, value);
+		return out;
+	}
+	const child = hasOwnKey(bag, head) ? ownValue(bag, head) : void 0;
+	if (child === null || typeof child !== "object" || Array.isArray(child)) return bag;
+	if (!hasPlainPrototype(child)) return bag;
+	defineOwnKey(out, head, withValueAtPath(child, rest.join("."), value));
+	return out;
+}
+/**
 * Keep `cdkd drift --revert` from pushing a REDACTION MASK to AWS (issue
 * [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
 *
@@ -76139,8 +76351,8 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert when cdkd can pair its position against AWS's report (a list element by an identity field, or by its list's own unchanged literal values). Where it cannot pair, and where a token is EMBEDDED in a longer string, the token is written literally, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
 				let newProperties;
 				try {
-					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties) : overlaid, outcome.awsProperties, secrets, overlaid);
+					const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 }), outcome.uncertifiedPaths, outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")));
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(certifiedOverlay, outcome.awsProperties) : certifiedOverlay, outcome.awsProperties, secrets, certifiedOverlay);
 					if (maskPreserved.unpreservablePaths.length > 0) {
 						totalUnresolvable++;
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. Two causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value), or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so the baseline is recaptured against the template). An ordinary no-change re-deploy clears neither.`);
@@ -76165,7 +76377,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), outcome.uncertifiedPaths, revertBaseline));
 						}
 					} catch (captureErr) {
 						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
@@ -76320,7 +76532,7 @@ function printRevertPlan(reports, out) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && preserved.length > 0) out.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.secretsIncomplete && preserved.length > 0) out.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					out.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
@@ -76331,7 +76543,7 @@ function printRevertPlan(reports, out) {
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && unbaselined.length > 0) out.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.secretsIncomplete && unbaselined.length > 0) out.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
@@ -76482,8 +76694,13 @@ function writeHumanReport(reports) {
 		if (notCompared.length > 0) {
 			const notComparedAtAll = notCompared.filter((n) => !ANY_OF_IT_COMPARED[n.cause]).length;
 			const referenceCaused = notCompared.length - notComparedAtAll;
+			const partialCauses = new Set(notCompared.filter((n) => ANY_OF_IT_COMPARED[n.cause]).map((n) => n.cause));
+			const hasReferencePartial = partialCauses.has("refused") || partialCauses.has("unresolvedToken");
+			const hasUncertified = partialCauses.has("uncertifiedBaseline");
+			const partialClause = hasReferencePartial && !hasUncertified ? "cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared" : hasUncertified && !hasReferencePartial ? "their recorded baseline holds the redaction mask at a position cdkd could not certify, so that position was NOT compared" : `some of their properties were NOT compared; each entry below names why`;
+			const partialClauseShort = hasReferencePartial && !hasUncertified ? "a dynamic reference cdkd could not, or refused to, resolve" : hasUncertified && !hasReferencePartial ? "a baseline position cdkd could not certify" : "see each entry";
 			const atAllCause = Object.keys(UNCOMPARED_REASONS).filter((cause) => cause in ANY_OF_IT_COMPARED).filter((cause) => !ANY_OF_IT_COMPARED[cause] && notCompared.some((n) => n.cause === cause)).map((cause) => UNCOMPARED_REASONS[cause].phrase.replace(/^not compared AT ALL: /, "")).join("; ");
-			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
+			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — ${partialClause}:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (${partialClauseShort})` : "") + `:\n`);
 			for (const { outcome, cause } of notCompared) process.stdout.write(`    ! ${outcome.logicalId} (${outcome.resourceType}) — ${notComparedReason(cause)}\n`);
 		}
 		if (unsupported.length > 0) {
@@ -79366,9 +79583,9 @@ function indexNestedTemplatePaths(template, templateDir) {
 		if (r.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = r.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates.`);
 		const resolved = resolveAssemblyPath(templateDir, assetPath);
-		if (!resolved.contained) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, templateDir)}`);
+		if (!resolved.contained) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, templateDir)}`);
 		result[logicalId] = resolved.path;
 	}
 	return result;
@@ -89473,12 +89690,12 @@ function resolveAssetCodeDirectory(opts) {
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0) getLogger().warn(`Lambda '${displaySafe(logicalId)}' has an absolute Metadata['aws:asset:path'] pointing outside the assembly: '${displaySafe(absolute)}'` + (escape.escape === "symlink" ? ` (through a symbolic link to '${displaySafe(escape.realPath)}')` : "") + ". cdkd will bind-mount that directory into the container read-only, where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.");
+		if (escape !== void 0) getLogger().warn(`Lambda '${displaySafe(logicalId)}' has an absolute Metadata['aws:asset:path'] pointing outside the assembly: ${displayAssemblyPath(absolute)}` + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(escape.realPath)})` : "") + ". cdkd will bind-mount that directory into the container read-only, where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.");
 		return absolute;
 	}
 	const resolved = resolveAssemblyPath(manifestDir, assetPath, { containWithin: assetOutdir });
 	if (!resolved.contained && resolved.escape === "lexical" && resolved.path === resolve(assetOutdir)) return resolved.path;
-	if (!resolved.contained) throw wrapError(`Lambda '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}`);
+	if (!resolved.contained) throw wrapError(`Lambda '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}`);
 	return resolved.path;
 }
 /**
@@ -89544,7 +89761,7 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 		assetOutdir,
 		logicalId
 	});
-	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' asset directory '${displaySafe(abs)}' does not exist or is not a directory. Re-synthesize the app and retry.`);
+	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' asset directory ${displayAssemblyPath(abs)} does not exist or is not a directory. Re-synthesize the app and retry.`);
 	return abs;
 }
 /**
@@ -92621,7 +92838,7 @@ function clampConcurrency(input) {
 async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	foldRegionOption(options);
 	if (options.stackRegion !== void 0) {
 		options.rawStackRegion = options.stackRegion;
 		options.stackRegion = canonicalizeRegion(options.stackRegion);
@@ -92746,7 +92963,7 @@ async function localStartApiCommand(target, options) {
 				assumeRole: options.assumeRole,
 				containerHost: options.containerHost,
 				...debugPortBase !== void 0 && { debugPort: debugPortBase + i },
-				stsRegion: options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"],
+				stsRegion: canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]),
 				inlineTmpDirs,
 				layerTmpDirs,
 				stateByStack,
@@ -92814,7 +93031,7 @@ async function localStartApiCommand(target, options) {
 			for (const result of handles) if (result.status === "fulfilled") groupPool.release(result.value);
 			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
 		}
-		const defaultRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? void 0;
+		const defaultRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? void 0);
 		const started = await startApiServer({
 			state: groupState,
 			rieTimeoutMs,
@@ -92901,7 +93118,7 @@ async function localStartApiCommand(target, options) {
 				spec.env["AWS_ACCESS_KEY_ID"] = "AKIAIOSFODNN7EXAMPLE";
 				spec.env["AWS_SECRET_ACCESS_KEY"] = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
 			}
-			if (!spec.env["AWS_REGION"]) spec.env["AWS_REGION"] = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+			if (!spec.env["AWS_REGION"]) spec.env["AWS_REGION"] = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1");
 			spec.extraHosts = [...spec.extraHosts ?? [], ...hostGatewayMapping];
 		}
 		wsServers.push({
@@ -93743,6 +93960,14 @@ function readEnvOverridesFile$3(filePath) {
 * handler's AWS SDK calls can authenticate. Used when --assume-role is
 * NOT set for that Lambda — SAM-compatible default.
 *
+* Issue [#1843](https://github.com/go-to-k/cdkd/issues/1843): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in and the
+* credentials are copied verbatim (an access key id is case-sensitive) — the
+* twin of `local-invoke.ts`'s `forwardAwsEnv`. The value becomes the
+* container's own `AWS_REGION`, and SDK endpoint resolution is case-sensitive.
+* Folded here as well as at the handler entry because this helper is exported
+* and must not depend on its caller having folded `process.env`.
+*
 * Exported for unit-test isolation (`local-container-caller-identity.test.ts`),
 * which drives the `--role-arn` cases without booting the API server.
 */
@@ -93752,9 +93977,11 @@ function forwardAwsEnv$2(env) {
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
 	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
 	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 	applyCallerIdentityCredentials(env);
 }
@@ -94907,7 +95134,7 @@ async function prepareOneImage(task, container, options) {
 				tag,
 				...task.stack.assetOutdir !== void 0 && { assetOutdir: task.stack.assetOutdir },
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${displaySafe(container.name)}' (${asset.source.directory !== void 0 ? displaySafe(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${displaySafe(container.name)}' (${asset.source.directory !== void 0 ? displayAssemblyPath(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
 			});
 			if (actualTag !== tag) {
 				const tagArgs = [
@@ -95654,7 +95881,7 @@ function engineAssemblyRoot(outdir) {
 	if (!climbed) return outdir;
 	if (!warnedDerivedRoots.has(dir)) {
 		warnedDerivedRoots.add(dir);
-		getLogger().warn(`'${displaySafe(outdir)}' is a cdk.Stage sub-assembly, so cdkd is treating its parent '${displaySafe(dir)}' as the assembly root when it checks Docker build contexts — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named.`);
+		getLogger().warn(`${displayAssemblyPath(outdir)} is a cdk.Stage sub-assembly, so cdkd is treating its parent ${displayAssemblyPath(dir)} as the assembly root when it checks Docker build contexts — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named.`);
 	}
 	return dir;
 }
@@ -96664,12 +96891,12 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const manifest = await loader.loadManifest(cdkOutDir, resolved.stack.stackName);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
-	if (!asset) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
+	if (!asset) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle (asset ${displaySafe(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assemblyDir,
 		sink: "read that directory and build a local image from it"
 	});
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source '${displaySafe(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source ${displayAssemblyPath(sourceDir)} does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -98369,7 +98596,7 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 */
 function resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler) {
 	const resolved = resolveAssemblyPath(dir, `${modulePath}${fileExtension}`);
-	if (!resolved.contained) throw new Error(`Handler '${displaySafe(handler)}' names a module path that ${renderAssemblyPathEscape(resolved, dir, "materialize it", "A Handler's module path names a file inside the function's own code directory; one that leaves it would write the inline Code.ZipFile body to an arbitrary path on this machine. Refusing to materialize it.")}`);
+	if (!resolved.contained) throw new Error(`Handler ${displayAssemblyPath(handler)} names a module path that ${renderAssemblyPathEscape(resolved, dir, "materialize it", "A Handler's module path names a file inside the function's own code directory; one that leaves it would write the inline Code.ZipFile body to an arbitrary path on this machine. Refusing to materialize it.")}`);
 	return resolved.path;
 }
 /**
@@ -98580,4 +98807,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BwCSQ51f.js.map
+//# sourceMappingURL=program-D7aismcf.js.map