@go-to-k/cdkd 0.296.2 → 0.296.4

package/dist/{program-CiMVZi4n.js → program-CwSdIG3b.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-Dvc7ddKe.js";
 import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $o as buildDenyExternalAccessPolicy, $r as malformedDriftResourcePropertiesWarning, $s as nullPrototypeRecord, $t as extractDeploymentEventError, Ai as refuseMalformedResourceEntriesForDeploy, Ao as importableOutputs, Ar as carriesFetchableDynamicReference, As as resolveStateBucketWithDefault, At as planRollback, Ba as literalSplitDelimitersOf, Bi as refuseMalformedResourcesForDestroy, Bn as CloudControlProvider, Bo as createAssetRedirectResolver, Bs as uploadCfnTemplate, Bt as createPreDeleteFinalSnapshot, C as perType, Ci as refuseMalformedOrphans, Cn as withCreateTokenLedger, Co as acceptedCreateOnlyDropsOf, Cs as getDefaultStateBucketName, Da as describeTypeWithThrottleRetry, Di as refuseMalformedOutputsForDestroy, Do as hasReasonlessBaselineRefusal, Dr as getAccountInfo, Ds as resolveAutoAssetStorage, Dt as isJournaledOrphan, Ea as templateResourceTypes, Ei as refuseMalformedOutputs, Eo as hasReadableExportSet, Er as parameterTypeMayLoseSecretIdentity, Es as resolveApp, Et as demoteSupersededOrphans, Fa as inheritNestedStackParameterAssociations, Fi as refuseMalformedResourcePropertiesForDestroy, Fn as ProviderRegistry, Fo as AssetPublisher, Fr as isStalePlaceholderArnAttribute, Fs as ssmResolvedValueType, Ft as inheritProducerRegions, G as cyan, Ga as shareLogOnlyValues, Gi as repairMalformedOutputsForReadOnly, Gn as deleteIndeterminateGuards, Go as assertAssetBucketRegion, Gr as UNREADABLE_RESOURCES_MAP_ROW, Gs as canonicalizeRegion, H as formatResourceLine, Ha as printingCorpusOf, Hi as refuseMalformedState, Hn as ccProtectionRegistryTypes, Ho as rewriteTemplateAssetReferences, Hr as STATE_REGION_DIVERGED, Hs as decodeListingKey, Ht as isFinalSnapshotError, Ia as recordNestedStackParameterExpressions, Ii as refuseMalformedResourcePropertiesForDrift, In as ccBrokenReason, Io as isSensitiveAttributeName, Ir as refStateLookupFromResource, Is as CFN_TEMPLATE_BODY_LIMIT, It as ATOMIC_FINAL_SNAPSHOT_TYPES, J as red, Ja as maskSecretsInError, Ji as repairMalformedResourcesForReadOnly, Jn as isWaitAbandonedError, Jo as isCrossRegionRedirect, Jr as hasReadableOrphans, Js as StageLoadError, K as gray, Ka as createSecretMasker, Ki as repairMalformedResourceEntriesForReadOnly, Kn as deleteSkipReason, Ko as ensureAssetStorage, Kr as deployRefusesOrphanRowsReason, Ks as derivePartitionAndUrlSuffix, La as carryLogOnlyValues, Li as refuseMalformedResourcePropertiesForExport, Ln as wouldReturnToSdkProvider, Lo as stringifyValue, Ls as CFN_TEMPLATE_URL_LIMIT, Lt as PRE_DELETE_SNAPSHOT_TYPES, Ma as DagBuilder, Mi as refuseMalformedResourceEntriesForImport, Mo as orphansAfterRollback, Mr as keepsSecretReferenceToken, Ms as resolveUseCdkBootstrapAssets, Mt as resolveReplacementOldType, Na as TemplateParser, Ni as refuseMalformedResourceEntriesForImportSave, No as orphansCarriedFrom, Nr as AWS_NO_VALUE, Ns as stateBucketExistenceConfirmed, Nt as findNestedStackTypeChanges, Oa as withRetry, Oi as refuseMalformedResourceAttributesForOrphan, Oo as hasUnverifiableParameterRefusal, Or as isImpossibleEmptyStoredAttribute, Os as resolveCaptureObservedState, Ot as isReplacementOrphan, Pa as liveMatchesUnresolvedTokenFrame, Pi as refuseMalformedResourceEntriesForOrphan, Pn as CC_BROKEN_REASON, Po as shouldRetainResource, Pr as cfnRefValueFromPhysicalId, Ps as warnDeprecatedNoPrefixCliFlag, Q as reachableDivergentParameters, Qa as scrubResourceRecord, Qi as findActionableSilentDrops, Qo as validateContainerRepoName, Qr as isReadableResourceEntry, Qs as hasPlainPrototype, Qt as DeploymentEventsStore, Ra as createUnionSecretMasker, Ri as refuseMalformedResourcePropertiesForOrphan, Rn as isCustomResourceType$1, Ro as WorkGraph, Rr as withSharedDrainBudget, Rs as MIGRATE_TMP_PREFIX, Rt as buildFinalSnapshotIdentifier, S as isProtectionValueActive, Si as refuseMalformedOrphanRecordsForDestroy, So as splitImportedOps, Ss as synthesisStatusMessage, St as destroyStackRecordsView, Ta as prefetchCreateOnlyPropertyPaths, Ti as refuseMalformedOrphansForOrphan, To as exportNamesCarriedFrom, Tr as isUnboundTemplateParameter, Ts as loadCdkJson, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as recordLogOnlyParameterValue, Ui as repairMalformedOrphanRecordsForReadOnly, Uo as AssetModeResolver, Ur as STATE_RESOURCES_MALFORMED, Us as expectedOwnerParam, Ut as refusesFinalSnapshot, Va as logOnlyValueCount, Vi as refuseMalformedResourcesForExport, Vn as slowCcOperationTimeoutMs, Vo as loadPublishableAssetManifest, Vr as JSON_LISTING_HOLE_VALUE, Vs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as effectiveDeletionPolicy, W as bold, Wa as recordLogOnlyValue, Wi as repairMalformedOrphansForReadOnly, Wn as UNSPECIFIED_SKIP_REASON, Wo as BOOTSTRAP_MARKER_PREFIX, Wr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ws as PARTITION_TABLE, Wt as unsupportedFinalSnapshotError, X as computeParameterTaint, Xa as markSameGenerationBag, Xi as unreadableOrphanRecords, Xo as readBootstrapMarkerBody, Xr as hasReadableResources, Xs as defineOwnKey, Xt as updatePartialReason, Y as yellow, Ya as maskSecretsInText, Yi as unpreviewableOrphanRecords, Yo as parseBootstrapMarker, Yr as hasReadableOutputs, Ys as processStackMessages, Yt as updatePartialMessage, Z as namesAnyDeclaredParameter, Za as redactSecretsForState, Zi as unreadableResourceEntries, Zo as validateAssetBucketName, Zr as isReadableOrphanRecord, Zs as hasOwnKey, Zt as DeploymentEventsReader, _ as makeCanonicalizePropertiesFn, _i as malformedStateRefusalMessage, _n as findDestructiveChanges, _o as isSingleDynamicReferenceToken, _r as envCredentialsAreAssumedRole, _s as escapeRegExp, a as findNestedTemplateTreeDefect, aa as shownType, ac as resolveAssemblyPath, ai as malformedOrphanRecordsRefusalMessage, an as secretSafeKeyDisplay, ao as carriesSecretMask, ar as classifyReplaySecretRegion, as as dockerSpawnEnvWithSensitive, at as makeSiblingClaimReader, b as recordedProtectionNote, bo as S3StateBackend, bs as getDockerImageBySourceHash, bt as replayRollback, c as renderNestedTemplateTreeDefect, ca as isStatefulRecreateTargetSync, ci as malformedOrphansRefusalMessage, cn as noEchoParameterValueSeed, co as recordMaskOnlyValuesIn, cr as applyRoleArnIfSet, cs as getDockerCmd, ct as displacedOpClause, d as conditionInputsFrom, di as malformedOutputsWarning, dn as isExportAliasCollision, do as wholeStringLeavesOf, dr as explicitRoleArnOrThrow, ds as partitionSensitiveEnv, ea as unwrittenCreateOnlyReplacement, ec as ownValue, ei as malformedExportNamesWarning, en as WITHHELD_NAME_DISPLAY, eo as DYNAMIC_REFERENCE_TOKEN_SCAN, es as buildDockerImage, et as deleteJournaledOrphans, f as parentSuppliedValues, fi as malformedRenderedContainersWarning, fn as bindingSkippedOutputs, fo as STATE_SOURCED_BASELINE_RULES, fr as isIamRoleArn, fs as redactDockerArgvValues, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, gi as malformedScrubResourceEntriesRefusalMessage, gn as constructPathOf, go as WHOLE_DYNAMIC_REFERENCE_PATTERN, gr as callerEnvCredentials, gs as warnFinchArgvExposure, gt as withNestedRevertRun, h as keptWholeReasonText, hi as malformedResourcesWarning, hn as maskingRetryLogger, ho as TEMPLATE_SOURCED_RULES, hr as applyCallerIdentityCredentials, hs as runDockerStreaming, ht as revertedNestedRowIds, i as childTemplateLoader, ia as findReplacedReadersOfRecreateTargets, ic as renderAssemblyPathEscape, ii as malformedLocalResourcesWarning, in as secretBearingStateKeyWarning, io as identityKeyFor, ir as IntrinsicFunctionResolver, is as describeDockerFailure, it as sameJournaledOrphans, ji as refuseMalformedResourceEntriesForDestroy, jo as isReadableBag, jr as isNamelessDynamicReferenceError, js as resolveStateBucketWithDefaultAndSource, jt as replacementNeverSwapped, ki as refuseMalformedResourceEntries, ko as importableOutputKeys, kr as carriesDynamicReference, ks as resolveSkipPrefix, kt as planFailedOps, l as templateIdentity, la as renderStatefulReason, li as malformedOrphansWarning, ln as collectDeclaredOutputNames, lo as recordNoEchoAttributeValues, lr as assertFlagRoleArn, ls as isDockerClientEnvKey, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, mi as malformedResourcePropertiesWarning, mn as DEFAULT_RESOURCE_WARN_AFTER_MS, mo as STATE_SOURCED_READBACK_RULES, mr as AWS_CREDENTIAL_ENV_KEYS, ms as runDockerForeground, n as IMPLICIT_DELETE_DEPENDENCIES, na as NO_CC_HANDLERS_REASON, nc as describeFileReadFailure, ni as malformedLocalOutputsWarning, nn as exportAliasCollisionScrubWarning, no as isUncertifiedBaselineMaskPosition, nr as DiffCalculator, ns as describeDockerCapturedOutput, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as MULTI_REGION_RECREATE_BLOCKED_TYPES, oi as malformedOrphanRecordsWarning, on as exportNameSecretExposure, oo as provenPublicValue, or as producerRegionsFromState, os as finchSecretArgvRefusal, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pi as malformedResourceEntriesWarning, pn as DEFAULT_RESOURCE_TIMEOUT_MS, po as STATE_SOURCED_CROSS_GENERATION_RULES, pr as sendableAssumeRoleCommand, ps as redactedDockerCause, pt as recordDisplacedSkips, q as green, qa as errorCauseChain, qi as repairMalformedResourcePropertiesForReadOnly, qo as getBootstrapMarkerKey, qr as displayLogicalId, qs as AssemblyReader, r as computeImplicitDeleteEdges, ra as hasNoCloudControlHandlers, rc as displayAssemblyPath, ri as malformedLocalResourceEntriesWarning, rn as secretBearing, ro as pathCrossesDottedKey, rr as INTRINSIC_KEYS, rs as describeDockerExecFailure, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as isStatefulRecreateTargetForReplace, sc as resolveBucketRegion, si as malformedOrphanRowsKeptWarning, sn as isWholeDynamicReferenceValue, so as recordMaskOnlyValue, sr as regionLessSecretName, ss as formatDockerLoginError, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, tc as absoluteAssemblyPathEscape, ti as malformedExportSourceWarning, tn as displayTextOrWithheld, to as dynamicReferenceTokens, ts as resolveDockerContextDirectory, tt as isHandledOrphan, u as conditionFingerprint, ui as malformedOutputsRefusalMessage, un as collectPublishedOutputNames, uo as recordProvenPublicExpression, ur as assertSendableRoleArn, us as isMalformedEnvKey, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as previewableOrphanRecords, vn as formatDestructiveChange, vo as LockManager, vs as stripControlChars, vt as withNestedStackContext, w as readProtection, wi as refuseMalformedOrphansForDestroy, wo as describeRegionValueKind, wr as coerceParameterTypedValue, ws as getLegacyStateBucketName, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as refuseMalformedOrphanRecords, xn as ledgerForStack, xo as rebuildClientForBucketRegion, xs as Synthesizer, y as recordedProtectionEvidence, yi as refuseDivergentRecordRegionForDestroy, yn as RollbackInlinePolicyWriters, yo as isLockInfoExpired, ys as AssetManifestLoader, yt as replayFailedOperations, za as hasMaskableValues, zi as refuseMalformedResourcesForDeploy, zo as buildAssetRedirectMap, zr as parameterInputsFor, zs as findLargeInlineResources, zt as ccRoutedFinalSnapshotError } from "./deploy-engine-C_Eg-RHm.js";
-import { t as getCdkdVersion } from "./version-WJhcQQ3m.js";
+import { $ as namesAnyDeclaredParameter, $a as markSameGenerationBag, $i as unreadableOrphanRecords, $o as readBootstrapMarkerBody, $r as hasReadableResources, $s as defineOwnKey, $t as DeploymentEventsReader, Aa as describeTypeWithThrottleRetry, Ai as refuseMalformedOutputsForDestroy, Ao as hasReasonlessBaselineRefusal, Ar as getAccountInfo, As as resolveAutoAssetStorage, At as isReplacementOrphan, Ba as carryLogOnlyValues, Bi as refuseMalformedResourcePropertiesForExport, Bn as isCustomResourceType$1, Bo as stringifyValue, Bs as CFN_TEMPLATE_URL_LIMIT, Bt as buildFinalSnapshotIdentifier, C as perType, Cn as ledgerForStack, Co as S3StateBackend, Cs as getDockerImageBySourceHash, Di as refuseMalformedOrphansForDestroy, Do as describeRegionValueKind, Dr as coerceParameterTypedValue, Ds as getLegacyStateBucketName, Dt as recordAfterRollbackUpdate, Ei as refuseMalformedOrphans, Eo as acceptedCreateOnlyDropsOf, Es as getDefaultStateBucketName, Et as withStackRecords, Fa as DagBuilder, Fi as refuseMalformedResourceEntriesForImport, Fo as orphansAfterRollback, Fr as keepsSecretReferenceToken, Fs as resolveUseCdkBootstrapAssets, Ft as findNestedStackTypeChanges, G as cyan, Ga as printingCorpusOf, Gi as refuseMalformedState, Gn as ccProtectionRegistryTypes, Go as rewriteTemplateAssetReferences, Gr as STATE_REGION_DIVERGED, Gs as decodeListingKey, Gt as refusesFinalSnapshot, H as formatResourceLine, Ha as hasMaskableValues, Hi as refuseMalformedResourcesForDeploy, Hn as withPrintingSecrets, Ho as buildAssetRedirectMap, Hr as parameterInputsFor, Hs as findLargeInlineResources, Ht as createPreDeleteFinalSnapshot, Ia as TemplateParser, Ii as refuseMalformedResourceEntriesForImportSave, In as CC_BROKEN_REASON, Io as orphansCarriedFrom, Ir as AWS_NO_VALUE, Is as stateBucketExistenceConfirmed, J as red, Ja as shareLogOnlyValues, Ji as repairMalformedOutputsForReadOnly, Jn as deleteIndeterminateGuards, Jo as assertAssetBucketRegion, Jr as UNREADABLE_RESOURCES_MAP_ROW, Js as canonicalizeRegion, K as gray, Ka as recordLogOnlyParameterValue, Ki as repairMalformedOrphanRecordsForReadOnly, Ko as AssetModeResolver, Kr as STATE_RESOURCES_MALFORMED, Ks as expectedOwnerParam, Kt as unsupportedFinalSnapshotError, La as liveMatchesUnresolvedTokenFrame, Li as refuseMalformedResourceEntriesForOrphan, Ln as ProviderRegistry, Lo as shouldRetainResource, Lr as cfnRefValueFromPhysicalId, Ls as warnDeprecatedNoPrefixCliFlag, Lt as inheritProducerRegions, Mi as refuseMalformedResourceEntries, Mo as importableOutputKeys, Mr as carriesDynamicReference, Ms as resolveSkipPrefix, Mt as planRollback, Ni as refuseMalformedResourceEntriesForDeploy, No as importableOutputs, Nr as carriesFetchableDynamicReference, Ns as resolveStateBucketWithDefault, Nt as replacementNeverSwapped, Oa as prefetchCreateOnlyPropertyPaths, Oi as refuseMalformedOrphansForOrphan, Oo as exportNamesCarriedFrom, Or as isUnboundTemplateParameter, Os as loadCdkJson, Ot as demoteSupersededOrphans, Pi as refuseMalformedResourceEntriesForDestroy, Po as isReadableBag, Pr as isNamelessDynamicReferenceError, Ps as resolveStateBucketWithDefaultAndSource, Pt as resolveReplacementOldType, Q as computeParameterTaint, Qa as maskSecretsInText, Qi as unpreviewableOrphanRecords, Qo as parseBootstrapMarker, Qr as hasReadableOutputs, Qs as processStackMessages, Qt as updatePartialReason, Ra as inheritNestedStackParameterAssociations, Ri as refuseMalformedResourcePropertiesForDestroy, Rn as ccBrokenReason, Ro as AssetPublisher, Rr as isStalePlaceholderArnAttribute, Rs as ssmResolvedValueType, Rt as ATOMIC_FINAL_SNAPSHOT_TYPES, S as isProtectionValueActive, Si as refuseDivergentRecordRegionForDestroy, So as isLockInfoExpired, Ss as AssetManifestLoader, St as replayRollback, Ti as refuseMalformedOrphanRecordsForDestroy, Tn as withCreateTokenLedger, To as splitImportedOps, Ts as synthesisStatusMessage, U as createReadOnlyAttributeHealerFactory, Ua as literalSplitDelimitersOf, Ui as refuseMalformedResourcesForDestroy, Un as CloudControlProvider, Uo as createAssetRedirectResolver, Us as uploadCfnTemplate, Ut as effectiveDeletionPolicy, Va as createUnionSecretMasker, Vi as refuseMalformedResourcePropertiesForOrphan, Vo as WorkGraph, Vr as withSharedDrainBudget, Vs as MIGRATE_TMP_PREFIX, Vt as ccRoutedFinalSnapshotError, W as bold, Wa as logOnlyValueCount, Wi as refuseMalformedResourcesForExport, Wn as slowCcOperationTimeoutMs, Wo as loadPublishableAssetManifest, Wr as JSON_LISTING_HOLE_VALUE, Ws as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wt as isFinalSnapshotError, X as secretNamePrintingBag, Xa as errorCauseChain, Xi as repairMalformedResourcePropertiesForReadOnly, Xo as getBootstrapMarkerKey, Xr as displayLogicalId, Xs as AssemblyReader, Y as yellow, Ya as createSecretMasker, Yi as repairMalformedResourceEntriesForReadOnly, Yn as deleteSkipReason, Yo as ensureAssetStorage, Yr as deployRefusesOrphanRowsReason, Ys as derivePartitionAndUrlSuffix, Z as stateSecretNameNeedles, Za as maskSecretsInError, Zi as repairMalformedResourcesForReadOnly, Zn as isWaitAbandonedError, Zo as isCrossRegionRedirect, Zr as hasReadableOrphans, Zs as StageLoadError, Zt as updatePartialMessage, _ as makeCanonicalizePropertiesFn, _i as malformedResourcePropertiesWarning, _n as maskingRetryLogger, _o as STATE_SOURCED_READBACK_RULES, _r as AWS_CREDENTIAL_ENV_KEYS, _s as runDockerForeground, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as NO_CC_HANDLERS_REASON, ac as describeFileReadFailure, ai as malformedLocalOutputsWarning, an as secretBearing, ao as isUncertifiedBaselineMaskPosition, ar as DiffCalculator, as as describeDockerCapturedOutput, at as loadJournaledOrphans, b as recordedProtectionNote, bi as malformedStateRefusalMessage, bn as formatDestructiveChange, bo as isSingleDynamicReferenceToken, br as envCredentialsAreAssumedRole, bs as escapeRegExp, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as shownType, cc as resolveAssemblyPath, ci as malformedOrphanRecordsRefusalMessage, cn as exportNameSecretExposure, co as carriesSecretMask, cr as classifyReplaySecretRegion, cs as dockerSpawnEnvWithSensitive, ct as planOrphanAdoption, d as conditionInputsFrom, da as isStatefulRecreateTargetSync, di as malformedOrphansRefusalMessage, dn as collectDeclaredOutputNames, do as recordMaskOnlyValuesIn, dr as applyRoleArnIfSet, ds as getDockerCmd, dt as displacedPhysicalIdShown, ea as unreadableResourceEntries, ec as hasOwnKey, ei as isReadableOrphanRecord, en as DeploymentEventsStore, eo as redactSecretsForState, es as validateAssetBucketName, et as reachableDivergentParameters, f as parentSuppliedValues, fa as renderStatefulReason, fi as malformedOrphansWarning, fn as collectPublishedOutputNames, fo as recordNoEchoAttributeValues, fr as assertFlagRoleArn, fs as isDockerClientEnvKey, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, gi as malformedResourceEntriesWarning, gn as DEFAULT_RESOURCE_WARN_AFTER_MS, go as STATE_SOURCED_CROSS_GENERATION_RULES, gr as sendableAssumeRoleCommand, gs as redactedDockerCause, h as keptWholeReasonText, hi as malformedRenderedContainersWarning, hn as DEFAULT_RESOURCE_TIMEOUT_MS, ho as STATE_SOURCED_BASELINE_RULES, hr as isIamRoleArn, hs as redactDockerArgvValues, ht as recordDisplacedSkips, i as childTemplateLoader, ic as absoluteAssemblyPathEscape, ii as malformedExportSourceWarning, in as exportAliasCollisionScrubWarning, io as dynamicReferenceTokens, is as resolveDockerContextDirectory, it as journaledOrphanLines, ja as withRetry, ji as refuseMalformedResourceAttributesForOrphan, jo as hasUnverifiableParameterRefusal, jr as isImpossibleEmptyStoredAttribute, js as resolveCaptureObservedState, jt as planFailedOps, ka as templateResourceTypes, ki as refuseMalformedOutputs, ko as hasReadableExportSet, kr as parameterTypeMayLoseSecretIdentity, ks as resolveApp, kt as isJournaledOrphan, l as templateIdentity, la as MULTI_REGION_RECREATE_BLOCKED_TYPES, li as malformedOrphanRecordsWarning, ln as isWholeDynamicReferenceValue, lo as provenPublicValue, lr as producerRegionsFromState, ls as finchSecretArgvRefusal, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, mi as malformedOutputsWarning, mn as bindingSkippedOutputs, mo as wholeStringLeavesOf, mr as explicitRoleArnOrThrow, ms as partitionSensitiveEnv, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, nc as nullPrototypeRecord, ni as malformedDriftResourcePropertiesWarning, nn as WITHHELD_NAME_DISPLAY, ns as buildDenyExternalAccessPolicy, nt as deleteJournaledOrphans, o as isAbsoluteAssetPath, oa as hasNoCloudControlHandlers, oc as displayAssemblyPath, oi as malformedLocalResourceEntriesWarning, on as secretBearingStateKeyWarning, oo as pathCrossesDottedKey, or as INTRINSIC_KEYS, os as describeDockerExecFailure, ot as sameJournaledOrphans, p as readRecordedConditionVerdicts, pi as malformedOutputsRefusalMessage, pn as isExportAliasCollision, po as recordProvenPublicExpression, pr as assertSendableRoleArn, ps as isMalformedEnvKey, q as green, qa as recordLogOnlyValue, qi as repairMalformedOrphansForReadOnly, qn as UNSPECIFIED_SKIP_REASON, qo as BOOTSTRAP_MARKER_PREFIX, qr as UNREADABLE_ORPHANS_CONTAINER_ROW, qs as PARTITION_TABLE, r as computeImplicitDeleteEdges, ra as unwrittenCreateOnlyReplacement, rc as ownValue, ri as malformedExportNamesWarning, rn as displayTextOrWithheld, ro as DYNAMIC_REFERENCE_TOKEN_SCAN, rs as buildDockerImage, rt as isHandledOrphan, s as listNestedTemplateRows, sa as findReplacedReadersOfRecreateTargets, sc as renderAssemblyPathEscape, si as malformedLocalResourcesWarning, sn as secretSafeKeyDisplay, so as identityKeyFor, sr as IntrinsicFunctionResolver, ss as describeDockerFailure, st as makeSiblingClaimReader, t as DeployEngine, ta as findActionableSilentDrops, tc as hasPlainPrototype, ti as isReadableResourceEntry, tn as extractDeploymentEventError, to as scrubResourceRecord, ts as validateContainerRepoName, tt as resourcesNamingDeclaredParameter, u as conditionFingerprint, ua as isStatefulRecreateTargetForReplace, uc as resolveBucketRegion, ui as malformedOrphanRowsKeptWarning, un as noEchoParameterValueSeed, uo as recordMaskOnlyValue, ur as regionLessSecretName, us as formatDockerLoginError, ut as displacedOpClause, v as withResourceDeadline, vi as malformedResourcesWarning, vn as constructPathOf, vo as TEMPLATE_SOURCED_RULES, vr as applyCallerIdentityCredentials, vs as runDockerStreaming, vt as withNestedRevertRun, w as readProtection, wi as refuseMalformedOrphanRecords, wo as rebuildClientForBucketRegion, ws as Synthesizer, wt as destroyStackRecordsView, x as PROTECTION_PROPERTY_BY_TYPE, xi as previewableOrphanRecords, xn as RollbackInlinePolicyWriters, xo as LockManager, xs as stripControlChars, xt as replayFailedOperations, y as recordedProtectionEvidence, yi as malformedScrubResourceEntriesRefusalMessage, yn as findDestructiveChanges, yo as WHOLE_DYNAMIC_REFERENCE_PATTERN, yr as callerEnvCredentials, ys as warnFinchArgvExposure, za as recordNestedStackParameterExpressions, zi as refuseMalformedResourcePropertiesForDrift, zn as wouldReturnToSdkProvider, zo as isSensitiveAttributeName, zr as refStateLookupFromResource, zs as CFN_TEMPLATE_BODY_LIMIT, zt as PRE_DELETE_SNAPSHOT_TYPES } from "./deploy-engine-HCnNEpdp.js";
+import { t as getCdkdVersion } from "./version-D557_3cB.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -29,7 +29,7 @@ import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -2414,7 +2414,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CtsCylnp.js");
+	providerClasses ??= import("./provider-classes-DXBYMcmp.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4482,6 +4482,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	}
 	const diffSecrets = /* @__PURE__ */ new Map();
 	const splitPieces = /* @__PURE__ */ new Map();
+	const derivedNames = /* @__PURE__ */ new Map();
 	const splitDelimiters = literalSplitDelimitersOf(template, new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name)));
 	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && mergedParameters !== void 0 && Object.prototype.hasOwnProperty.call(mergedParameters, name) && !isWholeDynamicReferenceValue(mergedParameters[name])) {
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
@@ -4492,11 +4493,13 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		diffSecrets,
 		inheritedForResolver,
 		outputsPassSecrets
-	], [splitPieces]);
+	], [splitPieces, derivedNames]);
 	const maskForLog = printing.mask;
 	const resolveRecordingInto = (bag, printingSecrets) => (value) => intrinsicResolver.resolve(value, {
 		recordedSecretValues: bag,
 		...printingSecrets && { printingSecrets },
+		secretNameNeedles: stateSecretNameNeedles(currentState.resources, diffSecrets),
+		secretNameSink: derivedNames,
 		...inheritedForResolver && { inheritedSecrets: inheritedForResolver },
 		template: effectiveTemplate,
 		resources: currentState.resources,
@@ -4570,6 +4573,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				return {
 					value: await intrinsicResolver.resolve(structuredClone(node), {
 						recordedSecretValues: secrets,
+						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, diffSecrets),
+						secretNameSink: derivedNames,
 						template: effectiveTemplate,
 						resources: resourcesForInputs,
 						stateBackend,
@@ -4636,7 +4641,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let shownOutputChanges = outputChanges;
 	let shownBlocking = blocking;
 	let shownDeployRefusals = deployRefusals;
-	if (hasMaskableValues(printingSecrets)) {
+	if (hasMaskableValues(printing.maskCorpus())) {
 		const mask = printing.mask;
 		const maskReason = (reason) => mask(stripControlChars(mask(reason)));
 		shownBlocking = blocking.map(maskReason);
@@ -4824,6 +4829,8 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 			const resolvedValue = await resolver.resolve(value, {
 				template: parentTemplate,
 				resources: parentState.resources,
+				secretNameNeedles: stateSecretNameNeedles(parentState.resources),
+				secretNameSink: /* @__PURE__ */ new Map(),
 				stateBackend,
 				stackName: parentStackName,
 				bestEffort: true,
@@ -7193,9 +7200,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			parameters = await bindDefaultedParametersOneByOne(resolver, stack.template, shownStack, logger);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
+		const secretNameSink = /* @__PURE__ */ new Map();
+		const secretNameNeedles = stateSecretNameNeedles(state.resources);
 		const resolverContext = (recordedSecretValues) => ({
 			template: stack.template,
 			resources: state.resources,
+			secretNameNeedles,
+			secretNameSink,
 			...Object.keys(parameters).length > 0 && { parameters },
 			...Object.keys(conditions).length > 0 && { conditions },
 			stackName: stack.stackName,
@@ -8534,10 +8545,10 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 		return uniqueId;
 	};
 }
-function containsDynamicReference(value) {
+function containsDynamicReference$1(value) {
 	if (typeof value === "string") return value.includes("{{resolve:");
-	if (Array.isArray(value)) return value.some(containsDynamicReference);
-	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference);
+	if (Array.isArray(value)) return value.some(containsDynamicReference$1);
+	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference$1);
 	return false;
 }
 const MIN_SECRET_NEEDLE_LENGTH = 4;
@@ -8712,7 +8723,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 	return out + leaf.slice(cursor);
 }
 async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
-	if (!containsDynamicReference(props)) return props;
+	if (!containsDynamicReference$1(props)) return props;
 	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
 	const ctx = {
 		template: { Resources: {} },
@@ -9711,7 +9722,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 			try {
 				const revertSecretResolvers = new DriftSecretResolvers(report.region);
 				const revertProducerRegions = report.producerRegions;
-				await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
+				await runWithConcurrency(driftedOutcomes.map((outcome) => () => withPrintingSecrets(secretNamePrintingBag(outcome.logicalId, report.state.resources), async () => {
 					const stateResource = report.state.resources[outcome.logicalId];
 					if (!stateResource) {
 						totalFailed++;
@@ -9827,7 +9838,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						const msg = maskSecretsInText(err instanceof Error ? err.message : String(err), secrets);
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 					}
-				}), concurrency);
+				})), concurrency);
 				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0) {
 					const resources = { ...report.state.resources };
 					let recordedCount = 0;
@@ -10683,7 +10694,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (!level) continue;
 			logger.debug(`Deletion level ${executionLevels.length - levelIndex}/${executionLevels.length} (${level.length} resources)`);
 			const stackRegion = state.region ?? ctx.baseRegion;
-			const deletePromises = level.map(async (logicalId) => {
+			const deletePromises = level.map((logicalId) => withPrintingSecrets(secretNamePrintingBag(logicalId, state.resources), async () => {
 				if (lock.interrupted) return;
 				const resource = state.resources[logicalId];
 				if (!resource) {
@@ -10890,7 +10901,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} finally {
 					renderer.removeTask(logicalId);
 				}
-			});
+			}));
 			await Promise.all(deletePromises);
 		}
 		result.interrupted = lock.interrupted;
@@ -14895,6 +14906,8 @@ async function buildResolvedParametersPerStack(args) {
 		const parentResolverContext = {
 			template: parentNode.template,
 			resources: parentNode.state.resources,
+			secretNameNeedles: stateSecretNameNeedles(parentNode.state.resources),
+			secretNameSink: /* @__PURE__ */ new Map(),
 			parameters: parentParamValues,
 			stackName: parentNode.cdkdName,
 			...args.stateBackend && { stateBackend: args.stateBackend }
@@ -19073,6 +19086,8 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	const baseContext = {
 		template,
 		resources: stackState.resources,
+		secretNameNeedles: stateSecretNameNeedles(stackState.resources),
+		secretNameSink: /* @__PURE__ */ new Map(),
 		...Object.keys(parameters).length > 0 && { parameters },
 		...Object.keys(conditions).length > 0 && { conditions },
 		stateBackend,
@@ -19840,6 +19855,10 @@ const ENGINE_ECS_SECRETS_CHANNEL = {
 	what: "ECS task secrets are fetched with the role and injected as plaintext into the container's environment",
 	flagOnly: false
 };
+const ENGINE_DYNAMIC_REFERENCE_CHANNEL = {
+	what: "CloudFormation dynamic references ({{resolve:...}}) are fetched with the role and injected as plaintext into the container's environment",
+	flagOnly: false
+};
 const ENGINE_ASSUME_ROLE_CHANNEL = {
 	what: "the role --assume-role / --assume-task-role assumes for the container is assumed BY the --role-arn role, so the container can receive a role you could not assume yourself",
 	flagOnly: false
@@ -20946,6 +20965,7 @@ function checkVolumeHostPath(hostPath) {
 }
 async function applyCrossStackResolverToTask(task, context) {
 	if (!context.crossStackResolver) return;
+	const { resolveDynamicReferences: _envOnly, ...secretContext } = context;
 	const rawContainers = (task.resource.Properties ?? {})["ContainerDefinitions"];
 	if (!Array.isArray(rawContainers)) return;
 	for (let idx = 0; idx < task.containers.length; idx += 1) {
@@ -20965,10 +20985,21 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") continue;
 			if (Object.hasOwn(container.environment, key)) continue;
 			if (!isCrossStackIntrinsic(value)) continue;
-			const sub = await substituteAgainstStateAsync(value, context);
+			let resolvedToken = false;
+			const hook = context.resolveDynamicReferences;
+			const keyContext = hook ? {
+				...context,
+				resolveDynamicReferences: async (v, producerRegion) => {
+					const plain = await hook(v, producerRegion);
+					resolvedToken = true;
+					return plain;
+				}
+			} : context;
+			const sub = await substituteAgainstStateAsync(value, keyContext);
 			if (sub.kind === "literal") {
 				defineOwnKey(container.environment, key, String(sub.value));
 				resolvedEnvKeys.add(key);
+				if (resolvedToken) container.resolvedDynamicReferenceKeys = [...container.resolvedDynamicReferenceKeys ?? [], key];
 			}
 		}
 		if (Array.isArray(c["Secrets"])) for (const entry of c["Secrets"]) {
@@ -20980,7 +21011,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
 			if (container.secrets.some((s) => s.name === sName)) continue;
 			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, context);
+			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
 			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
 				container.secrets.push({
 					name: sName,
@@ -21560,6 +21591,29 @@ function strandedProfileCredentialsNotice(hostPath) {
 	return `The AWS credentials file mounted into the containers is NOT removed: delete ${displayIdent(hostPath)} once you tear them down.`;
 }
 
+//#endregion
+//#region src/local/dynamic-reference.ts
+function createCallerDynamicReferenceResolver(profile) {
+	return new DynamicReferenceResolver({
+		secretsManagerClientFactory: (region) => new SecretsManagerClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...region && { region: canonicalizeRegion(region) },
+			...profile && { profile }
+		}),
+		ssmClientFactory: (region) => new SSMClient({
+			...awsClientDefaults({
+				profile,
+				ignoreAssumedRole: true
+			}),
+			...region && { region: canonicalizeRegion(region) },
+			...profile && { profile }
+		})
+	});
+}
+
 //#endregion
 //#region src/local/websocket-body.ts
 function bufferToBody$1(raw, isBinary) {
@@ -21966,6 +22020,7 @@ function createContainerPool(specs, options) {
 				}],
 				extraMounts,
 				env: spec.env,
+				...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 				cmd: [spec.lambda.handler],
 				hostPort,
 				host: spec.containerHost,
@@ -21984,6 +22039,7 @@ function createContainerPool(specs, options) {
 				readOnly: true
 			}] },
 			env: spec.env,
+			...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 			cmd: spec.command,
 			hostPort,
 			host: spec.containerHost,
@@ -22376,7 +22432,8 @@ async function localStartApiCommand(target, options) {
 				skipPull: options.pull === false,
 				...options.layerRoleArn !== void 0 && { layerRoleArn: options.layerRoleArn },
 				...profileCredentials && { profileCredentials },
-				...profileCredsFile && { profileCredsFile }
+				...profileCredsFile && { profileCredsFile },
+				...dynamicReferenceSpecOptions(options)
 			});
 			specs.set(logicalId, spec);
 		}
@@ -22800,8 +22857,14 @@ function assumeRolePin(logicalId) {
 function malformedAutoRoleError(logicalId, detail) {
 	return /* @__PURE__ */ new Error(`--assume-role-auto: ${detail}. Refusing to start rather than fall back to your shell credentials for this Lambda. Fix the deployed role ARN, or pin one explicitly with ${assumeRolePin(logicalId)}.`);
 }
+function dynamicReferenceSpecOptions(options) {
+	return {
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegionOverride: options.stackRegion }
+	};
+}
 async function buildContainerSpec(args) {
-	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile } = args;
+	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile, profile, stackRegionOverride } = args;
 	const lambda = resolveLambdaByLogicalId(logicalId, stacks);
 	let codeDir;
 	let optDir;
@@ -22834,6 +22897,22 @@ async function buildContainerSpec(args) {
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? logicalId;
 		getLogger().warn(`Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}) or pass --from-state to recover deployed values.`);
 	}
+	const plaintextKeys = new Set(stateAudit?.sensitiveKeys ?? []);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamicRefs = createCallerDynamicReferenceResolver(profile);
+	let dynamic;
+	try {
+		dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+			region: firstUsableRegion(stateBundle?.region, stackRegionOverride, lambda.stack.region, stsRegion),
+			label: `Lambda ${logicalId}`,
+			skipKeys: plaintextKeys,
+			resolver: dynamicRefs
+		});
+	} finally {
+		dynamicRefs.dispose();
+	}
+	const sensitiveKeyList = [...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys];
+	const sensitiveEnvKeys = sensitiveKeyList.length > 0 ? new Set(sensitiveKeyList) : void 0;
 	const dockerEnv = {
 		AWS_LAMBDA_FUNCTION_NAME: logicalId,
 		AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
@@ -22841,7 +22920,7 @@ async function buildContainerSpec(args) {
 		AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 		AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${logicalId}`,
 		AWS_LAMBDA_LOG_STREAM_NAME: "local",
-		...envResult.resolved
+		...dynamic.env
 	};
 	const roleArn = resolveStartApiAssumeRoleArn({
 		logicalId,
@@ -22879,6 +22958,7 @@ async function buildContainerSpec(args) {
 		codeDir,
 		platform,
 		env: dockerEnv,
+		...sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys },
 		containerHost,
 		...optDir !== void 0 && { optDir },
 		...debugPort !== void 0 && { debugPort },
@@ -22897,6 +22977,7 @@ async function buildContainerSpec(args) {
 		...lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		env: dockerEnv,
+		...sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys },
 		containerHost,
 		...debugPort !== void 0 && { debugPort },
 		...tmpfs !== void 0 && { tmpfs },
@@ -23328,13 +23409,16 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options)
 		try {
 			const loaded = await provider.load(stack.stackName, stack.region);
 			if (!loaded) continue;
-			const bundle = { state: {
-				version: 1,
-				stackName: stack.stackName,
-				resources: loaded.resources,
-				outputs: loaded.outputs,
-				lastModified: 0
-			} };
+			const bundle = {
+				state: {
+					version: 1,
+					stackName: stack.stackName,
+					resources: loaded.resources,
+					outputs: loaded.outputs,
+					lastModified: 0
+				},
+				region: loaded.region
+			};
 			if (stackHasIntrinsicEnv(stackName)) {
 				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
 				if (pseudo) bundle.pseudoParameters = pseudo;
@@ -23797,10 +23881,24 @@ async function runEcsTask(task, options, state) {
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
 	for (const c of task.containers) {
-		const refusal = finchSecretArgvRefusal(c.secrets.map((s) => s.name).filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
+		const refusal = finchSecretArgvRefusal([
+			...c.secrets.map((s) => s.name),
+			...c.resolvedDynamicReferenceKeys ?? [],
+			...dynamicReferenceEnvKeys(c, options.envOverrides)
+		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
 		if (refusal !== void 0) finchRefusals.push(refusal);
 	}
 	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
+	const argvRefusals = [];
+	for (const c of task.containers) {
+		const fields = [
+			["Command", c.command],
+			["EntryPoint", c.entryPoint],
+			["HealthCheck.Command", c.healthCheck?.command]
+		];
+		for (const [field, argv] of fields) if (argv?.some((a) => containsDynamicReference(a))) argvRefusals.push(`Container ${displayIdent(c.name)}: ${field} carries a CloudFormation dynamic reference ({{resolve:...}}). cdkd resolves dynamic references only in Environment, because resolving one here would put the secret on the docker run argv. Move the value into an Environment variable or a Secrets entry.`);
+	}
+	if (argvRefusals.length > 0) throw new EcsTaskRunnerError(argvRefusals.join("\n"));
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
@@ -23810,6 +23908,22 @@ async function runEcsTask(task, options, state) {
 		valueFrom: s.valueFrom
 	});
 	const secretsByContainer = groupSecretsByContainer(await resolveEcsSecrets(allSecrets, { ...options.region !== void 0 && { region: options.region } }));
+	const dynamicEnvByContainer = /* @__PURE__ */ new Map();
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		for (const c of task.containers) {
+			const tokenKeys = new Set(dynamicReferenceEnvKeys(c, options.envOverrides));
+			if (tokenKeys.size === 0) continue;
+			dynamicEnvByContainer.set(c.name, await resolveDynamicReferencesInEnv(c.environment, {
+				region: firstUsableRegion(options.stateRecordRegion, options.stackRegion, task.stack.region, options.region),
+				label: `Container ${c.name}`,
+				skipKeys: new Set(Object.keys(c.environment).filter((k) => !tokenKeys.has(k))),
+				resolver: dynamicRefs
+			}));
+		}
+	} finally {
+		dynamicRefs.dispose();
+	}
 	if (options.existingNetwork) state.network = {
 		...options.existingNetwork,
 		ownedByCaller: true
@@ -23853,9 +23967,14 @@ async function runEcsTask(task, options, state) {
 	for (const container of task.containers) {
 		const image = imagePlan.get(container.name);
 		if (!image) throw new EcsTaskRunnerError(`Internal: no resolved image for container '${container.name}'.`);
+		const dynamic = dynamicEnvByContainer.get(container.name);
 		const built = buildDockerRunArgs({
 			task,
-			container,
+			container: dynamic ? {
+				...container,
+				environment: dynamic.env
+			} : container,
+			plaintextEnvKeys: [...container.resolvedDynamicReferenceKeys ?? [], ...dynamic?.resolvedKeys ?? []],
 			image,
 			network: state.network.networkName,
 			volumeByName,
@@ -24175,6 +24294,19 @@ async function realizeDockerVolumes(volumes, state) {
 function randHex(bytes) {
 	return randomBytes(bytes).toString("hex");
 }
+function overriddenEnvKeys(overrides, containerName) {
+	if (!overrides) return [];
+	const applied = (map) => Object.entries(map ?? {}).filter(([, v]) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean").map(([k]) => k);
+	return [...applied(overrides["Parameters"]), ...applied(overrides[containerName])];
+}
+function dynamicReferenceEnvKeys(container, overrides) {
+	const skip = /* @__PURE__ */ new Set([
+		...container.resolvedDynamicReferenceKeys ?? [],
+		...container.secrets.map((s) => s.name),
+		...overriddenEnvKeys(overrides, container.name)
+	]);
+	return Object.keys(container.environment).filter((k) => !skip.has(k) && containsDynamicReference(container.environment[k]));
+}
 function groupSecretsByContainer(resolved) {
 	const out = /* @__PURE__ */ new Map();
 	for (const r of resolved) {
@@ -24242,7 +24374,11 @@ function buildDockerRunArgs(opts) {
 		applyOverrideMap(finalEnv, overrides["Parameters"]);
 		applyOverrideMap(finalEnv, overrides[container.name]);
 	}
-	const sensitiveKeys = /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]);
+	const sensitiveKeys = /* @__PURE__ */ new Set([
+		...SENSITIVE_ENV_KEYS,
+		...secrets.map((s) => s.name),
+		...opts.plaintextEnvKeys ?? []
+	]);
 	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys);
 	args.push(...flags);
 	if (container.user) args.push("--user", container.user);
@@ -24362,13 +24498,23 @@ async function localRunTaskCommand(target, options) {
 			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) {
+				const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
 				const subContext = {
 					resources: imageContext?.stateResources ?? {},
 					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
 					consumerRegion,
-					crossStackResolver: resolver
+					crossStackResolver: resolver,
+					resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+						region: producerRegion,
+						consumer: `Task ${task.taskDefinitionLogicalId} cross-stack env value`,
+						overridable: false
+					})
 				};
-				await applyCrossStackResolverToTask(task, subContext);
+				try {
+					await applyCrossStackResolverToTask(task, subContext);
+				} finally {
+					dynamicRefs.dispose();
+				}
 			}
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state.");
 		sigintHandler = () => {
@@ -24403,7 +24549,8 @@ async function localRunTaskCommand(target, options) {
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
 		const runOpts = buildRunEcsTaskOptions(options, channels, {
 			...envOverrides !== void 0 && { envOverrides },
-			...resolvedRoleArn !== void 0 && { resolvedRoleArn }
+			...resolvedRoleArn !== void 0 && { resolvedRoleArn },
+			...stateRecordRegion !== void 0 && { stateRecordRegion }
 		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
@@ -24621,6 +24768,9 @@ function buildRunEcsTaskOptions(options, channels, extra = {}) {
 	if (extra.resolvedRoleArn) runOpts.taskRoleArn = extra.resolvedRoleArn;
 	if (options.platform) runOpts.platformOverride = options.platform;
 	if (options.region) runOpts.region = options.region;
+	if (options.stackRegion) runOpts.stackRegion = options.stackRegion;
+	if (options.profile) runOpts.profile = options.profile;
+	if (extra.stateRecordRegion) runOpts.stateRecordRegion = extra.stateRecordRegion;
 	if (options.ecrRoleArn !== void 0) runOpts.ecrRoleArn = options.ecrRoleArn;
 	if (channels.profileCredsFile) runOpts.profileCredentialsFile = {
 		hostPath: channels.profileCredsFile.hostPath,
@@ -24662,7 +24812,11 @@ function createLocalStartServiceCommand() {
 		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
-	warnEngineRoleExposure(cmd, "start-service", [ENGINE_ECS_SECRETS_CHANNEL, ENGINE_ACCOUNT_ID_CHANNEL]);
+	warnEngineRoleExposure(cmd, "start-service", [
+		ENGINE_ECS_SECRETS_CHANNEL,
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
+	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
@@ -25475,13 +25629,28 @@ function findFileAssetByObjectKey(fileAssets, hash) {
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
 async function buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext) {
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		return await buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs) {
 	const logger = getLogger();
-	let templateEnv = resolved.environmentVariables;
+	const overrides = readEnvOverridesFile$1(options.envVars);
+	const cdkPath = readCdkPathOrUndefined(resolved.resource);
+	const overriddenKeys = keysOverriddenBy(resolved.environmentVariables, (env) => resolveEnvVars(resolved.logicalId, cdkPath, env, overrides).resolved);
+	let templateEnv = withoutKeys(resolved.environmentVariables, overriddenKeys);
 	const sensitiveEnvKeys = /* @__PURE__ */ new Set();
 	if (stateProvider && loaded) {
 		const subContext = {
 			resources: imageContext?.stateResources ?? loaded.resources,
-			consumerRegion: loaded.region
+			consumerRegion: loaded.region,
+			resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+				region: producerRegion,
+				consumer: `AgentCore Runtime ${resolved.logicalId} cross-stack env value`
+			})
 		};
 		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 		if (pseudo) subContext.pseudoParameters = pseudo;
@@ -25495,14 +25664,21 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 		for (const key of audit.sensitiveKeys) sensitiveEnvKeys.add(key);
 		for (const { key, reason } of audit.unresolved) logger.warn(`${stateProvider.label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
-	const overrides = readEnvOverridesFile$1(options.envVars);
-	const cdkPath = readCdkPathOrUndefined(resolved.resource);
 	const envResult = resolveEnvVars(resolved.logicalId, cdkPath, templateEnv, overrides);
 	for (const key of envResult.unresolved) {
 		const overrideKeyExample = cdkPath?.replace(/\/Resource$/, "") ?? resolved.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack) to recover deployed values.`);
 	}
-	const dockerEnv = { ...envResult.resolved };
+	const skipKeys = keysNotFromTemplate(templateEnv, envResult.resolved);
+	for (const key of sensitiveEnvKeys) skipKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(loaded?.region, options.stackRegion, resolved.stack.region, options.region),
+		label: `AgentCore Runtime ${resolved.logicalId}`,
+		skipKeys,
+		resolver: dynamicRefs
+	});
+	for (const key of dynamic.resolvedKeys) sensitiveEnvKeys.add(key);
+	const dockerEnv = { ...dynamic.env };
 	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
 	await applyAgentCoreCredentialEnv(dockerEnv, {
 		...assumeRoleArn !== void 0 && { assumeRoleArn },
@@ -25844,7 +26020,11 @@ function createLocalStartAgentCoreCommand$1() {
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
-	warnEngineRoleExposure(cmd, "start-agentcore", [engineCredentialTripleChannel("the agent container"), ENGINE_ACCOUNT_ID_CHANNEL]);
+	warnEngineRoleExposure(cmd, "start-agentcore", [
+		engineCredentialTripleChannel("the agent container"),
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
+	]);
 	return adoptDeprecatedRegionFlag(cmd);
 }
 
@@ -25890,7 +26070,8 @@ function createLocalStartAlbCommand() {
 	warnEngineRoleExposure(cmd, "start-alb", [
 		engineCredentialTripleChannel("the ALB's Lambda target-group containers"),
 		ENGINE_ECS_SECRETS_CHANNEL,
-		ENGINE_ACCOUNT_ID_CHANNEL
+		ENGINE_ACCOUNT_ID_CHANNEL,
+		ENGINE_DYNAMIC_REFERENCE_CHANNEL
 	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
@@ -25907,7 +26088,7 @@ function createLocalStartCloudFrontCommand$1() {
 	cmd.addOption(new Option("--state-prefix <prefix>", "[not supported on start-cloudfront] S3 key prefix for --from-state state files. Refused at startup with --from-state.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
 	refuseUnwiredCdkdStateFlags(cmd);
-	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers")], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
+	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers"), ENGINE_DYNAMIC_REFERENCE_CHANNEL], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
 	return adoptDeprecatedRegionFlag(cmd);
 }
 function refuseUnwiredCdkdStateFlags(cmd) {
@@ -26024,50 +26205,7 @@ async function localInvokeCommand(target, options) {
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
 		logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
 		imagePlan = await resolveImagePlan(lambda, options);
-		let stateAudit;
-		let templateEnv = getTemplateEnv(lambda.resource);
-		let stateForRoleHint;
-		const stateProvider = createLocalStateProvider$1(options, lambda.stack.stackName, lambda.stack.region);
-		if (stateProvider) try {
-			const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
-			if (loaded) {
-				stateForRoleHint = {
-					version: 1,
-					stackName: lambda.stack.stackName,
-					resources: loaded.resources,
-					outputs: loaded.outputs,
-					lastModified: 0
-				};
-				const subContext = {
-					resources: loaded.resources,
-					consumerRegion: loaded.region
-				};
-				if (envHasIntrinsicValue(templateEnv)) {
-					const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
-					if (pseudo) subContext.pseudoParameters = pseudo;
-				}
-				if (envHasCrossStackIntrinsic(templateEnv)) {
-					const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
-					if (resolver) subContext.crossStackResolver = resolver;
-				}
-				const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
-				templateEnv = env;
-				stateAudit = audit;
-				const label = stateProvider.label;
-				for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
-				for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
-			}
-		} finally {
-			stateProvider.dispose();
-		}
-		const overrides = readEnvOverridesFile(options.envVars);
-		const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
-		const envResult = resolveEnvVars(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
-		for (const key of envResult.unresolved) {
-			if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
-			const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
-			logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass --from-state (cdkd-deployed) / --from-cfn-stack (cdk-deployed) to recover deployed values.`);
-		}
+		const { env: templateEnvResolved, sensitiveEnvKeys, stateForRoleHint } = await resolveInvokeTemplateEnv(lambda, options);
 		let resolvedAssumeRoleArn;
 		if (typeof options.assumeRole === "string") resolvedAssumeRoleArn = explicitRoleArnOrThrow("--assume-role", options.assumeRole);
 		else if (options.assumeRole === true) {
@@ -26082,7 +26220,7 @@ async function localInvokeCommand(target, options) {
 			AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 			AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${lambda.logicalId}`,
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
-			...envResult.resolved
+			...templateEnvResolved
 		};
 		await applyLambdaCredentialEnv(dockerEnv, {
 			...resolvedAssumeRoleArn && { assumeRoleArn: resolvedAssumeRoleArn },
@@ -26112,6 +26250,7 @@ async function localInvokeCommand(target, options) {
 			mounts: imagePlan.mounts,
 			extraMounts: extraMountsWithProfile,
 			env: dockerEnv,
+			...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys },
 			...hostGatewayExtraHosts.length > 0 && { extraHosts: hostGatewayExtraHosts },
 			cmd: imagePlan.cmd,
 			hostPort,
@@ -26139,6 +26278,82 @@ async function localInvokeCommand(target, options) {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 	}
 }
+async function resolveInvokeTemplateEnv(lambda, options) {
+	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
+	try {
+		return await resolveInvokeTemplateEnvWith(lambda, options, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function resolveInvokeTemplateEnvWith(lambda, options, dynamicRefs) {
+	const logger = getLogger();
+	let stateAudit;
+	let stateForRoleHint;
+	let ownerRegion;
+	const declaredEnv = getTemplateEnv(lambda.resource);
+	const overrides = readEnvOverridesFile(options.envVars);
+	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
+	const overriddenKeys = keysOverriddenBy(declaredEnv, (env) => resolveEnvVars(lambda.logicalId, lambdaCdkPath, env, overrides).resolved);
+	let templateEnv = declaredEnv && withoutKeys(declaredEnv, overriddenKeys);
+	const stateProvider = createLocalStateProvider$1(options, lambda.stack.stackName, lambda.stack.region);
+	if (stateProvider) try {
+		const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
+		if (loaded) {
+			ownerRegion = loaded.region;
+			stateForRoleHint = {
+				version: 1,
+				stackName: lambda.stack.stackName,
+				resources: loaded.resources,
+				outputs: loaded.outputs,
+				lastModified: 0
+			};
+			const subContext = {
+				resources: loaded.resources,
+				consumerRegion: loaded.region,
+				resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+					region: producerRegion,
+					consumer: `Lambda ${lambda.logicalId} cross-stack env value`
+				})
+			};
+			if (envHasIntrinsicValue(templateEnv)) {
+				const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
+				if (pseudo) subContext.pseudoParameters = pseudo;
+			}
+			if (envHasCrossStackIntrinsic(templateEnv)) {
+				const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
+				if (resolver) subContext.crossStackResolver = resolver;
+			}
+			const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
+			templateEnv = env;
+			stateAudit = audit;
+			const label = stateProvider.label;
+			for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
+			for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		}
+	} finally {
+		stateProvider.dispose();
+	}
+	const envResult = resolveEnvVars(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
+	for (const key of envResult.unresolved) {
+		if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
+		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
+		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass --from-state (cdkd-deployed) / --from-cfn-stack (cdk-deployed) to recover deployed values.`);
+	}
+	const plaintextKeys = new Set(stateAudit?.sensitiveKeys ?? []);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(ownerRegion, options.stackRegion, lambda.stack.region, options.region),
+		label: `Lambda ${lambda.logicalId}`,
+		skipKeys: plaintextKeys,
+		resolver: dynamicRefs
+	});
+	return {
+		env: dynamic.env,
+		sensitiveEnvKeys: /* @__PURE__ */ new Set([...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys]),
+		...stateForRoleHint !== void 0 && { stateForRoleHint }
+	};
+}
 async function resolveImagePlan(lambda, options) {
 	if (lambda.kind === "zip") return resolveZipImagePlan(lambda, options);
 	return resolveContainerImagePlan(lambda, options);
@@ -26612,4 +26827,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CiMVZi4n.js.map
+//# sourceMappingURL=program-CwSdIG3b.js.map