@go-to-k/cdkd 0.296.1 → 0.296.3

package/dist/{program-DXRavuSm.js → program-DFehMfoh.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-Dvc7ddKe.js";
 import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as dynamicReferenceTokens, $o as resolveDockerContextDirectory, $r as malformedExportSourceWarning, $s as absoluteAssemblyPathEscape, $t as displayTextOrWithheld, Aa as DagBuilder, Ai as refuseMalformedResourceEntriesForImport, Ao as orphansAfterRollback, Ar as keepsSecretReferenceToken, As as resolveUseCdkBootstrapAssets, At as resolveReplacementOldType, Ba as printingCorpusOf, Bi as refuseMalformedState, Bn as ccProtectionRegistryTypes, Bo as rewriteTemplateAssetReferences, Br as STATE_REGION_DIVERGED, Bs as decodeListingKey, Bt as isFinalSnapshotError, C as perType, Ca as prefetchCreateOnlyPropertyPaths, Ci as refuseMalformedOrphansForOrphan, Co as exportNamesCarriedFrom, Cr as isUnboundTemplateParameter, Cs as loadCdkJson, Di as refuseMalformedResourceEntries, Do as importableOutputKeys, Dr as carriesDynamicReference, Ds as resolveSkipPrefix, Dt as isJournaledOrphan, Ea as withRetry, Ei as refuseMalformedResourceAttributesForOrphan, Eo as hasUnverifiableParameterRefusal, Er as isImpossibleEmptyStoredAttribute, Es as resolveCaptureObservedState, Et as demoteSupersededOrphans, Fa as carryLogOnlyValues, Fi as refuseMalformedResourcePropertiesForExport, Fn as wouldReturnToSdkProvider, Fo as stringifyValue, Fs as CFN_TEMPLATE_URL_LIMIT, Ft as PRE_DELETE_SNAPSHOT_TYPES, G as cyan, Ga as errorCauseChain, Gi as repairMalformedResourcePropertiesForReadOnly, Go as getBootstrapMarkerKey, Gr as displayLogicalId, Gs as AssemblyReader, H as formatResourceLine, Ha as recordLogOnlyValue, Hi as repairMalformedOrphansForReadOnly, Hn as UNSPECIFIED_SKIP_REASON, Ho as BOOTSTRAP_MARKER_PREFIX, Hr as UNREADABLE_ORPHANS_CONTAINER_ROW, Hs as PARTITION_TABLE, Ht as unsupportedFinalSnapshotError, Ia as createUnionSecretMasker, Ii as refuseMalformedResourcePropertiesForOrphan, In as isCustomResourceType$1, Io as WorkGraph, Ir as withSharedDrainBudget, Is as MIGRATE_TMP_PREFIX, It as buildFinalSnapshotIdentifier, J as red, Ja as markSameGenerationBag, Ji as unreadableOrphanRecords, Jo as readBootstrapMarkerBody, Jr as hasReadableResources, Js as defineOwnKey, Jt as updatePartialReason, K as gray, Ka as maskSecretsInError, Ki as repairMalformedResourcesForReadOnly, Kn as isWaitAbandonedError, Ko as isCrossRegionRedirect, Kr as hasReadableOrphans, Ks as StageLoadError, La as hasMaskableValues, Li as refuseMalformedResourcesForDeploy, Lo as buildAssetRedirectMap, Lr as parameterInputsFor, Ls as findLargeInlineResources, Lt as ccRoutedFinalSnapshotError, Ma as liveMatchesUnresolvedTokenFrame, Mi as refuseMalformedResourceEntriesForOrphan, Mn as CC_BROKEN_REASON, Mo as shouldRetainResource, Mr as cfnRefValueFromPhysicalId, Ms as warnDeprecatedNoPrefixCliFlag, Na as inheritNestedStackParameterAssociations, Ni as refuseMalformedResourcePropertiesForDestroy, Nn as ProviderRegistry, No as AssetPublisher, Nr as isStalePlaceholderArnAttribute, Ns as ssmResolvedValueType, Nt as inheritProducerRegions, Oi as refuseMalformedResourceEntriesForDeploy, Oo as importableOutputs, Or as carriesFetchableDynamicReference, Os as resolveStateBucketWithDefault, Ot as planFailedOps, Pa as recordNestedStackParameterExpressions, Pi as refuseMalformedResourcePropertiesForDrift, Pn as ccBrokenReason, Po as isSensitiveAttributeName, Pr as refStateLookupFromResource, Ps as CFN_TEMPLATE_BODY_LIMIT, Pt as ATOMIC_FINAL_SNAPSHOT_TYPES, Q as reachableDivergentParameters, Qa as DYNAMIC_REFERENCE_TOKEN_SCAN, Qi as unwrittenCreateOnlyReplacement, Qo as buildDockerImage, Qr as malformedExportNamesWarning, Qs as ownValue, Qt as WITHHELD_NAME_DISPLAY, Ra as literalSplitDelimitersOf, Ri as refuseMalformedResourcesForDestroy, Rn as CloudControlProvider, Ro as createAssetRedirectResolver, Rs as uploadCfnTemplate, Rt as createPreDeleteFinalSnapshot, S as isProtectionValueActive, Si as refuseMalformedOrphansForDestroy, So as describeRegionValueKind, Sr as coerceParameterTypedValue, Ss as getLegacyStateBucketName, St as destroyStackRecordsView, Ta as describeTypeWithThrottleRetry, Ti as refuseMalformedOutputsForDestroy, To as hasReasonlessBaselineRefusal, Tr as getAccountInfo, Ts as resolveAutoAssetStorage, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as shareLogOnlyValues, Ui as repairMalformedOutputsForReadOnly, Un as deleteIndeterminateGuards, Uo as assertAssetBucketRegion, Ur as UNREADABLE_RESOURCES_MAP_ROW, Us as canonicalizeRegion, Va as recordLogOnlyParameterValue, Vi as repairMalformedOrphanRecordsForReadOnly, Vo as AssetModeResolver, Vr as STATE_RESOURCES_MALFORMED, Vs as expectedOwnerParam, Vt as refusesFinalSnapshot, W as bold, Wa as createSecretMasker, Wi as repairMalformedResourceEntriesForReadOnly, Wn as deleteSkipReason, Wo as ensureAssetStorage, Wr as deployRefusesOrphanRowsReason, Ws as derivePartitionAndUrlSuffix, X as computeParameterTaint, Xa as scrubResourceRecord, Xi as findActionableSilentDrops, Xo as validateContainerRepoName, Xr as isReadableResourceEntry, Xs as hasPlainPrototype, Xt as DeploymentEventsStore, Y as yellow, Ya as redactSecretsForState, Yi as unreadableResourceEntries, Yo as validateAssetBucketName, Yr as isReadableOrphanRecord, Ys as hasOwnKey, Yt as DeploymentEventsReader, Z as namesAnyDeclaredParameter, Zo as buildDenyExternalAccessPolicy, Zr as malformedDriftResourcePropertiesWarning, Zs as nullPrototypeRecord, Zt as extractDeploymentEventError, _ as makeCanonicalizePropertiesFn, _i as refuseDivergentRecordRegionForDestroy, _n as RollbackInlinePolicyWriters, _o as isLockInfoExpired, _s as AssetManifestLoader, a as findNestedTemplateTreeDefect, aa as isStatefulRecreateTargetForReplace, ac as resolveBucketRegion, ai as malformedOrphanRowsKeptWarning, an as isWholeDynamicReferenceValue, ao as recordMaskOnlyValue, ar as regionLessSecretName, as as formatDockerLoginError, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as refuseMalformedOrphanRecordsForDestroy, bo as splitImportedOps, bs as synthesisStatusMessage, bt as replayRollback, c as renderNestedTemplateTreeDefect, ci as malformedOutputsRefusalMessage, cn as collectPublishedOutputNames, co as recordProvenPublicExpression, cr as assertSendableRoleArn, cs as isMalformedEnvKey, ct as displacedOpClause, d as conditionInputsFrom, di as malformedResourceEntriesWarning, dn as DEFAULT_RESOURCE_TIMEOUT_MS, do as STATE_SOURCED_CROSS_GENERATION_RULES, dr as sendableAssumeRoleCommand, ds as redactedDockerCause, ea as NO_CC_HANDLERS_REASON, ec as describeFileReadFailure, ei as malformedLocalOutputsWarning, en as exportAliasCollisionScrubWarning, eo as isUncertifiedBaselineMaskPosition, er as DiffCalculator, es as describeDockerCapturedOutput, et as deleteJournaledOrphans, f as parentSuppliedValues, fi as malformedResourcePropertiesWarning, fn as DEFAULT_RESOURCE_WARN_AFTER_MS, fo as STATE_SOURCED_READBACK_RULES, fr as AWS_CREDENTIAL_ENV_KEYS, fs as runDockerForeground, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, gi as previewableOrphanRecords, gn as formatDestructiveChange, go as LockManager, gs as stripControlChars, gt as withNestedRevertRun, h as keptWholeReasonText, hi as malformedStateRefusalMessage, hn as findDestructiveChanges, ho as isSingleDynamicReferenceToken, hr as envCredentialsAreAssumedRole, hs as escapeRegExp, ht as revertedNestedRowIds, i as childTemplateLoader, ia as MULTI_REGION_RECREATE_BLOCKED_TYPES, ii as malformedOrphanRecordsWarning, in as exportNameSecretExposure, io as provenPublicValue, ir as producerRegionsFromState, is as finchSecretArgvRefusal, it as sameJournaledOrphans, ja as TemplateParser, ji as refuseMalformedResourceEntriesForImportSave, jo as orphansCarriedFrom, jr as AWS_NO_VALUE, js as stateBucketExistenceConfirmed, jt as findNestedStackTypeChanges, ki as refuseMalformedResourceEntriesForDestroy, ko as isReadableBag, kr as isNamelessDynamicReferenceError, ks as resolveStateBucketWithDefaultAndSource, kt as planRollback, l as templateIdentity, li as malformedOutputsWarning, ln as isExportAliasCollision, lo as wholeStringLeavesOf, lr as explicitRoleArnOrThrow, ls as partitionSensitiveEnv, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, mi as malformedScrubResourceEntriesRefusalMessage, mn as constructPathOf, mo as WHOLE_DYNAMIC_REFERENCE_PATTERN, mr as callerEnvCredentials, ms as warnFinchArgvExposure, n as IMPLICIT_DELETE_DEPENDENCIES, na as findReplacedReadersOfRecreateTargets, nc as renderAssemblyPathEscape, ni as malformedLocalResourcesWarning, nn as secretBearingStateKeyWarning, no as identityKeyFor, nr as IntrinsicFunctionResolver, ns as describeDockerFailure, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as isStatefulRecreateTargetSync, oi as malformedOrphansRefusalMessage, on as noEchoParameterValueSeed, oo as recordMaskOnlyValuesIn, or as applyRoleArnIfSet, os as getDockerCmd, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pi as malformedResourcesWarning, pn as maskingRetryLogger, po as TEMPLATE_SOURCED_RULES, pr as applyCallerIdentityCredentials, ps as runDockerStreaming, pt as recordDisplacedSkips, q as green, qa as maskSecretsInText, qi as unpreviewableOrphanRecords, qo as parseBootstrapMarker, qr as hasReadableOutputs, qs as processStackMessages, qt as updatePartialMessage, r as computeImplicitDeleteEdges, ra as shownType, rc as resolveAssemblyPath, ri as malformedOrphanRecordsRefusalMessage, rn as secretSafeKeyDisplay, ro as carriesSecretMask, rr as classifyReplaySecretRegion, rs as dockerSpawnEnvWithSensitive, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as renderStatefulReason, si as malformedOrphansWarning, sn as collectDeclaredOutputNames, so as recordNoEchoAttributeValues, sr as assertFlagRoleArn, ss as isDockerClientEnvKey, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as hasNoCloudControlHandlers, tc as displayAssemblyPath, ti as malformedLocalResourceEntriesWarning, tn as secretBearing, to as pathCrossesDottedKey, tr as INTRINSIC_KEYS, ts as describeDockerExecFailure, tt as isHandledOrphan, u as conditionFingerprint, ui as malformedRenderedContainersWarning, un as bindingSkippedOutputs, uo as STATE_SOURCED_BASELINE_RULES, ur as isIamRoleArn, us as redactDockerArgvValues, ut as dropSettledNestedJournals, v as withResourceDeadline, vo as S3StateBackend, vs as getDockerImageBySourceHash, vt as withNestedStackContext, w as readProtection, wa as templateResourceTypes, wi as refuseMalformedOutputs, wo as hasReadableExportSet, wr as parameterTypeMayLoseSecretIdentity, ws as resolveApp, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as refuseMalformedOrphans, xn as withCreateTokenLedger, xo as acceptedCreateOnlyDropsOf, xs as getDefaultStateBucketName, y as recordedProtectionEvidence, yi as refuseMalformedOrphanRecords, yn as ledgerForStack, yo as rebuildClientForBucketRegion, ys as Synthesizer, yt as replayFailedOperations, za as logOnlyValueCount, zi as refuseMalformedResourcesForExport, zn as slowCcOperationTimeoutMs, zo as loadPublishableAssetManifest, zr as JSON_LISTING_HOLE_VALUE, zs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as effectiveDeletionPolicy } from "./deploy-engine-xlct0Hcm.js";
-import { t as getCdkdVersion } from "./version-Dpc_HYX0.js";
+import { $ as resourcesNamingDeclaredParameter, $o as buildDenyExternalAccessPolicy, $r as malformedDriftResourcePropertiesWarning, $s as nullPrototypeRecord, $t as extractDeploymentEventError, Ai as refuseMalformedResourceEntriesForDeploy, Ao as importableOutputs, Ar as carriesFetchableDynamicReference, As as resolveStateBucketWithDefault, At as planRollback, Ba as literalSplitDelimitersOf, Bi as refuseMalformedResourcesForDestroy, Bn as CloudControlProvider, Bo as createAssetRedirectResolver, Bs as uploadCfnTemplate, Bt as createPreDeleteFinalSnapshot, C as perType, Ci as refuseMalformedOrphans, Cn as withCreateTokenLedger, Co as acceptedCreateOnlyDropsOf, Cs as getDefaultStateBucketName, Da as describeTypeWithThrottleRetry, Di as refuseMalformedOutputsForDestroy, Do as hasReasonlessBaselineRefusal, Dr as getAccountInfo, Ds as resolveAutoAssetStorage, Dt as isJournaledOrphan, Ea as templateResourceTypes, Ei as refuseMalformedOutputs, Eo as hasReadableExportSet, Er as parameterTypeMayLoseSecretIdentity, Es as resolveApp, Et as demoteSupersededOrphans, Fa as inheritNestedStackParameterAssociations, Fi as refuseMalformedResourcePropertiesForDestroy, Fn as ProviderRegistry, Fo as AssetPublisher, Fr as isStalePlaceholderArnAttribute, Fs as ssmResolvedValueType, Ft as inheritProducerRegions, G as cyan, Ga as shareLogOnlyValues, Gi as repairMalformedOutputsForReadOnly, Gn as deleteIndeterminateGuards, Go as assertAssetBucketRegion, Gr as UNREADABLE_RESOURCES_MAP_ROW, Gs as canonicalizeRegion, H as formatResourceLine, Ha as printingCorpusOf, Hi as refuseMalformedState, Hn as ccProtectionRegistryTypes, Ho as rewriteTemplateAssetReferences, Hr as STATE_REGION_DIVERGED, Hs as decodeListingKey, Ht as isFinalSnapshotError, Ia as recordNestedStackParameterExpressions, Ii as refuseMalformedResourcePropertiesForDrift, In as ccBrokenReason, Io as isSensitiveAttributeName, Ir as refStateLookupFromResource, Is as CFN_TEMPLATE_BODY_LIMIT, It as ATOMIC_FINAL_SNAPSHOT_TYPES, J as red, Ja as maskSecretsInError, Ji as repairMalformedResourcesForReadOnly, Jn as isWaitAbandonedError, Jo as isCrossRegionRedirect, Jr as hasReadableOrphans, Js as StageLoadError, K as gray, Ka as createSecretMasker, Ki as repairMalformedResourceEntriesForReadOnly, Kn as deleteSkipReason, Ko as ensureAssetStorage, Kr as deployRefusesOrphanRowsReason, Ks as derivePartitionAndUrlSuffix, La as carryLogOnlyValues, Li as refuseMalformedResourcePropertiesForExport, Ln as wouldReturnToSdkProvider, Lo as stringifyValue, Ls as CFN_TEMPLATE_URL_LIMIT, Lt as PRE_DELETE_SNAPSHOT_TYPES, Ma as DagBuilder, Mi as refuseMalformedResourceEntriesForImport, Mo as orphansAfterRollback, Mr as keepsSecretReferenceToken, Ms as resolveUseCdkBootstrapAssets, Mt as resolveReplacementOldType, Na as TemplateParser, Ni as refuseMalformedResourceEntriesForImportSave, No as orphansCarriedFrom, Nr as AWS_NO_VALUE, Ns as stateBucketExistenceConfirmed, Nt as findNestedStackTypeChanges, Oa as withRetry, Oi as refuseMalformedResourceAttributesForOrphan, Oo as hasUnverifiableParameterRefusal, Or as isImpossibleEmptyStoredAttribute, Os as resolveCaptureObservedState, Ot as isReplacementOrphan, Pa as liveMatchesUnresolvedTokenFrame, Pi as refuseMalformedResourceEntriesForOrphan, Pn as CC_BROKEN_REASON, Po as shouldRetainResource, Pr as cfnRefValueFromPhysicalId, Ps as warnDeprecatedNoPrefixCliFlag, Q as reachableDivergentParameters, Qa as scrubResourceRecord, Qi as findActionableSilentDrops, Qo as validateContainerRepoName, Qr as isReadableResourceEntry, Qs as hasPlainPrototype, Qt as DeploymentEventsStore, Ra as createUnionSecretMasker, Ri as refuseMalformedResourcePropertiesForOrphan, Rn as isCustomResourceType$1, Ro as WorkGraph, Rr as withSharedDrainBudget, Rs as MIGRATE_TMP_PREFIX, Rt as buildFinalSnapshotIdentifier, S as isProtectionValueActive, Si as refuseMalformedOrphanRecordsForDestroy, So as splitImportedOps, Ss as synthesisStatusMessage, St as destroyStackRecordsView, Ta as prefetchCreateOnlyPropertyPaths, Ti as refuseMalformedOrphansForOrphan, To as exportNamesCarriedFrom, Tr as isUnboundTemplateParameter, Ts as loadCdkJson, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as recordLogOnlyParameterValue, Ui as repairMalformedOrphanRecordsForReadOnly, Uo as AssetModeResolver, Ur as STATE_RESOURCES_MALFORMED, Us as expectedOwnerParam, Ut as refusesFinalSnapshot, Va as logOnlyValueCount, Vi as refuseMalformedResourcesForExport, Vn as slowCcOperationTimeoutMs, Vo as loadPublishableAssetManifest, Vr as JSON_LISTING_HOLE_VALUE, Vs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as effectiveDeletionPolicy, W as bold, Wa as recordLogOnlyValue, Wi as repairMalformedOrphansForReadOnly, Wn as UNSPECIFIED_SKIP_REASON, Wo as BOOTSTRAP_MARKER_PREFIX, Wr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ws as PARTITION_TABLE, Wt as unsupportedFinalSnapshotError, X as computeParameterTaint, Xa as markSameGenerationBag, Xi as unreadableOrphanRecords, Xo as readBootstrapMarkerBody, Xr as hasReadableResources, Xs as defineOwnKey, Xt as updatePartialReason, Y as yellow, Ya as maskSecretsInText, Yi as unpreviewableOrphanRecords, Yo as parseBootstrapMarker, Yr as hasReadableOutputs, Ys as processStackMessages, Yt as updatePartialMessage, Z as namesAnyDeclaredParameter, Za as redactSecretsForState, Zi as unreadableResourceEntries, Zo as validateAssetBucketName, Zr as isReadableOrphanRecord, Zs as hasOwnKey, Zt as DeploymentEventsReader, _ as makeCanonicalizePropertiesFn, _i as malformedStateRefusalMessage, _n as findDestructiveChanges, _o as isSingleDynamicReferenceToken, _r as envCredentialsAreAssumedRole, _s as escapeRegExp, a as findNestedTemplateTreeDefect, aa as shownType, ac as resolveAssemblyPath, ai as malformedOrphanRecordsRefusalMessage, an as secretSafeKeyDisplay, ao as carriesSecretMask, ar as classifyReplaySecretRegion, as as dockerSpawnEnvWithSensitive, at as makeSiblingClaimReader, b as recordedProtectionNote, bo as S3StateBackend, bs as getDockerImageBySourceHash, bt as replayRollback, c as renderNestedTemplateTreeDefect, ca as isStatefulRecreateTargetSync, ci as malformedOrphansRefusalMessage, cn as noEchoParameterValueSeed, co as recordMaskOnlyValuesIn, cr as applyRoleArnIfSet, cs as getDockerCmd, ct as displacedOpClause, d as conditionInputsFrom, di as malformedOutputsWarning, dn as isExportAliasCollision, do as wholeStringLeavesOf, dr as explicitRoleArnOrThrow, ds as partitionSensitiveEnv, ea as unwrittenCreateOnlyReplacement, ec as ownValue, ei as malformedExportNamesWarning, en as WITHHELD_NAME_DISPLAY, eo as DYNAMIC_REFERENCE_TOKEN_SCAN, es as buildDockerImage, et as deleteJournaledOrphans, f as parentSuppliedValues, fi as malformedRenderedContainersWarning, fn as bindingSkippedOutputs, fo as STATE_SOURCED_BASELINE_RULES, fr as isIamRoleArn, fs as redactDockerArgvValues, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, gi as malformedScrubResourceEntriesRefusalMessage, gn as constructPathOf, go as WHOLE_DYNAMIC_REFERENCE_PATTERN, gr as callerEnvCredentials, gs as warnFinchArgvExposure, gt as withNestedRevertRun, h as keptWholeReasonText, hi as malformedResourcesWarning, hn as maskingRetryLogger, ho as TEMPLATE_SOURCED_RULES, hr as applyCallerIdentityCredentials, hs as runDockerStreaming, ht as revertedNestedRowIds, i as childTemplateLoader, ia as findReplacedReadersOfRecreateTargets, ic as renderAssemblyPathEscape, ii as malformedLocalResourcesWarning, in as secretBearingStateKeyWarning, io as identityKeyFor, ir as IntrinsicFunctionResolver, is as describeDockerFailure, it as sameJournaledOrphans, ji as refuseMalformedResourceEntriesForDestroy, jo as isReadableBag, jr as isNamelessDynamicReferenceError, js as resolveStateBucketWithDefaultAndSource, jt as replacementNeverSwapped, ki as refuseMalformedResourceEntries, ko as importableOutputKeys, kr as carriesDynamicReference, ks as resolveSkipPrefix, kt as planFailedOps, l as templateIdentity, la as renderStatefulReason, li as malformedOrphansWarning, ln as collectDeclaredOutputNames, lo as recordNoEchoAttributeValues, lr as assertFlagRoleArn, ls as isDockerClientEnvKey, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, mi as malformedResourcePropertiesWarning, mn as DEFAULT_RESOURCE_WARN_AFTER_MS, mo as STATE_SOURCED_READBACK_RULES, mr as AWS_CREDENTIAL_ENV_KEYS, ms as runDockerForeground, n as IMPLICIT_DELETE_DEPENDENCIES, na as NO_CC_HANDLERS_REASON, nc as describeFileReadFailure, ni as malformedLocalOutputsWarning, nn as exportAliasCollisionScrubWarning, no as isUncertifiedBaselineMaskPosition, nr as DiffCalculator, ns as describeDockerCapturedOutput, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as MULTI_REGION_RECREATE_BLOCKED_TYPES, oi as malformedOrphanRecordsWarning, on as exportNameSecretExposure, oo as provenPublicValue, or as producerRegionsFromState, os as finchSecretArgvRefusal, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pi as malformedResourceEntriesWarning, pn as DEFAULT_RESOURCE_TIMEOUT_MS, po as STATE_SOURCED_CROSS_GENERATION_RULES, pr as sendableAssumeRoleCommand, ps as redactedDockerCause, pt as recordDisplacedSkips, q as green, qa as errorCauseChain, qi as repairMalformedResourcePropertiesForReadOnly, qo as getBootstrapMarkerKey, qr as displayLogicalId, qs as AssemblyReader, r as computeImplicitDeleteEdges, ra as hasNoCloudControlHandlers, rc as displayAssemblyPath, ri as malformedLocalResourceEntriesWarning, rn as secretBearing, ro as pathCrossesDottedKey, rr as INTRINSIC_KEYS, rs as describeDockerExecFailure, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as isStatefulRecreateTargetForReplace, sc as resolveBucketRegion, si as malformedOrphanRowsKeptWarning, sn as isWholeDynamicReferenceValue, so as recordMaskOnlyValue, sr as regionLessSecretName, ss as formatDockerLoginError, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, tc as absoluteAssemblyPathEscape, ti as malformedExportSourceWarning, tn as displayTextOrWithheld, to as dynamicReferenceTokens, ts as resolveDockerContextDirectory, tt as isHandledOrphan, u as conditionFingerprint, ui as malformedOutputsRefusalMessage, un as collectPublishedOutputNames, uo as recordProvenPublicExpression, ur as assertSendableRoleArn, us as isMalformedEnvKey, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as previewableOrphanRecords, vn as formatDestructiveChange, vo as LockManager, vs as stripControlChars, vt as withNestedStackContext, w as readProtection, wi as refuseMalformedOrphansForDestroy, wo as describeRegionValueKind, wr as coerceParameterTypedValue, ws as getLegacyStateBucketName, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as refuseMalformedOrphanRecords, xn as ledgerForStack, xo as rebuildClientForBucketRegion, xs as Synthesizer, y as recordedProtectionEvidence, yi as refuseDivergentRecordRegionForDestroy, yn as RollbackInlinePolicyWriters, yo as isLockInfoExpired, ys as AssetManifestLoader, yt as replayFailedOperations, za as hasMaskableValues, zi as refuseMalformedResourcesForDeploy, zo as buildAssetRedirectMap, zr as parameterInputsFor, zs as findLargeInlineResources, zt as ccRoutedFinalSnapshotError } from "./deploy-engine-Dre6eDNJ.js";
+import { t as getCdkdVersion } from "./version-B5LYpWJH.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -29,7 +29,7 @@ import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -2414,7 +2414,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DNkoEEo4.js");
+	providerClasses ??= import("./provider-classes-Ca6o5by0.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -8534,10 +8534,10 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 		return uniqueId;
 	};
 }
-function containsDynamicReference(value) {
+function containsDynamicReference$1(value) {
 	if (typeof value === "string") return value.includes("{{resolve:");
-	if (Array.isArray(value)) return value.some(containsDynamicReference);
-	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference);
+	if (Array.isArray(value)) return value.some(containsDynamicReference$1);
+	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference$1);
 	return false;
 }
 const MIN_SECRET_NEEDLE_LENGTH = 4;
@@ -8712,7 +8712,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 	return out + leaf.slice(cursor);
 }
 async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
-	if (!containsDynamicReference(props)) return props;
+	if (!containsDynamicReference$1(props)) return props;
 	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
 	const ctx = {
 		template: { Resources: {} },
@@ -16833,17 +16833,18 @@ function displacedOpLabel(op, segment) {
 	return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — ${displacedOpClause(op, segment.importedResources ?? [], getLogger())}; not reverted, check that resource by hand`;
 }
 function failedOpsToReplay(ops, revertFailed) {
-	return revertFailed ? ops : ops.filter(isJournaledOrphan);
+	return revertFailed ? ops : ops.filter((op) => isJournaledOrphan(op) || op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
 }
 function failedActionLabel(item, skipFinalSnapshot) {
 	const { op, action } = item;
 	switch (action) {
 		case "revert-failed-update": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED update — remote state unknown, force-applying previous properties]`;
-		case "delete-failed-create": return op.physicalIdRecoveredFromError === true ? `  - delete   ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) [FAILED create, never recorded in state: ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}]` : `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create]`;
+		case "delete-failed-create": return op.physicalIdRecoveredFromError === true ? `  - delete   ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) [FAILED ` + (isReplacementOrphan(op) ? "replacement's new resource" : "create") + `, never recorded in state: ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}]` : `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create]`;
 		case "delete-failed-create-with-final-snapshot": return `  - delete   ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) [FAILED create, ${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
 		case "orphan-failed-create-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
 		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
+		case "skip-failed-replaced-deleted": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed replacement deleted the old resource ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"} before its create failed; nothing to revert, state still records it`;
 		case "skip-failed-superseded": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed CREATE created ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"} before failing; a later deploy or rollback may own it now; not deleted, needs manual attention`;
 		case "skip-failed-mismatch": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed CREATE recorded ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}, which is not the resource state tracks under this id; not reverted, needs manual attention`;
 		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
@@ -17261,11 +17262,11 @@ function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 		switch (action) {
 			case "delete-failed-create-with-final-snapshot":
 				if (planItemWillBeRefused(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)) break;
-				delete previewState[op.logicalId];
+				if (!isReplacementOrphan(op)) delete previewState[op.logicalId];
 				break;
 			case "delete-failed-create":
 			case "orphan-failed-create-retain":
-				delete previewState[op.logicalId];
+				if (!isReplacementOrphan(op)) delete previewState[op.logicalId];
 				break;
 			case "revert-failed-update": if (op.previousState) previewState[op.logicalId] = op.previousState;
 		}
@@ -19839,6 +19840,10 @@ const ENGINE_ECS_SECRETS_CHANNEL = {
 	what: "ECS task secrets are fetched with the role and injected as plaintext into the container's environment",
 	flagOnly: false
 };
+const ENGINE_DYNAMIC_REFERENCE_CHANNEL = {
+	what: "CloudFormation dynamic references ({{resolve:...}}) are fetched with the role and injected as plaintext into the container's environment",
+	flagOnly: false
+};
 const ENGINE_ASSUME_ROLE_CHANNEL = {
 	what: "the role --assume-role / --assume-task-role assumes for the container is assumed BY the --role-arn role, so the container can receive a role you could not assume yourself",
 	flagOnly: false
@@ -20945,6 +20950,7 @@ function checkVolumeHostPath(hostPath) {
 }
 async function applyCrossStackResolverToTask(task, context) {
 	if (!context.crossStackResolver) return;
+	const { resolveDynamicReferences: _envOnly, ...secretContext } = context;
 	const rawContainers = (task.resource.Properties ?? {})["ContainerDefinitions"];
 	if (!Array.isArray(rawContainers)) return;
 	for (let idx = 0; idx < task.containers.length; idx += 1) {
@@ -20964,10 +20970,21 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") continue;
 			if (Object.hasOwn(container.environment, key)) continue;
 			if (!isCrossStackIntrinsic(value)) continue;
-			const sub = await substituteAgainstStateAsync(value, context);
+			let resolvedToken = false;
+			const hook = context.resolveDynamicReferences;
+			const keyContext = hook ? {
+				...context,
+				resolveDynamicReferences: async (v, producerRegion) => {
+					const plain = await hook(v, producerRegion);
+					resolvedToken = true;
+					return plain;
+				}
+			} : context;
+			const sub = await substituteAgainstStateAsync(value, keyContext);
 			if (sub.kind === "literal") {
 				defineOwnKey(container.environment, key, String(sub.value));
 				resolvedEnvKeys.add(key);
+				if (resolvedToken) container.resolvedDynamicReferenceKeys = [...container.resolvedDynamicReferenceKeys ?? [], key];
 			}
 		}
 		if (Array.isArray(c["Secrets"])) for (const entry of c["Secrets"]) {
@@ -20979,7 +20996,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
 			if (container.secrets.some((s) => s.name === sName)) continue;
 			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, context);
+			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
 			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
 				container.secrets.push({
 					name: sName,
@@ -21559,6 +21576,29 @@ function strandedProfileCredentialsNotice(hostPath) {
 	return `The AWS credentials file mounted into the containers is NOT removed: delete ${displayIdent(hostPath)} once you tear them down.`;
 }
 
+//#endregion
+//#region src/local/dynamic-reference.ts
+function createCallerDynamicReferenceResolver(profile) {
+	return new DynamicReferenceResolver({
+		secretsManagerClientFactory: (region) => new SecretsManagerClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...region && { region: canonicalizeRegion(region) },
+			...profile && { profile }
+		}),
+		ssmClientFactory: (region) => new SSMClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...region && { region: canonicalizeRegion(region) },
+			...profile && { profile }
+		})
+	});
+}
+
 //#endregion
 //#region src/local/websocket-body.ts
 function bufferToBody$1(raw, isBinary) {
@@ -21965,6 +22005,7 @@ function createContainerPool(specs, options) {
 				}],
 				extraMounts,
 				env: spec.env,
+				...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 				cmd: [spec.lambda.handler],
 				hostPort,
 				host: spec.containerHost,
@@ -21983,6 +22024,7 @@ function createContainerPool(specs, options) {
 				readOnly: true
 			}] },
 			env: spec.env,
+			...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 			cmd: spec.command,
 			hostPort,
 			host: spec.containerHost,
@@ -22375,7 +22417,8 @@ async function localStartApiCommand(target, options) {
 				skipPull: options.pull === false,
 				...options.layerRoleArn !== void 0 && { layerRoleArn: options.layerRoleArn },
 				...profileCredentials && { profileCredentials },
-				...profileCredsFile && { profileCredsFile }
+				...profileCredsFile && { profileCredsFile },
+				...dynamicReferenceSpecOptions(options)
 			});
 			specs.set(logicalId, spec);
 		}
@@ -22799,8 +22842,14 @@ function assumeRolePin(logicalId) {
 function malformedAutoRoleError(logicalId, detail) {
 	return /* @__PURE__ */ new Error(`--assume-role-auto: ${detail}. Refusing to start rather than fall back to your shell credentials for this Lambda. Fix the deployed role ARN, or pin one explicitly with ${assumeRolePin(logicalId)}.`);
 }
+function dynamicReferenceSpecOptions(options) {
+	return {
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegionOverride: options.stackRegion }
+	};
+}
 async function buildContainerSpec(args) {
-	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile } = args;
+	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile, profile, stackRegionOverride } = args;
 	const lambda = resolveLambdaByLogicalId(logicalId, stacks);
 	let codeDir;
 	let optDir;
@@ -22833,6 +22882,22 @@ async function buildContainerSpec(args) {
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? logicalId;
 		getLogger().warn(`Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}) or pass --from-state to recover deployed values.`);
 	}
+	const plaintextKeys = new Set(stateAudit?.sensitiveKeys ?? []);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamicRefs = createCallerDynamicReferenceResolver(profile);
+	let dynamic;
+	try {
+		dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+			region: firstUsableRegion(stateBundle?.region, stackRegionOverride, lambda.stack.region, stsRegion),
+			label: `Lambda ${logicalId}`,
+			skipKeys: plaintextKeys,
+			resolver: dynamicRefs
+		});
+	} finally {
+		dynamicRefs.dispose();
+	}
+	const sensitiveKeyList = [...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys];
+	const sensitiveEnvKeys = sensitiveKeyList.length > 0 ? new Set(sensitiveKeyList) : void 0;
 	const dockerEnv = {
 		AWS_LAMBDA_FUNCTION_NAME: logicalId,
 		AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
@@ -22840,7 +22905,7 @@ async function buildContainerSpec(args) {
 		AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 		AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${logicalId}`,
 		AWS_LAMBDA_LOG_STREAM_NAME: "local",
-		...envResult.resolved
+		...dynamic.env
 	};
 	const roleArn = resolveStartApiAssumeRoleArn({
 		logicalId,
@@ -22878,6 +22943,7 @@ async function buildContainerSpec(args) {
 		codeDir,
 		platform,
 		env: dockerEnv,
+		...sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys },
 		containerHost,
 		...optDir !== void 0 && { optDir },
 		...debugPort !== void 0 && { debugPort },
@@ -22896,6 +22962,7 @@ async function buildContainerSpec(args) {
 		...lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		env: dockerEnv,
+		...sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys },
 		containerHost,
 		...debugPort !== void 0 && { debugPort },
 		...tmpfs !== void 0 && { tmpfs },
@@ -23327,13 +23394,16 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options)
 		try {
 			const loaded = await provider.load(stack.stackName, stack.region);
 			if (!loaded) continue;
-			const bundle = { state: {
-				version: 1,
-				stackName: stack.stackName,
-				resources: loaded.resources,
-				outputs: loaded.outputs,
-				lastModified: 0
-			} };
+			const bundle = {
+				state: {
+					version: 1,
+					stackName: stack.stackName,
+					resources: loaded.resources,
+					outputs: loaded.outputs,
+					lastModified: 0
+				},
+				region: loaded.region
+			};
 			if (stackHasIntrinsicEnv(stackName)) {
 				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
 				if (pseudo) bundle.pseudoParameters = pseudo;
@@ -23796,10 +23866,24 @@ async function runEcsTask(task, options, state) {
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
 	for (const c of task.containers) {
-		const refusal = finchSecretArgvRefusal(c.secrets.map((s) => s.name).filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
+		const refusal = finchSecretArgvRefusal([
+			...c.secrets.map((s) => s.name),
+			...c.resolvedDynamicReferenceKeys ?? [],
+			...dynamicReferenceEnvKeys(c, options.envOverrides)
+		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
 		if (refusal !== void 0) finchRefusals.push(refusal);
 	}
 	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
+	const argvRefusals = [];
+	for (const c of task.containers) {
+		const fields = [
+			["Command", c.command],
+			["EntryPoint", c.entryPoint],
+			["HealthCheck.Command", c.healthCheck?.command]
+		];
+		for (const [field, argv] of fields) if (argv?.some((a) => containsDynamicReference(a))) argvRefusals.push(`Container ${displayIdent(c.name)}: ${field} carries a CloudFormation dynamic reference ({{resolve:...}}). cdkd resolves dynamic references only in Environment, because resolving one here would put the secret on the docker run argv. Move the value into an Environment variable or a Secrets entry.`);
+	}
+	if (argvRefusals.length > 0) throw new EcsTaskRunnerError(argvRefusals.join("\n"));
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
@@ -23809,6 +23893,22 @@ async function runEcsTask(task, options, state) {
 		valueFrom: s.valueFrom
 	});
 	const secretsByContainer = groupSecretsByContainer(await resolveEcsSecrets(allSecrets, { ...options.region !== void 0 && { region: options.region } }));
+	const dynamicEnvByContainer = /* @__PURE__ */ new Map();
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		for (const c of task.containers) {
+			const tokenKeys = new Set(dynamicReferenceEnvKeys(c, options.envOverrides));
+			if (tokenKeys.size === 0) continue;
+			dynamicEnvByContainer.set(c.name, await resolveDynamicReferencesInEnv(c.environment, {
+				region: firstUsableRegion(options.stateRecordRegion, options.stackRegion, task.stack.region, options.region),
+				label: `Container ${c.name}`,
+				skipKeys: new Set(Object.keys(c.environment).filter((k) => !tokenKeys.has(k))),
+				resolver: dynamicRefs
+			}));
+		}
+	} finally {
+		dynamicRefs.dispose();
+	}
 	if (options.existingNetwork) state.network = {
 		...options.existingNetwork,
 		ownedByCaller: true
@@ -23852,9 +23952,14 @@ async function runEcsTask(task, options, state) {
 	for (const container of task.containers) {
 		const image = imagePlan.get(container.name);
 		if (!image) throw new EcsTaskRunnerError(`Internal: no resolved image for container '${container.name}'.`);
+		const dynamic = dynamicEnvByContainer.get(container.name);
 		const built = buildDockerRunArgs({
 			task,
-			container,
+			container: dynamic ? {
+				...container,
+				environment: dynamic.env
+			} : container,
+			plaintextEnvKeys: [...container.resolvedDynamicReferenceKeys ?? [], ...dynamic?.resolvedKeys ?? []],
 			image,
 			network: state.network.networkName,
 			volumeByName,
@@ -24174,6 +24279,19 @@ async function realizeDockerVolumes(volumes, state) {
 function randHex(bytes) {
 	return randomBytes(bytes).toString("hex");
 }
+function overriddenEnvKeys(overrides, containerName) {
+	if (!overrides) return [];
+	const applied = (map) => Object.entries(map ?? {}).filter(([, v]) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean").map(([k]) => k);
+	return [...applied(overrides["Parameters"]), ...applied(overrides[containerName])];
+}
+function dynamicReferenceEnvKeys(container, overrides) {
+	const skip = /* @__PURE__ */ new Set([
+		...container.resolvedDynamicReferenceKeys ?? [],
+		...container.secrets.map((s) => s.name),
+		...overriddenEnvKeys(overrides, container.name)
+	]);
+	return Object.keys(container.environment).filter((k) => !skip.has(k) && containsDynamicReference(container.environment[k]));
+}
 function groupSecretsByContainer(resolved) {
 	const out = /* @__PURE__ */ new Map();
 	for (const r of resolved) {
@@ -24241,7 +24359,11 @@ function buildDockerRunArgs(opts) {
 		applyOverrideMap(finalEnv, overrides["Parameters"]);
 		applyOverrideMap(finalEnv, overrides[container.name]);
 	}
-	const sensitiveKeys = /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]);
+	const sensitiveKeys = /* @__PURE__ */ new Set([
+		...SENSITIVE_ENV_KEYS,
+		...secrets.map((s) => s.name),
+		...opts.plaintextEnvKeys ?? []
+	]);
 	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys);
 	args.push(...flags);
 	if (container.user) args.push("--user", container.user);
@@ -24361,13 +24483,23 @@ async function localRunTaskCommand(target, options) {
 			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) {
+				const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
 				const subContext = {
 					resources: imageContext?.stateResources ?? {},
 					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
 					consumerRegion,
-					crossStackResolver: resolver
+					crossStackResolver: resolver,
+					resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+						region: producerRegion,
+						consumer: `Task ${task.taskDefinitionLogicalId} cross-stack env value`,
+						overridable: false
+					})
 				};
-				await applyCrossStackResolverToTask(task, subContext);
+				try {
+					await applyCrossStackResolverToTask(task, subContext);
+				} finally {
+					dynamicRefs.dispose();
+				}
 			}
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state.");
 		sigintHandler = () => {
@@ -24402,7 +24534,8 @@ async function localRunTaskCommand(target, options) {
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
 		const runOpts = buildRunEcsTaskOptions(options, channels, {
 			...envOverrides !== void 0 && { envOverrides },
-			...resolvedRoleArn !== void 0 && { resolvedRoleArn }
+			...resolvedRoleArn !== void 0 && { resolvedRoleArn },
+			...stateRecordRegion !== void 0 && { stateRecordRegion }
 		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
@@ -24620,6 +24753,9 @@ function buildRunEcsTaskOptions(options, channels, extra = {}) {
 	if (extra.resolvedRoleArn) runOpts.taskRoleArn = extra.resolvedRoleArn;
 	if (options.platform) runOpts.platformOverride = options.platform;
 	if (options.region) runOpts.region = options.region;
+	if (options.stackRegion) runOpts.stackRegion = options.stackRegion;
+	if (options.profile) runOpts.profile = options.profile;
+	if (extra.stateRecordRegion) runOpts.stateRecordRegion = extra.stateRecordRegion;
 	if (options.ecrRoleArn !== void 0) runOpts.ecrRoleArn = options.ecrRoleArn;
 	if (channels.profileCredsFile) runOpts.profileCredentialsFile = {
 		hostPath: channels.profileCredsFile.hostPath,
@@ -24661,7 +24797,11 @@ function createLocalStartServiceCommand() {
 		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
-	warnEngineRoleExposure(cmd, "start-service", [ENGINE_ECS_SECRETS_CHANNEL, ENGINE_ACCOUNT_ID_CHANNEL]);
+	warnEngineRoleExposure(cmd, "start-service", [
+		ENGINE_ECS_SECRETS_CHANNEL,
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
+	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
@@ -25474,13 +25614,28 @@ function findFileAssetByObjectKey(fileAssets, hash) {
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
 async function buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext) {
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		return await buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs) {
 	const logger = getLogger();
-	let templateEnv = resolved.environmentVariables;
+	const overrides = readEnvOverridesFile$1(options.envVars);
+	const cdkPath = readCdkPathOrUndefined(resolved.resource);
+	const overriddenKeys = keysOverriddenBy(resolved.environmentVariables, (env) => resolveEnvVars(resolved.logicalId, cdkPath, env, overrides).resolved);
+	let templateEnv = withoutKeys(resolved.environmentVariables, overriddenKeys);
 	const sensitiveEnvKeys = /* @__PURE__ */ new Set();
 	if (stateProvider && loaded) {
 		const subContext = {
 			resources: imageContext?.stateResources ?? loaded.resources,
-			consumerRegion: loaded.region
+			consumerRegion: loaded.region,
+			resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+				region: producerRegion,
+				consumer: `AgentCore Runtime ${resolved.logicalId} cross-stack env value`
+			})
 		};
 		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 		if (pseudo) subContext.pseudoParameters = pseudo;
@@ -25494,14 +25649,21 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 		for (const key of audit.sensitiveKeys) sensitiveEnvKeys.add(key);
 		for (const { key, reason } of audit.unresolved) logger.warn(`${stateProvider.label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
-	const overrides = readEnvOverridesFile$1(options.envVars);
-	const cdkPath = readCdkPathOrUndefined(resolved.resource);
 	const envResult = resolveEnvVars(resolved.logicalId, cdkPath, templateEnv, overrides);
 	for (const key of envResult.unresolved) {
 		const overrideKeyExample = cdkPath?.replace(/\/Resource$/, "") ?? resolved.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack) to recover deployed values.`);
 	}
-	const dockerEnv = { ...envResult.resolved };
+	const skipKeys = keysNotFromTemplate(templateEnv, envResult.resolved);
+	for (const key of sensitiveEnvKeys) skipKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(loaded?.region, options.stackRegion, resolved.stack.region, options.region),
+		label: `AgentCore Runtime ${resolved.logicalId}`,
+		skipKeys,
+		resolver: dynamicRefs
+	});
+	for (const key of dynamic.resolvedKeys) sensitiveEnvKeys.add(key);
+	const dockerEnv = { ...dynamic.env };
 	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
 	await applyAgentCoreCredentialEnv(dockerEnv, {
 		...assumeRoleArn !== void 0 && { assumeRoleArn },
@@ -25843,7 +26005,11 @@ function createLocalStartAgentCoreCommand$1() {
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
-	warnEngineRoleExposure(cmd, "start-agentcore", [engineCredentialTripleChannel("the agent container"), ENGINE_ACCOUNT_ID_CHANNEL]);
+	warnEngineRoleExposure(cmd, "start-agentcore", [
+		engineCredentialTripleChannel("the agent container"),
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
+	]);
 	return adoptDeprecatedRegionFlag(cmd);
 }
 
@@ -25889,7 +26055,8 @@ function createLocalStartAlbCommand() {
 	warnEngineRoleExposure(cmd, "start-alb", [
 		engineCredentialTripleChannel("the ALB's Lambda target-group containers"),
 		ENGINE_ECS_SECRETS_CHANNEL,
-		ENGINE_ACCOUNT_ID_CHANNEL
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
 	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
@@ -25906,7 +26073,7 @@ function createLocalStartCloudFrontCommand$1() {
 	cmd.addOption(new Option("--state-prefix <prefix>", "[not supported on start-cloudfront] S3 key prefix for --from-state state files. Refused at startup with --from-state.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
 	refuseUnwiredCdkdStateFlags(cmd);
-	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers")], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
+	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers"), ENGINE_DYNAMIC_REFERENCE_CHANNEL], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
 	return adoptDeprecatedRegionFlag(cmd);
 }
 function refuseUnwiredCdkdStateFlags(cmd) {
@@ -26023,50 +26190,7 @@ async function localInvokeCommand(target, options) {
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
 		logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
 		imagePlan = await resolveImagePlan(lambda, options);
-		let stateAudit;
-		let templateEnv = getTemplateEnv(lambda.resource);
-		let stateForRoleHint;
-		const stateProvider = createLocalStateProvider$1(options, lambda.stack.stackName, lambda.stack.region);
-		if (stateProvider) try {
-			const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
-			if (loaded) {
-				stateForRoleHint = {
-					version: 1,
-					stackName: lambda.stack.stackName,
-					resources: loaded.resources,
-					outputs: loaded.outputs,
-					lastModified: 0
-				};
-				const subContext = {
-					resources: loaded.resources,
-					consumerRegion: loaded.region
-				};
-				if (envHasIntrinsicValue(templateEnv)) {
-					const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
-					if (pseudo) subContext.pseudoParameters = pseudo;
-				}
-				if (envHasCrossStackIntrinsic(templateEnv)) {
-					const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
-					if (resolver) subContext.crossStackResolver = resolver;
-				}
-				const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
-				templateEnv = env;
-				stateAudit = audit;
-				const label = stateProvider.label;
-				for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
-				for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
-			}
-		} finally {
-			stateProvider.dispose();
-		}
-		const overrides = readEnvOverridesFile(options.envVars);
-		const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
-		const envResult = resolveEnvVars(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
-		for (const key of envResult.unresolved) {
-			if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
-			const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
-			logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass --from-state (cdkd-deployed) / --from-cfn-stack (cdk-deployed) to recover deployed values.`);
-		}
+		const { env: templateEnvResolved, sensitiveEnvKeys, stateForRoleHint } = await resolveInvokeTemplateEnv(lambda, options);
 		let resolvedAssumeRoleArn;
 		if (typeof options.assumeRole === "string") resolvedAssumeRoleArn = explicitRoleArnOrThrow("--assume-role", options.assumeRole);
 		else if (options.assumeRole === true) {
@@ -26081,7 +26205,7 @@ async function localInvokeCommand(target, options) {
 			AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 			AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${lambda.logicalId}`,
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
-			...envResult.resolved
+			...templateEnvResolved
 		};
 		await applyLambdaCredentialEnv(dockerEnv, {
 			...resolvedAssumeRoleArn && { assumeRoleArn: resolvedAssumeRoleArn },
@@ -26111,6 +26235,7 @@ async function localInvokeCommand(target, options) {
 			mounts: imagePlan.mounts,
 			extraMounts: extraMountsWithProfile,
 			env: dockerEnv,
+			...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys },
 			...hostGatewayExtraHosts.length > 0 && { extraHosts: hostGatewayExtraHosts },
 			cmd: imagePlan.cmd,
 			hostPort,
@@ -26138,6 +26263,82 @@ async function localInvokeCommand(target, options) {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 	}
 }
+async function resolveInvokeTemplateEnv(lambda, options) {
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		return await resolveInvokeTemplateEnvWith(lambda, options, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function resolveInvokeTemplateEnvWith(lambda, options, dynamicRefs) {
+	const logger = getLogger();
+	let stateAudit;
+	let stateForRoleHint;
+	let ownerRegion;
+	const declaredEnv = getTemplateEnv(lambda.resource);
+	const overrides = readEnvOverridesFile(options.envVars);
+	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
+	const overriddenKeys = keysOverriddenBy(declaredEnv, (env) => resolveEnvVars(lambda.logicalId, lambdaCdkPath, env, overrides).resolved);
+	let templateEnv = declaredEnv && withoutKeys(declaredEnv, overriddenKeys);
+	const stateProvider = createLocalStateProvider$1(options, lambda.stack.stackName, lambda.stack.region);
+	if (stateProvider) try {
+		const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
+		if (loaded) {
+			ownerRegion = loaded.region;
+			stateForRoleHint = {
+				version: 1,
+				stackName: lambda.stack.stackName,
+				resources: loaded.resources,
+				outputs: loaded.outputs,
+				lastModified: 0
+			};
+			const subContext = {
+				resources: loaded.resources,
+				consumerRegion: loaded.region,
+				resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+					region: producerRegion,
+					consumer: `Lambda ${lambda.logicalId} cross-stack env value`
+				})
+			};
+			if (envHasIntrinsicValue(templateEnv)) {
+				const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
+				if (pseudo) subContext.pseudoParameters = pseudo;
+			}
+			if (envHasCrossStackIntrinsic(templateEnv)) {
+				const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
+				if (resolver) subContext.crossStackResolver = resolver;
+			}
+			const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
+			templateEnv = env;
+			stateAudit = audit;
+			const label = stateProvider.label;
+			for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
+			for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		}
+	} finally {
+		stateProvider.dispose();
+	}
+	const envResult = resolveEnvVars(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
+	for (const key of envResult.unresolved) {
+		if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
+		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
+		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass --from-state (cdkd-deployed) / --from-cfn-stack (cdk-deployed) to recover deployed values.`);
+	}
+	const plaintextKeys = new Set(stateAudit?.sensitiveKeys ?? []);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(ownerRegion, options.stackRegion, lambda.stack.region, options.region),
+		label: `Lambda ${lambda.logicalId}`,
+		skipKeys: plaintextKeys,
+		resolver: dynamicRefs
+	});
+	return {
+		env: dynamic.env,
+		sensitiveEnvKeys: /* @__PURE__ */ new Set([...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys]),
+		...stateForRoleHint !== void 0 && { stateForRoleHint }
+	};
+}
 async function resolveImagePlan(lambda, options) {
 	if (lambda.kind === "zip") return resolveZipImagePlan(lambda, options);
 	return resolveContainerImagePlan(lambda, options);
@@ -26611,4 +26812,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DXRavuSm.js.map
+//# sourceMappingURL=program-DFehMfoh.js.map