@go-to-k/cdkd 0.294.8 → 0.294.10

package/dist/{program-CVOLJJ2z.js → program-Eed63bId.js}

@@ -1,18 +1,20 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-B46YMG0h.js";
 import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
-import { n as awsClientDefaults, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as nestedChildStackName, $a as shouldRetainResource, $n as isUnboundTemplateParameter, $o as ssmResolvedValueType, $r as refuseMalformedOutputsForDestroy, Aa as carriesSecretMask, Ai as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as DiffCalculator, Ao as partitionSensitiveEnv, Ar as malformedLocalResourcesWarning, At as extractDeploymentEventError, B as gray, Ba as isLockInfoExpired, Bn as isIamRoleArn, Bo as Synthesizer, Br as malformedResourcePropertiesWarning, Bt as collectDeclaredOutputNames, Ca as scrubResourceRecord, Ci as findActionableSilentDrops, Co as describeDockerFailure, Cr as isReadableOrphanRecord, Cs as resolveAssemblyPath, Ct as isFinalSnapshotError, Da as isUncertifiedBaselineMaskPosition, Di as hasNoCloudControlHandlers, Do as getDockerCmd, Dr as malformedExportSourceWarning, Dt as updatePartialReason, Ea as dynamicReferenceTokens, Ei as NO_CC_HANDLERS_REASON, Eo as formatDockerLoginError, Er as malformedExportNamesWarning, Et as updatePartialMessage, Fa as STATE_SOURCED_READBACK_RULES, Fn as regionLessSecretName, Fo as warnFinchArgvExposure, Fr as malformedOrphansWarning, Ft as secretBearingStateKeyWarning, G as namesAnyDeclaredParameter, Ga as hasReadableExportSet, Gn as envCredentialsAreAssumedRole, Go as resolveAutoAssetStorage, Gr as refuseDivergentRecordRegionForDestroy, Gt as DEFAULT_RESOURCE_WARN_AFTER_MS, H as red, Ha as rebuildClientForBucketRegion, Hn as AWS_CREDENTIAL_ENV_KEYS, Ho as getDefaultStateBucketName, Hr as malformedScrubResourceEntriesRefusalMessage, Ht as isExportAliasCollision, I as formatResourceLine, Ia as TEMPLATE_SOURCED_RULES, In as applyRoleArnIfSet, Io as escapeRegExp, Ir as malformedOutputsRefusalMessage, It as secretSafeKeyDisplay, J as makeSiblingClaimReader, Ja as importableOutputKeys, Jo as resolveStateBucketWithDefault, Jr as refuseMalformedOrphanRecordsForDestroy, K as reachableDivergentParameters, Ka as hasReasonlessBaselineRefusal, Ko as resolveCaptureObservedState, Kt as maskingRetryLogger, L as createReadOnlyAttributeHealerFactory, La as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ln as assertFlagRoleArn, Lo as stripControlChars, Lr as malformedOutputsWarning, Lt as exportNameSecretExposure, Ma as recordMaskOnlyValuesIn, Mi as isStatefulRecreateTargetSync, Mn as IntrinsicFunctionResolver, Mo as redactedDockerCause, Mr as malformedOrphanRecordsWarning, Mt as displayTextOrWithheld, Na as STATE_SOURCED_BASELINE_RULES, Ni as renderStatefulReason, Nn as classifyReplaySecretRegion, No as runDockerForeground, Nr as malformedOrphanRowsKeptWarning, Nt as exportAliasCollisionScrubWarning, Oa as pathCrossesDottedKey, Oi as findReplacedReadersOfRecreateTargets, Oo as isDockerClientEnvKey, Or as malformedLocalOutputsWarning, Ot as DeploymentEventsReader, Pa as STATE_SOURCED_CROSS_GENERATION_RULES, Pn as producerRegionsFromState, Po as runDockerStreaming, Pr as malformedOrphansRefusalMessage, Pt as secretBearing, Qa as orphansCarriedFrom, Qi as withRetry, Qn as coerceParameterTypedValue, Qo as warnDeprecatedNoPrefixCliFlag, Qr as refuseMalformedOutputs, R as bold, Ra as isSingleDynamicReferenceToken, Rn as assertSendableRoleArn, Ro as AssetManifestLoader, Rr as malformedRenderedContainersWarning, Rt as isWholeDynamicReferenceValue, Sa as redactSecretsForState, Si as unreadableResourceEntries, Sn as isWaitAbandonedError, So as describeDockerExecFailure, Sr as hasReadableResources, Ss as renderAssemblyPathEscape, St as effectiveDeletionPolicy, Ta as DYNAMIC_REFERENCE_TOKEN_SCAN, To as finchSecretArgvRefusal, Tr as malformedDriftResourcePropertiesWarning, Ts as resolveBucketRegion, Tt as unsupportedFinalSnapshotError, U as yellow, Ua as describeRegionValueKind, Un as applyCallerIdentityCredentials, Uo as getLegacyStateBucketName, Ur as malformedStateRefusalMessage, Ut as bindingSkippedOutputs, V as green, Va as S3StateBackend, Vn as sendableAssumeRoleCommand, Vo as synthesisStatusMessage, Vr as malformedResourcesWarning, Vt as collectPublishedOutputNames, W as computeParameterTaint, Wa as exportNamesCarriedFrom, Wn as callerEnvCredentials, Wo as resolveApp, Wr as previewableOrphanRecords, Wt as DEFAULT_RESOURCE_TIMEOUT_MS, X as NESTED_PENDING_PARENT_REASON, Xa as isReadableBag, Xi as templateResourceTypes, Xo as resolveUseCdkBootstrapAssets, Xr as refuseMalformedOrphansForDestroy, Y as planOrphanAdoption, Ya as importableOutputs, Yi as prefetchCreateOnlyPropertyPaths, Yo as resolveStateBucketWithDefaultAndSource, Yr as refuseMalformedOrphans, Yt as ledgerForStack, Z as dropSettledNestedJournals, Za as orphansAfterRollback, Zi as describeTypeWithThrottleRetry, Zo as stateBucketExistenceConfirmed, Zr as refuseMalformedOrphansForOrphan, Zt as withCreateTokenLedger, _ as PROTECTION_PROPERTY_BY_TYPE, _a as createSecretMasker, _i as repairMalformedResourceEntriesForReadOnly, _o as validateContainerRepoName, _r as UNREADABLE_RESOURCES_MAP_ROW, _s as nullPrototypeRecord, _t as ATOMIC_FINAL_SNAPSHOT_TYPES, a as conditionInputsFrom, aa as liveMatchesUnresolvedTokenFrame, ai as refuseMalformedResourceEntriesForImportSave, ao as createAssetRedirectResolver, ar as isNamelessDynamicReferenceError, as as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, at as replayFailedOperations, b as readProtection, ba as maskSecretsInText, bi as unpreviewableOrphanRecords, bn as deleteSkipReason, bo as resolveDockerContextDirectory, br as hasReadableOrphans, bs as describeFileReadFailure, bt as ccRoutedFinalSnapshotError, c as isSecretBearingReferenceString, ca as carryLogOnlyValues, ci as refuseMalformedResourcePropertiesForExport, cn as CC_BROKEN_REASON, co as AssetModeResolver, cr as cfnRefValueFromPhysicalId, cs as PARTITION_TABLE, ct as destroyStackRecordsView, d as makeCanonicalizePropertiesFn, da as literalSplitDelimitersOf, di as refuseMalformedResourcesForDestroy, dn as wouldReturnToSdkProvider, do as ensureAssetStorage, ds as AssemblyReader, dt as planFailedOps, ei as refuseMalformedResourceAttributesForOrphan, eo as AssetPublisher, er as parameterTypeMayLoseSecretIdentity, es as CFN_TEMPLATE_BODY_LIMIT, fa as logOnlyValueCount, fi as refuseMalformedResourcesForExport, fn as isCustomResourceType$1, fo as getBootstrapMarkerKey, fr as withSharedDrainBudget, fs as StageLoadError, ft as planRollback, g as recordedProtectionNote, ga as shareLogOnlyValues, gi as repairMalformedOutputsForReadOnly, gn as ccProtectionRegistryTypes, go as validateAssetBucketName, gr as UNREADABLE_ORPHANS_CONTAINER_ROW, gs as hasPlainPrototype, gt as inheritProducerRegions, h as recordedProtectionEvidence, ha as recordLogOnlyValue, hi as repairMalformedOrphansForReadOnly, hn as slowCcOperationTimeoutMs, ho as readBootstrapMarkerBody, hr as STATE_RESOURCES_MALFORMED, hs as hasOwnKey, i as conditionFingerprint, ia as TemplateParser, ii as refuseMalformedResourceEntriesForImport, io as buildAssetRedirectMap, ir as carriesFetchableDynamicReference, is as uploadCfnTemplate, it as withNestedStackContext, ja as recordMaskOnlyValue, ji as isStatefulRecreateTargetForReplace, jn as INTRINSIC_KEYS, jo as redactDockerArgvValues, jr as malformedOrphanRecordsRefusalMessage, jt as WITHHELD_NAME_DISPLAY, ka as identityKeyFor, ki as shownType, ko as isMalformedEnvKey, kr as malformedLocalResourceEntriesWarning, kt as DeploymentEventsStore, l as keptWholeReasonText, la as createUnionSecretMasker, li as refuseMalformedResourcePropertiesForOrphan, ln as ProviderRegistry, lo as BOOTSTRAP_MARKER_PREFIX, lr as isStalePlaceholderArnAttribute, ls as canonicalizeRegion, m as withResourceDeadline, ma as recordLogOnlyParameterValue, mi as repairMalformedOrphanRecordsForReadOnly, mn as CloudControlProvider, mo as parseBootstrapMarker, mr as STATE_REGION_DIVERGED, ms as defineOwnKey, mt as findNestedStackTypeChanges, n as IMPLICIT_DELETE_DEPENDENCIES, ni as refuseMalformedResourceEntriesForDeploy, no as stringifyValue, nr as isImpossibleEmptyStoredAttribute, ns as MIGRATE_TMP_PREFIX, nt as withNestedRevertRun, o as parentSuppliedValues, oa as inheritNestedStackParameterAssociations, oi as refuseMalformedResourceEntriesForOrphan, oo as loadPublishableAssetManifest, or as keepsSecretReferenceToken, os as decodeListingKey, ot as replayRollback, pa as printingCorpusOf, pi as refuseMalformedState, po as isCrossRegionRedirect, pr as JSON_LISTING_HOLE_VALUE, ps as processStackMessages, pt as resolveReplacementOldType, q as resourcesNamingDeclaredParameter, qa as hasUnverifiableParameterRefusal, qo as resolveSkipPrefix, qr as refuseMalformedOrphanRecords, qt as RollbackInlinePolicyWriters, r as computeImplicitDeleteEdges, ra as DagBuilder, ri as refuseMalformedResourceEntriesForDestroy, ro as WorkGraph, rr as carriesDynamicReference, rs as findLargeInlineResources, s as readRecordedConditionVerdicts, sa as recordNestedStackParameterExpressions, si as refuseMalformedResourcePropertiesForDrift, so as rewriteTemplateAssetReferences, sr as AWS_NO_VALUE, ss as expectedOwnerParam, t as DeployEngine, ti as refuseMalformedResourceEntries, to as isSensitiveAttributeName, tr as getAccountInfo, ts as CFN_TEMPLATE_URL_LIMIT, tt as revertedNestedRowIds, u as mergeNoChangeOutputs, ua as hasMaskableValues, ui as refuseMalformedResourcesForDeploy, un as ccBrokenReason, uo as assertAssetBucketRegion, ur as refStateLookupFromResource, us as derivePartitionAndUrlSuffix, ut as withStackRecords, v as isProtectionValueActive, va as errorCauseChain, vi as repairMalformedResourcePropertiesForReadOnly, vn as UNSPECIFIED_SKIP_REASON, vo as buildDenyExternalAccessPolicy, vr as deployRefusesOrphanRowsReason, vs as ownValue, vt as PRE_DELETE_SNAPSHOT_TYPES, wo as dockerSpawnEnvWithSensitive, wr as isReadableResourceEntry, wt as refusesFinalSnapshot, xa as markSameGenerationBag, xi as unreadableOrphanRecords, xo as describeDockerCapturedOutput, xr as hasReadableOutputs, xs as displayAssemblyPath, xt as createPreDeleteFinalSnapshot, y as perType, ya as maskSecretsInError, yi as repairMalformedResourcesForReadOnly, yn as deleteIndeterminateGuards, yo as buildDockerImage, yr as displayLogicalId, ys as absoluteAssemblyPathEscape, yt as buildFinalSnapshotIdentifier, z as cyan, za as LockManager, zn as explicitRoleArnOrThrow, zo as getDockerImageBySourceHash, zr as malformedResourceEntriesWarning, zt as noEchoParameterValueSeed } from "./deploy-engine-C5kAhscq.js";
-import { t as getCdkdVersion } from "./version-DGxZ-zFN.js";
+import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
+import { $ as nestedChildStackName, $a as hasReadableExportSet, $o as resolveAutoAssetStorage, $r as refuseMalformedOrphanRecordsForDestroy, Ai as unwrittenCreateOnlyReplacement, Ao as describeDockerExecFailure, Ar as malformedDriftResourcePropertiesWarning, As as renderAssemblyPathEscape, B as gray, Ba as STATE_SOURCED_BASELINE_RULES, Bn as regionLessSecretName, Bo as redactedDockerCause, Br as malformedOrphansWarning, Bt as secretBearingStateKeyWarning, Ca as createSecretMasker, Ci as repairMalformedResourcePropertiesForReadOnly, Cn as UNSPECIFIED_SKIP_REASON, Co as readBootstrapMarkerBody, Cr as deployRefusesOrphanRowsReason, Cs as hasOwnKey, Ct as effectiveDeletionPolicy, Da as markSameGenerationBag, Di as unreadableResourceEntries, Dn as isWaitAbandonedError, Do as buildDockerImage, Dr as hasReadableResources, Ds as absoluteAssemblyPathEscape, Ea as maskSecretsInText, Ei as unreadableOrphanRecords, Eo as buildDenyExternalAccessPolicy, Er as hasReadableOutputs, Es as ownValue, Et as unsupportedFinalSnapshotError, Fa as identityKeyFor, Fi as shownType, Fn as DiffCalculator, Fo as getDockerCmd, Fr as malformedLocalResourcesWarning, Ft as extractDeploymentEventError, G as namesAnyDeclaredParameter, Ga as isSingleDynamicReferenceToken, Gn as isIamRoleArn, Go as stripControlChars, Gr as malformedResourcePropertiesWarning, Gt as collectDeclaredOutputNames, H as red, Ha as STATE_SOURCED_READBACK_RULES, Hn as assertFlagRoleArn, Ho as runDockerStreaming, Hr as malformedOutputsWarning, Ht as exportNameSecretExposure, I as formatResourceLine, Ia as carriesSecretMask, Ii as MULTI_REGION_RECREATE_BLOCKED_TYPES, In as INTRINSIC_KEYS, Io as isDockerClientEnvKey, Ir as malformedOrphanRecordsRefusalMessage, It as WITHHELD_NAME_DISPLAY, J as makeSiblingClaimReader, Ja as S3StateBackend, Jn as applyCallerIdentityCredentials, Jo as Synthesizer, Jr as malformedStateRefusalMessage, Jt as bindingSkippedOutputs, K as reachableDivergentParameters, Ka as LockManager, Kn as sendableAssumeRoleCommand, Ko as AssetManifestLoader, Kr as malformedResourcesWarning, Kt as collectPublishedOutputNames, L as createReadOnlyAttributeHealerFactory, La as recordMaskOnlyValue, Li as isStatefulRecreateTargetForReplace, Ln as IntrinsicFunctionResolver, Lo as isMalformedEnvKey, Lr as malformedOrphanRecordsWarning, Lt as displayTextOrWithheld, Ma as dynamicReferenceTokens, Mi as NO_CC_HANDLERS_REASON, Mo as dockerSpawnEnvWithSensitive, Mr as malformedExportSourceWarning, Mt as updatePartialReason, Na as isUncertifiedBaselineMaskPosition, Ni as hasNoCloudControlHandlers, No as finchSecretArgvRefusal, Nr as malformedLocalOutputsWarning, Ns as resolveBucketRegion, Nt as DeploymentEventsReader, Oa as redactSecretsForState, Oi as findActionableSilentDrops, Oo as resolveDockerContextDirectory, Or as isReadableOrphanRecord, Os as describeFileReadFailure, Pa as pathCrossesDottedKey, Pi as findReplacedReadersOfRecreateTargets, Po as formatDockerLoginError, Pr as malformedLocalResourceEntriesWarning, Pt as DeploymentEventsStore, Qa as exportNamesCarriedFrom, Qo as resolveApp, Qr as refuseMalformedOrphanRecords, Qt as RollbackInlinePolicyWriters, R as bold, Ra as recordMaskOnlyValuesIn, Ri as isStatefulRecreateTargetSync, Rn as classifyReplaySecretRegion, Ro as partitionSensitiveEnv, Rr as malformedOrphanRowsKeptWarning, Rt as exportAliasCollisionScrubWarning, Sa as shareLogOnlyValues, Si as repairMalformedResourceEntriesForReadOnly, So as parseBootstrapMarker, Sr as UNREADABLE_RESOURCES_MAP_ROW, Ss as defineOwnKey, St as createPreDeleteFinalSnapshot, Ta as maskSecretsInError, Ti as unpreviewableOrphanRecords, Tn as deleteSkipReason, To as validateContainerRepoName, Tr as hasReadableOrphans, Ts as nullPrototypeRecord, Tt as refusesFinalSnapshot, U as yellow, Ua as TEMPLATE_SOURCED_RULES, Un as assertSendableRoleArn, Uo as warnFinchArgvExposure, Ur as malformedRenderedContainersWarning, Ut as isWholeDynamicReferenceValue, V as green, Va as STATE_SOURCED_CROSS_GENERATION_RULES, Vn as applyRoleArnIfSet, Vo as runDockerForeground, Vr as malformedOutputsRefusalMessage, Vt as secretSafeKeyDisplay, W as computeParameterTaint, Wa as WHOLE_DYNAMIC_REFERENCE_PATTERN, Wn as explicitRoleArnOrThrow, Wo as escapeRegExp, Wr as malformedResourceEntriesWarning, Wt as noEchoParameterValueSeed, X as NESTED_PENDING_PARENT_REASON, Xa as acceptedCreateOnlyDropsOf, Xn as envCredentialsAreAssumedRole, Xo as getDefaultStateBucketName, Xr as refuseDivergentRecordRegionForDestroy, Xt as DEFAULT_RESOURCE_WARN_AFTER_MS, Y as planOrphanAdoption, Ya as rebuildClientForBucketRegion, Yn as callerEnvCredentials, Yo as synthesisStatusMessage, Yr as previewableOrphanRecords, Yt as DEFAULT_RESOURCE_TIMEOUT_MS, Z as dropSettledNestedJournals, Za as describeRegionValueKind, Zo as getLegacyStateBucketName, Zt as maskingRetryLogger, _ as perType, _a as literalSplitDelimitersOf, _i as refuseMalformedResourcesForExport, _n as isCustomResourceType$1, _o as BOOTSTRAP_MARKER_PREFIX, _r as withSharedDrainBudget, _s as canonicalizeRegion, _t as inheritProducerRegions, a as conditionInputsFrom, ai as refuseMalformedResourceAttributesForOrphan, ao as orphansAfterRollback, ar as parameterTypeMayLoseSecretIdentity, as as stateBucketExistenceConfirmed, at as replayFailedOperations, ba as recordLogOnlyParameterValue, bi as repairMalformedOrphansForReadOnly, bn as slowCcOperationTimeoutMs, bo as getBootstrapMarkerKey, br as STATE_RESOURCES_MALFORMED, bs as StageLoadError, bt as buildFinalSnapshotIdentifier, c as isSecretBearingReferenceString, ci as refuseMalformedResourceEntriesForDestroy, co as AssetPublisher, cr as carriesDynamicReference, cs as CFN_TEMPLATE_BODY_LIMIT, ct as destroyStackRecordsView, d as makeCanonicalizePropertiesFn, da as liveMatchesUnresolvedTokenFrame, di as refuseMalformedResourceEntriesForOrphan, do as WorkGraph, dr as keepsSecretReferenceToken, ds as findLargeInlineResources, dt as recordAfterRollbackUpdate, ei as refuseMalformedOrphans, en as ledgerForStack, eo as hasReasonlessBaselineRefusal, es as resolveCaptureObservedState, f as withResourceDeadline, fa as inheritNestedStackParameterAssociations, fi as refuseMalformedResourcePropertiesForDrift, fo as buildAssetRedirectMap, fr as AWS_NO_VALUE, fs as uploadCfnTemplate, ft as planFailedOps, g as isProtectionValueActive, ga as hasMaskableValues, gi as refuseMalformedResourcesForDestroy, gn as wouldReturnToSdkProvider, go as AssetModeResolver, gs as PARTITION_TABLE, h as PROTECTION_PROPERTY_BY_TYPE, ha as createUnionSecretMasker, hi as refuseMalformedResourcesForDeploy, hn as ccBrokenReason, ho as rewriteTemplateAssetReferences, hr as refStateLookupFromResource, hs as expectedOwnerParam, ht as findNestedStackTypeChanges, i as conditionFingerprint, ia as withRetry, ii as refuseMalformedOutputsForDestroy, io as isReadableBag, ir as isUnboundTemplateParameter, is as resolveUseCdkBootstrapAssets, it as withNestedStackContext, ja as DYNAMIC_REFERENCE_TOKEN_SCAN, jo as describeDockerFailure, jr as malformedExportNamesWarning, js as resolveAssemblyPath, jt as updatePartialMessage, ka as scrubResourceRecord, ko as describeDockerCapturedOutput, kr as isReadableResourceEntry, ks as displayAssemblyPath, l as keptWholeReasonText, la as DagBuilder, li as refuseMalformedResourceEntriesForImport, lo as isSensitiveAttributeName, lr as carriesFetchableDynamicReference, ls as CFN_TEMPLATE_URL_LIMIT, m as recordedProtectionNote, ma as carryLogOnlyValues, mi as refuseMalformedResourcePropertiesForOrphan, mn as ProviderRegistry, mo as loadPublishableAssetManifest, mr as isStalePlaceholderArnAttribute, ms as decodeListingKey, mt as resolveReplacementOldType, n as IMPLICIT_DELETE_DEPENDENCIES, na as templateResourceTypes, ni as refuseMalformedOrphansForOrphan, nn as withCreateTokenLedger, no as importableOutputKeys, ns as resolveStateBucketWithDefault, nt as withNestedRevertRun, o as parentSuppliedValues, oi as refuseMalformedResourceEntries, oo as orphansCarriedFrom, or as getAccountInfo, os as warnDeprecatedNoPrefixCliFlag, ot as replayRollback, p as recordedProtectionEvidence, pa as recordNestedStackParameterExpressions, pi as refuseMalformedResourcePropertiesForExport, pn as CC_BROKEN_REASON, po as createAssetRedirectResolver, pr as cfnRefValueFromPhysicalId, ps as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, pt as planRollback, q as resourcesNamingDeclaredParameter, qa as isLockInfoExpired, qn as AWS_CREDENTIAL_ENV_KEYS, qo as getDockerImageBySourceHash, qr as malformedScrubResourceEntriesRefusalMessage, qt as isExportAliasCollision, r as computeImplicitDeleteEdges, ra as describeTypeWithThrottleRetry, ri as refuseMalformedOutputs, ro as importableOutputs, rr as coerceParameterTypedValue, rs as resolveStateBucketWithDefaultAndSource, s as readRecordedConditionVerdicts, si as refuseMalformedResourceEntriesForDeploy, so as shouldRetainResource, sr as isImpossibleEmptyStoredAttribute, ss as ssmResolvedValueType, t as DeployEngine, ta as prefetchCreateOnlyPropertyPaths, ti as refuseMalformedOrphansForDestroy, to as hasUnverifiableParameterRefusal, ts as resolveSkipPrefix, tt as revertedNestedRowIds, u as mergeNoChangeOutputs, ua as TemplateParser, ui as refuseMalformedResourceEntriesForImportSave, uo as stringifyValue, ur as isNamelessDynamicReferenceError, us as MIGRATE_TMP_PREFIX, ut as withStackRecords, v as readProtection, va as logOnlyValueCount, vi as refuseMalformedState, vo as assertAssetBucketRegion, vr as JSON_LISTING_HOLE_VALUE, vs as derivePartitionAndUrlSuffix, vt as ATOMIC_FINAL_SNAPSHOT_TYPES, wa as errorCauseChain, wi as repairMalformedResourcesForReadOnly, wn as deleteIndeterminateGuards, wo as validateAssetBucketName, wr as displayLogicalId, ws as hasPlainPrototype, wt as isFinalSnapshotError, xa as recordLogOnlyValue, xi as repairMalformedOutputsForReadOnly, xn as ccProtectionRegistryTypes, xo as isCrossRegionRedirect, xr as UNREADABLE_ORPHANS_CONTAINER_ROW, xs as processStackMessages, xt as ccRoutedFinalSnapshotError, ya as printingCorpusOf, yi as repairMalformedOrphanRecordsForReadOnly, yn as CloudControlProvider, yo as ensureAssetStorage, yr as STATE_REGION_DIVERGED, ys as AssemblyReader, yt as PRE_DELETE_SNAPSHOT_TYPES, z as cyan, za as recordNoEchoAttributeValues, zi as renderStatefulReason, zn as producerRegionsFromState, zo as redactDockerArgvValues, zr as malformedOrphansRefusalMessage, zt as secretBearing } from "./deploy-engine-RCOtmm4V.js";
+import { t as getCdkdVersion } from "./version-BNo3JdVW.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
+import { LambdaClient } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { DescribeSecurityGroupRulesCommand } from "@aws-sdk/client-ec2";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { DescribeLogStreamsCommand, ResourceNotFoundException as ResourceNotFoundException$1 } from "@aws-sdk/client-cloudwatch-logs";
+import { DescribeLogStreamsCommand, ResourceNotFoundException as ResourceNotFoundException$2 } from "@aws-sdk/client-cloudwatch-logs";
+import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
 import * as fs from "node:fs";
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -26,7 +28,7 @@ import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
-import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
+import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -1673,7 +1675,7 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 					});
 				}
 			} catch (e) {
-				if (e instanceof ResourceNotFoundException$1) {
+				if (e instanceof ResourceNotFoundException$2) {
 					let regionVerified = true;
 					if (clients.expectedRegionDiverged) {
 						regionVerified = false;
@@ -2501,7 +2503,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DlVxBF89.js");
+	providerClasses ??= import("./provider-classes-R7yvwymx.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4188,6 +4190,26 @@ function deployRefusesPropertiesReason(logicalIds) {
 function nestedStackTypeChangeReason(tc) {
 	return `${displayIdent(tc.logicalId)}: Type changes from ${displayIdent(tc.currentType)} to ${displayIdent(tc.desiredType)}. cdkd does not replace a resource into or out of ${NESTED_STACK_RESOURCE_TYPE} (issue #2668); give the new resource a different logical id, or remove it in one deploy and add its replacement in the next.`;
 }
+function findUnwrittenCreateOnlyRefusals(changes, stateResources) {
+	const reasons = [];
+	for (const [logicalId, change] of changes) {
+		if (change.changeType !== "UPDATE") continue;
+		if (!Object.hasOwn(stateResources, logicalId)) continue;
+		const record = stateResources[logicalId];
+		if (record === void 0 || record.provisionedBy === "cc-api") continue;
+		if (record.resourceType !== change.resourceType) continue;
+		const propertyChanges = change.propertyChanges ?? [];
+		const desired = { ...change.desiredProperties ?? {} };
+		for (const pc of propertyChanges) desired[pc.path] = pc.newValue;
+		const keys = unwrittenCreateOnlyReplacement(change.resourceType, record.properties ?? {}, desired, /* @__PURE__ */ new Set(), acceptedCreateOnlyDropsOf(record), propertyChanges.filter((pc) => pc.requiresReplacement).map((pc) => pc.path));
+		if (keys.length === 0) continue;
+		const routeDriving = findActionableSilentDrops(change.resourceType, desired, /* @__PURE__ */ new Set(), record.properties ?? {}).map(({ property }) => property);
+		const keep = [.../* @__PURE__ */ new Set([...keys, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => displayIdent(`${change.resourceType}:${property}`)).join(",");
+		const one = keys.length === 1;
+		reasons.push(`${displayIdent(logicalId)} (${displayIdent(change.resourceType)}): this previews a replacement that would apply create-only ${keys.map((k) => displayIdent(k)).join(", ")}, which the state record holds although the SDK provider never wrote ${one ? "it" : "them"}, so AWS does not. A deploy without --prefer-sdk-route refuses it (CREATE_ONLY_DROP_NEEDS_REPLACEMENT) unless --recreate-via-cc-api or --replace opts in; a deploy passing --prefer-sdk-route ${keep} changes nothing.`);
+	}
+	return reasons;
+}
 const DEPLOY_REFUSES_OUTPUTS_REASON = "The 'outputs' bag cannot be read. This preview repaired it to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
 const DEPLOY_REFUSES_RESOURCES_BAG_REASON = "The 'resources' map cannot be read. This preview read it as empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
 function deployRefusesResourceEntriesReason(logicalIds) {
@@ -4616,6 +4638,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		stateResources: stateForDiff.resources
 	});
 	if (nestedStackTypeChanges.length > 0) blocking = [...blocking, ...nestedStackTypeChanges.map(nestedStackTypeChangeReason)];
+	for (const reason of findUnwrittenCreateOnlyRefusals(changes, stateForDiff.resources)) logger.warn(printing.mask(reason));
 	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
 	const bindingSkipped = bindingSkippedOutputs(outputsDigestSource, currentState.skippedOutputs, changedLogicalIds);
 	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs, bindingSkipped, {
@@ -5161,7 +5184,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement && (propChange.inPlacePropagated === true || propChange.replacementPropagated === true) ? " [may require replacement]" : propChange.requiresReplacement ? " [requires replacement]" : "";
-				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.inPlacePropagated ? " [attribute propagated]" : "";
+				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [template expression changed]" : "";
 				const indent = "              ";
 				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
 				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
@@ -7970,7 +7993,7 @@ function canonicalizeIpProtocols(baseline, aws, resourceType) {
 //#region src/analyzer/drift-cc-api-deny-list.ts
 const CC_API_FALLBACK_DENY_LIST = {
 	"AWS::ApiGateway::RestApi": "Body / BodyS3Location are write-only inputs not returned by CC API GetResource; cdkd state preserves them",
-	"AWS::CloudFormation::Stack": "CC API returns runtime stack state (outputs/status), not the template parameters cdkd state stores",
+	"AWS::CloudFormation::Stack": "cdkd deploys nested stacks itself: no CloudFormation stack exists, and the physicalId is a cdkd-local placeholder ARN",
 	"AWS::EC2::LaunchTemplate": "CC API returns version-bumped LaunchTemplateData with synthetic LatestVersionNumber that diverges from the CFn input shape"
 };
 
@@ -8900,7 +8923,13 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 			attributes: res.attributes ?? {}
 		};
 	}
-	return { siblings };
+	const own = (state.resources ?? {})[excludedLogicalId];
+	const ownAttributesValue = isReadableResourceEntry(own) ? own.attributes : void 0;
+	const ownAttributes = typeof ownAttributesValue === "object" && ownAttributesValue !== null && !Array.isArray(ownAttributesValue) ? ownAttributesValue : void 0;
+	return {
+		siblings,
+		...ownAttributes && { attributes: ownAttributes }
+	};
 }
 function canonicalizeDerivedPatternBName(resourceType, baseline, aws) {
 	if (!hasOwnKey(PATTERN_B_NAME_PROPERTIES, resourceType)) return baseline;
@@ -9410,6 +9439,20 @@ function deepEqualUnordered(a, b) {
 	if (ak.length !== Object.keys(bo).length) return false;
 	return ak.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepEqualUnordered(ao[k], bo[k]));
 }
+function keepRecordedAttributesOverMask(redacted, plaintext, recorded, noEchoDeclared) {
+	if (recorded === void 0 || noEchoDeclared === true) return redacted;
+	const out = { ...redacted };
+	for (const key of Object.keys(redacted)) {
+		if (noEchoDeclared?.has(key)) continue;
+		if (!hasOwnKey(recorded, key) || !carriesSecretMask(redacted[key])) continue;
+		if (carriesSecretMask(recorded[key])) continue;
+		if (sameRecordedJson(plaintext[key], recorded[key])) defineOwnKey(out, key, recorded[key]);
+	}
+	return out;
+}
+function sameRecordedJson(candidate, recorded) {
+	return deepEqualUnordered(candidate === void 0 ? void 0 : JSON.parse(JSON.stringify(candidate)), recorded);
+}
 async function runRevert(reports, regionScope, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
 	const out = humanTextSink(options.json);
@@ -9455,6 +9498,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 				recovery: lockRecovery
 			}));
 			const narrowedByLogicalId = /* @__PURE__ */ new Map();
+			const reRecordedByLogicalId = /* @__PURE__ */ new Map();
 			try {
 				const revertSecretResolvers = new DriftSecretResolvers(report.region);
 				const revertProducerRegions = report.producerRegions;
@@ -9551,6 +9595,19 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						} catch (captureErr) {
 							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
 						}
+						try {
+							if (updateResult !== void 0) {
+								const noEchoDeclared = recordNoEchoAttributeValues(updateResult, secrets, newProperties);
+								const next = recordAfterRollbackUpdate(stateResource, updateResult);
+								const attributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactSecretsForState(next.attributes, secrets), next.attributes, stateResource.attributes, noEchoDeclared);
+								if (next.physicalId !== stateResource.physicalId || !sameRecordedJson(attributes, stateResource.attributes)) reRecordedByLogicalId.set(outcome.logicalId, {
+									physicalId: next.physicalId,
+									attributes
+								});
+							}
+						} catch (recordErr) {
+							logger.warn(safeMsg`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the attributes the provider returned could not be recorded — ${maskSecretsInText(recordErr instanceof Error ? recordErr.message : String(recordErr), secrets)}`);
+						}
 					} catch (err) {
 						if (err instanceof ResourceUpdateNotSupportedError) {
 							totalUnsupported++;
@@ -9562,7 +9619,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 					}
 				}), concurrency);
-				if (narrowedByLogicalId.size > 0) {
+				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0) {
 					const resources = { ...report.state.resources };
 					let recordedCount = 0;
 					for (const [logicalId, delta] of narrowedByLogicalId) {
@@ -9593,7 +9650,23 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							properties: newBaseline
 						};
 					}
-					if (recordedCount === 0) return;
+					let reRecordedCount = 0;
+					for (const [logicalId, identity] of reRecordedByLogicalId) {
+						const existing = resources[logicalId];
+						if (!existing) continue;
+						reRecordedCount++;
+						const { attributes: _replaced, ...rest } = existing;
+						resources[logicalId] = {
+							...rest,
+							physicalId: identity.physicalId,
+							...identity.attributes !== void 0 && { attributes: identity.attributes }
+						};
+					}
+					if (recordedCount === 0 && reRecordedCount === 0) return;
+					const recordedParts = [];
+					if (recordedCount > 0) recordedParts.push(`the value the provider actually applied on ${recordedCount} resource(s)`);
+					if (reRecordedCount > 0) recordedParts.push(`the identity the revert returned on ${reRecordedCount} resource(s)`);
+					const recordedWhat = recordedParts.join(" and ");
 					const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 					const newState = {
 						...carriedState,
@@ -9604,10 +9677,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					if (report.migrationPending) saveOptions.migrateLegacy = true;
 					try {
 						await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
-						logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
+						logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded ${recordedWhat}.`);
 					} catch (err) {
 						const revertAgain = revertCommandLine(report.stackName, report.region);
-						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`));
+						const unrecorded = [...recordedCount > 0 ? ["the value the provider actually applied"] : [], ...reRecordedCount > 0 ? ["the identity the revert returned"] : []].join(" and ");
+						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record ${unrecorded}: ${err instanceof Error ? err.message : String(err)}.` + (reRecordedCount > 0 ? " The state record still holds the physical id and attributes from before the revert, which a later 'Fn::GetAtt' and 'cdkd export' read. Re-running the revert does not repair it, since the revert landed; a later deploy that updates this resource records the identity its update returns." : "") + (recordedCount > 0 ? ` The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`) : ""));
 					}
 				}
 			} finally {
@@ -19134,7 +19208,163 @@ const fromStateFactory = (options) => {
 };
 const cdkdExtraStateProviders = { fromState: fromStateFactory };
 function createLocalStateProvider$1(options, cdkdStackName, synthRegion) {
-	return createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
+	const provider = createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
+	if (provider instanceof CfnLocalStateProvider) bindCallerIdentityClients(provider, options.profile);
+	else if (isCfnFlagPresent(options) && cannotLeaveUnbound(options.profile)) throw new Error(cfnProviderRefusal(["a --from-cfn-stack provider that is not CfnLocalStateProvider"]));
+	return provider;
+}
+function cannotLeaveUnbound(profile) {
+	if (getAssumedRoleCredentials() === void 0) return false;
+	return !(profile || process.env["AWS_PROFILE"]);
+}
+function cfnProviderRefusal(drift) {
+	return `--from-cfn-stack cannot run under --role-arn with this cdk-local version: it has ${drift.join(", ")}, so cdkd cannot make it read the stack with your own credentials instead of the role's. Pass --profile <name> (your own profile), or use the cdk-local version this cdkd release ships with (go-to-k/cdkd#3240).`;
+}
+const CFN_PROVIDER_CLIENT_GETTERS = [
+	"getClient",
+	"getLambdaClient",
+	"getSsmClient",
+	"getAgentCoreControlClient"
+];
+const CFN_PROVIDER_CLIENT_SLOTS = [
+	"client",
+	"lambdaClient",
+	"ssmClient",
+	"agentCoreControlClient"
+];
+const CFN_PROVIDER_PROTOTYPE_MEMBERS = [
+	"constructor",
+	...CFN_PROVIDER_CLIENT_GETTERS,
+	"resolveTemplateSsmParameters",
+	"resolveDeployedFunctionEnv",
+	"resolveLambdaExecutionRoleArn",
+	"resolveAgentCoreRuntimeRoleArn",
+	"load",
+	"getLastLoadError",
+	"buildCrossStackResolver",
+	"dispose"
+];
+function cfnProviderShapeDrift(provider) {
+	const proto = Object.getPrototypeOf(provider);
+	const allowed = CFN_PROVIDER_PROTOTYPE_MEMBERS;
+	const slots = CFN_PROVIDER_CLIENT_SLOTS;
+	const drift = [];
+	for (const name of CFN_PROVIDER_CLIENT_GETTERS) if (typeof proto?.[name] !== "function") drift.push(`no ${name}()`);
+	for (let p = proto; p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) for (const name of Object.getOwnPropertyNames(p)) if (!allowed.includes(name)) drift.push(`an unknown ${name}()`);
+	for (const slot of CFN_PROVIDER_CLIENT_SLOTS) if (!Object.hasOwn(provider, slot)) drift.push(`no ${slot} slot`);
+	if (typeof provider.region !== "string" || !Object.hasOwn(provider, "region")) drift.push("no region field");
+	for (const name of Object.getOwnPropertyNames(provider)) if (/Client$/.test(name) && !slots.includes(name)) drift.push(`an unknown ${name} slot`);
+	return drift;
+}
+function bindCallerIdentityClients(provider, profile) {
+	const drift = cfnProviderShapeDrift(provider);
+	if (drift.length > 0) {
+		if (!cannotLeaveUnbound(profile)) return;
+		throw new Error(cfnProviderRefusal(drift));
+	}
+	const slots = provider;
+	const live = () => {
+		if (slots.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
+	};
+	const config = () => ({
+		region: slots.region,
+		...profile && { profile }
+	});
+	slots.getClient = () => {
+		live();
+		return slots.client ??= new CloudFormationClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...config()
+		});
+	};
+	slots.getLambdaClient = () => {
+		live();
+		return slots.lambdaClient ??= new LambdaClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...config()
+		});
+	};
+	slots.getSsmClient = () => {
+		live();
+		return slots.ssmClient ??= new SSMClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...config()
+		});
+	};
+	slots.getAgentCoreControlClient = () => {
+		live();
+		return slots.agentCoreControlClient ??= new BedrockAgentCoreControlClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...config()
+		});
+	};
+}
+function engineCredentialTripleChannel(containers) {
+	return {
+		what: `the role's AWS credentials are copied into ${containers}, so that code runs as the role`,
+		flagOnly: true
+	};
+}
+const ENGINE_ECS_SECRETS_CHANNEL = {
+	what: "ECS task secrets are fetched with the role and injected as plaintext into the container's environment",
+	flagOnly: false
+};
+const ENGINE_ASSUME_ROLE_CHANNEL = {
+	what: "the role --assume-role / --assume-task-role assumes for the container is assumed BY the --role-arn role, so the container can receive a role you could not assume yourself",
+	flagOnly: false
+};
+function engineFromCfnStackChannel(alsoReads) {
+	return {
+		what: "--from-cfn-stack reads the deployed stack, including SecureString parameters decrypted into the container's environment" + (alsoReads ? `, and ${alsoReads}` : ""),
+		flagOnly: false
+	};
+}
+const ENGINE_ACCOUNT_ID_CHANNEL = {
+	what: "${AWS::AccountId} resolves to the role's account in the container's environment, secret references and image URIs",
+	flagOnly: false
+};
+function warnEngineRoleExposure(cmd, commandName, channels, fromCfnStackChannel = engineFromCfnStackChannel()) {
+	cmd.hook("preAction", (_thisCommand, actionCommand) => {
+		const options = actionCommand.optsWithGlobals();
+		const message = engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, {
+			roleArn: options.roleArn || process.env["CDKD_ROLE_ARN"],
+			profileFlag: options.profile,
+			envProfile: process.env["AWS_PROFILE"],
+			fromCfnStack: isCfnFlagPresent(options),
+			assumesForWorkload: isAssumeRequested(options.assumeRole) || isAssumeRequested(options.assumeTaskRole)
+		});
+		if (message !== void 0) getLogger().warn(message);
+	});
+	return cmd;
+}
+function isAssumeRequested(value) {
+	if (typeof value === "string") return value !== "";
+	if (value !== null && typeof value === "object") return Object.keys(value).length > 0;
+	return value === true;
+}
+function engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, input) {
+	if (!input.roleArn || !isIamRoleArn(input.roleArn) || input.profileFlag) return void 0;
+	const all = [
+		...channels,
+		...input.assumesForWorkload ? [ENGINE_ASSUME_ROLE_CHANNEL] : [],
+		...input.fromCfnStack ? [fromCfnStackChannel] : []
+	];
+	const envProfileSet = !!input.envProfile;
+	const open = envProfileSet ? all.filter((c) => c.flagOnly) : all;
+	if (open.length === 0) return void 0;
+	return `cdkd local ${commandName}: --role-arn ${envProfileSet ? "is set, and the exported AWS_PROFILE does not cover what follows (only the --profile flag does)" : "is set and no profile is selected"}, so the local emulation engine resolves these AS THE ROLE and hands them to your local code: ${open.map((c) => c.what).join("; ")}. Pass --profile <name> with your own profile to keep them on your identity, or do not pass a role whose permissions you would not give the code in the container. Tracked as go-to-k/cdkd#3240 (upstream go-to-k/cdk-local#783).`;
 }
 
 //#endregion
@@ -21599,7 +21829,7 @@ async function localStartApiCommand(target, options) {
 			const direct = buildCorsConfigByApiId(stack.template);
 			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
 		}
-		const stateByStack = options.fromState || isCfnFlagPresent(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
+		const stateByStack = options.fromState || isCfnFlagPresent$1(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials, {
 			onDirCreated: (hostPath) => {
@@ -23913,6 +24143,7 @@ function createLocalStartServiceCommand() {
 		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
+	warnEngineRoleExposure(cmd, "start-service", [ENGINE_ECS_SECRETS_CHANNEL, ENGINE_ACCOUNT_ID_CHANNEL]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
@@ -25094,6 +25325,7 @@ function createLocalStartAgentCoreCommand$1() {
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
+	warnEngineRoleExposure(cmd, "start-agentcore", [engineCredentialTripleChannel("the agent container"), ENGINE_ACCOUNT_ID_CHANNEL]);
 	return adoptDeprecatedRegionFlag(cmd);
 }
 
@@ -25136,6 +25368,11 @@ function createLocalStartAlbCommand() {
 		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders);
 	}));
 	addAlbSpecificOptions(cmd);
+	warnEngineRoleExposure(cmd, "start-alb", [
+		engineCredentialTripleChannel("the ALB's Lambda target-group containers"),
+		ENGINE_ECS_SECRETS_CHANNEL,
+		ENGINE_ACCOUNT_ID_CHANNEL
+	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
@@ -25151,6 +25388,7 @@ function createLocalStartCloudFrontCommand$1() {
 	cmd.addOption(new Option("--state-prefix <prefix>", "[not supported on start-cloudfront] S3 key prefix for --from-state state files. Refused at startup with --from-state.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
 	refuseUnwiredCdkdStateFlags(cmd);
+	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers")], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
 	return adoptDeprecatedRegionFlag(cmd);
 }
 function refuseUnwiredCdkdStateFlags(cmd) {
@@ -25855,4 +26093,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, isAbsoluteAssetPath as c, resolveSecretDerivedPrincipals as i, listNestedTemplateRows as l, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, findNestedTemplateTreeDefect as s, canonicalizeIpv4Cidr as t, renderNestedTemplateTreeDefect as u };
-//# sourceMappingURL=program-CVOLJJ2z.js.map
+//# sourceMappingURL=program-Eed63bId.js.map