@go-to-k/cdkd 0.296.25 → 0.296.27

package/dist/{program-GmKPVK8p.js → program-BwNb3_Ot.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
+import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as green, $a as describeTypeWithThrottleRetry, $i as refuseMalformedResourceAttributesForOrphan, $o as TEMPLATE_SOURCED_RULES, $r as carriesDynamicReference, $s as runDockerStreaming, $t as updatePartialReason, A as readProtection, Aa as findReplacedReadersOfRecreateTargets, Ac as derivePartitionAndUrlSuffix, Ai as malformedOrphanRecordsRefusalMessage, An as collectPublishedOutputNames, Ao as maskSecretsInError, Ar as producerRegionsFromState, As as ensureAssetStorage, At as destroyStackRecordsView, Bc as describeFileReadFailure, Bi as malformedResourcesWarning, Bo as inheritNestedStackParameterAssociations, Br as callerEnvCredentials, Bs as describeDockerCapturedOutput, Bt as recheckFailedPlan, C as noEchoComparisonForTemplate, Ca as withheldAccountClause, Cc as findLargeInlineResources, Ci as isReadableResourceEntry, Cn as secretSafeKeyDisplay, Co as logOnlyValueCount, Cs as buildAssetRedirectMap, Ct as journaledOrphanLines, D as PROTECTION_PROPERTY_BY_TYPE, Dc as expectedOwnerParam, Di as malformedLocalOutputsWarning, Dn as isWholeDynamicReferenceValue, Do as shareLogOnlyValues, Dr as IntrinsicFunctionResolver, Ds as AssetModeResolver, Dt as replayFailedOperations, E as recordedProtectionNote, Ea as unwrittenCreateOnlyReplacement, Ec as decodeListingKey, Ei as malformedExportSourceWarning, En as exportNameSecretExposure, Eo as recordLogOnlyValue, Er as INTRINSIC_KEYS, Es as rewriteTemplateAssetReferences, Et as sameJournaledOrphans, Fa as renderStatefulReason, Fc as hasOwnKey, Fi as malformedOutputsRefusalMessage, Fn as maskingRetryLogger, Fo as DYNAMIC_REFERENCE_TOKEN_SCAN, Fr as explicitRoleArnOrThrow, Fs as validateAssetBucketName, Ft as demoteSupersededOrphans, Gc as resolveBucketRegion, Go as recordMaskOnlyValue, Gs as formatDockerLoginError, Gt as findNestedStackTypeChanges, Hc as renderAssemblyPathEscape, Hi as malformedStateRefusalMessage, Hs as describeDockerFailure, Ht as replacementNeverSwapped, Ic as hasPlainPrototype, Ii as malformedOutputsWarning, In as constructPathOf, Io as dynamicReferenceTokens, Ir as isIamRoleArn, Is as validateContainerRepoName, It as isJournaledOrphan, J as formatResourceLine, Ji as refuseMalformedOrphans, Jo as recordProvenPublicExpression, Jr as coerceParameterTypedValue, Js as isMalformedEnvKey, Ki as refuseMalformedOrphanRecords, Ko as recordMaskOnlyValuesIn, Ks as getDockerCmd, Lc as nullPrototypeRecord, Li as malformedRenderedContainersWarning, Ln as findDestructiveChanges, Lo as isUncertifiedBaselineMaskPosition, Lr as sendableAssumeRoleCommand, Ls as buildDenyExternalAccessPolicy, Lt as isReplacementOrphan, Ma as MULTI_REGION_RECREATE_BLOCKED_TYPES, Mc as StageLoadError, Mi as malformedOrphanRowsKeptWarning, Mn as bindingSkippedOutputs, Mo as markSameGenerationBag, Mr as applyRoleArnIfSet, Ms as isCrossRegionRedirect, Mt as withStackRecords, Na as isStatefulRecreateTargetForReplace, Nc as processStackMessages, Ni as malformedOrphansRefusalMessage, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as redactSecretsForState, Nr as assertFlagRoleArn, Ns as parseBootstrapMarker, Nt as removeProtectionTypeList, O as isProtectionValueActive, Oa as NO_CC_HANDLERS_REASON, Oc as PARTITION_TABLE, Oi as malformedLocalResourceEntriesWarning, On as noEchoParameterValueSeed, Oo as createSecretMasker, Or as poisonRenderedSpellingsCollidingIn, Os as BOOTSTRAP_MARKER_PREFIX, Ot as replayRollback, Pa as isStatefulRecreateTargetSync, Pc as defineOwnKey, Pi as malformedOrphansWarning, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as scrubResourceRecord, Pr as assertSendableRoleArn, Ps as readBootstrapMarkerBody, Pt as recordAfterRollbackUpdate, Q as gray, Qa as templateResourceTypes, Qi as refuseMalformedOutputsForDestroy, Qo as STATE_SOURCED_READBACK_RULES, Qr as isImpossibleEmptyStoredAttribute, Qs as runDockerForeground, Qt as updatePartialMessage, Rc as ownValue, Ri as malformedResourceEntriesWarning, Rn as formatDestructiveChange, Ro as pathCrossesDottedKey, Rr as AWS_CREDENTIAL_ENV_KEYS, Rs as buildDockerImage, Rt as planFailedOps, S as noEchoAttributeNamesOf, Sa as unreadableResourceEntries, Sc as MIGRATE_TMP_PREFIX, Si as isReadableOrphanRecord, Sn as secretBearingStateKeyWarning, So as literalSplitDelimitersOf, Ss as WorkGraph, St as isHandledOrphan, T as recordedProtectionEvidence, Tc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ti as malformedExportNamesWarning, Tn as exportNameNoEchoParameters, To as recordLogOnlyParameterValue, Tr as DiffCalculator, Ts as loadPublishableAssetManifest, Tt as makeForeignHolderScan, Uc as resolveAssemblyPath, Ui as previewableOrphanRecords, Un as withCreateTokenLedger, Uo as carriesSecretMask, Us as dockerSpawnEnvWithSensitive, Ut as resolveReplacementOldType, Vc as displayAssemblyPath, Vi as malformedScrubResourceEntriesRefusalMessage, Vn as ledgerForStack, Vo as recordNestedStackParameterExpressions, Vr as envCredentialsAreAssumedRole, Vs as describeDockerExecFailure, Vt as recordUnderIdIsNotOwn, Wi as refuseDivergentRecordRegionForDestroy, Wo as provenPublicValue, Ws as finchSecretArgvRefusal, Wt as orphanDeleteNeedsIdentity, X as bold, Xi as refuseMalformedOrphansForOrphan, Xo as STATE_SOURCED_BASELINE_RULES, Xr as parameterTypeMayLoseSecretIdentity, Xs as redactDockerArgvValues, Y as createReadOnlyAttributeHealerFactory, Yi as refuseMalformedOrphansForDestroy, Yo as wholeStringLeavesOf, Yr as isUnboundTemplateParameter, Ys as partitionSensitiveEnv, Z as cyan, Za as prefetchCreateOnlyPropertyPaths, Zi as refuseMalformedOutputs, Zo as STATE_SOURCED_CROSS_GENERATION_RULES, Zr as getAccountInfo, Zs as redactedDockerCause, _ as makeCanonicalizePropertiesFn, _a as repairMalformedResourceEntriesForReadOnly, _c as stateBucketExistenceConfirmed, _i as deployRefusesOrphanRowsReason, _n as extractDeploymentEventError, _o as valueAtCoordinate, _r as isWaitAbandonedError, _s as orphansCarriedFrom, _t as withNestedRevertRun, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForOrphan, ac as Synthesizer, ai as isStalePlaceholderArnAttribute, an as stateSecretNameNeedles, ao as TemplateParser, ar as TemplateNoEchoReresolver, as as rebuildClientForBucketRegion, at as resourcesNamingDeclaredParameter, b as serviceTokenBlockingReason, ba as unpreviewableOrphanRecords, bc as CFN_TEMPLATE_BODY_LIMIT, bi as hasReadableOutputs, bn as exportAliasCollisionScrubWarning, bo as createUnionSecretMasker, bs as isSensitiveAttributeName, bt as deleteJournaledOrphans, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForExport, cc as getLegacyStateBucketName, ci as withSharedDrainBudget, cn as buildFinalSnapshotIdentifier, co as maskAtCoordinates, cs as describeRegionValueKind, ct as NESTED_PENDING_PARENT_REASON, d as conditionInputsFrom, da as refuseMalformedResourcesForDestroy, dc as resolveAutoAssetStorage, di as JSON_LISTING_HOLE_VALUE, dn as effectiveDeletionPolicy, do as maskedLeafCoordinatesOf, dr as slowCcOperationTimeoutMs, ds as hasReasonlessBaselineRefusal, dt as dropSettledNestedJournals, ea as refuseMalformedResourceEntries, ec as warnFinchArgvExposure, ei as carriesFetchableDynamicReference, en as completedReplayEntries, eo as withRetry, er as CC_BROKEN_REASON, es as WHOLE_DYNAMIC_REFERENCE_PATTERN, et as red, f as parentSuppliedValues, fa as refuseMalformedResourcesForExport, fc as resolveCaptureObservedState, fi as STATE_REGION_DIVERGED, fn as isFinalSnapshotError, fo as noEchoLeavesOf, fs as hasUnverifiableParameterRefusal, g as mergeNoChangeOutputs, ga as repairMalformedOutputsForReadOnly, gc as resolveUseCdkBootstrapAssets, gi as accountArgs, gn as DeploymentEventsStore, go as readsNoEchoSource, gs as orphansAfterRollback, gt as revertedNestedRowIds, h as keptWholeReasonText, ha as repairMalformedOrphansForReadOnly, hc as resolveStateBucketWithDefaultAndSource, hi as UNREADABLE_RESOURCES_MAP_ROW, hn as DeploymentEventsReader, ho as readbackPathFor, hr as deleteSkipReason, hs as isReadableBag, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForImportSave, ic as getDockerImageBySourceHash, ii as cfnRefValueFromPhysicalId, in as secretNamePrintingBag, io as DagBuilder, ir as wouldReturnToSdkProvider, is as S3StateBackend, it as reachableDivergentParameters, ja as shownType, jc as AssemblyReader, ji as malformedOrphanRecordsWarning, jn as isExportAliasCollision, jo as maskSecretsInText, jr as regionLessSecretName, js as getBootstrapMarkerKey, k as perType, ka as hasNoCloudControlHandlers, kc as canonicalizeRegion, ki as malformedLocalResourcesWarning, kn as collectDeclaredOutputNames, ko as errorCauseChain, kr as classifyReplaySecretRegion, ks as assertAssetBucketRegion, l as templateIdentity, la as refuseMalformedResourcePropertiesForOrphan, lc as loadCdkJson, li as parameterInputsFor, ln as ccRoutedFinalSnapshotError, lo as maskReadbackAtCoordinates, lr as withPrintingSecrets, ls as exportNamesCarriedFrom, lt as displacedOpClause, m as isSecretBearingReferenceString, ma as repairMalformedOrphanRecordsForReadOnly, mc as resolveStateBucketWithDefault, mi as UNREADABLE_ORPHANS_CONTAINER_ROW, mn as unsupportedFinalSnapshotError, mr as deleteIndeterminateGuards, ms as importableOutputs, mt as recordDisplacedSkips, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntriesForDestroy, nc as stripControlChars, ni as keepsSecretReferenceToken, nn as maskEventTextWithBoundBags, nr as ccBrokenReason, ns as LockManager, nt as computeParameterTaint, o as isAbsoluteAssetPath, oa as refuseMalformedResourcePropertiesForDestroy, oc as synthesisStatusMessage, oi as refStateLookupFromResource, on as ATOMIC_FINAL_SNAPSHOT_TYPES, oo as canonicalCoordinates, or as readsNoEchoDeleteValues, os as splitImportedOps, ot as makeSiblingClaimReader, p as readRecordedConditionVerdicts, pa as refuseMalformedState, pc as resolveSkipPrefix, pi as STATE_RESOURCES_MALFORMED, pn as refusesFinalSnapshot, po as noEchoOutputsComparison, pr as UNSPECIFIED_SKIP_REASON, ps as importableOutputKeys, pt as nestedChildStackName$1, qi as refuseMalformedOrphanRecordsForDestroy, qo as recordNoEchoAttributeValues, qs as isDockerClientEnvKey, qt as inheritProducerRegions, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForImport, rc as AssetManifestLoader, ri as AWS_NO_VALUE, rn as orphanRecordsPrintingBag, rr as isCustomResource, rs as isLockInfoExpired, rt as namesAnyDeclaredParameter, s as listNestedTemplateRows, sa as refuseMalformedResourcePropertiesForDrift, sc as getDefaultStateBucketName, sn as PRE_DELETE_SNAPSHOT_TYPES, so as isMarkedCoordinate, sr as isCustomResourceType$1, ss as acceptedCreateOnlyDropsOf, st as planOrphanAdoption, t as DeployEngine, ta as refuseMalformedResourceEntriesForDeploy, tc as escapeRegExp, ti as isNamelessDynamicReferenceError, tn as journaledOrphanPrintingBag, tr as ProviderRegistry, ts as isSingleDynamicReferenceToken, tt as yellow, u as conditionFingerprint, ua as refuseMalformedResourcesForDeploy, uc as resolveApp, un as createPreDeleteFinalSnapshot, uo as maskWholeValue, ur as CloudControlProvider, us as hasReadableExportSet, ut as displacedPhysicalIdShown, v as deferredServiceTokenWarning, va as repairMalformedResourcePropertiesForReadOnly, vc as warnDeprecatedNoPrefixCliFlag, vi as displayLogicalId, vn as WITHHELD_NAME_DISPLAY, vo as liveMatchesUnresolvedTokenFrame, vs as shouldRetainResource, w as noEchoParameterNamesOf, wa as findActionableSilentDrops, wc as uploadCfnTemplate, wi as malformedDriftResourcePropertiesWarning, wn as carriedExportAliasExposure, wo as printingCorpusOf, ws as createAssetRedirectResolver, wt as loadJournaledOrphans, x as withResourceDeadline, xa as unreadableOrphanRecords, xc as CFN_TEMPLATE_URL_LIMIT, xi as hasReadableResources, xn as secretBearing, xo as hasMaskableValues, xs as stringifyValue, xt as dropFailedHint, y as findServiceTokenRefusals, ya as repairMalformedResourcesForReadOnly, yc as ssmResolvedValueType, yi as hasReadableOrphans, yn as displayTextOrWithheld, yo as carryLogOnlyValues, ys as AssetPublisher, yt as withNestedStackContext, zc as absoluteAssemblyPathEscape, zi as malformedResourcePropertiesWarning, zn as RollbackInlinePolicyWriters, zo as identityKeyFor, zr as applyCallerIdentityCredentials, zs as resolveDockerContextDirectory, zt as planRollback } from "./deploy-engine-Dyj0tnOa.js";
-import { t as getCdkdVersion } from "./version-DImm5uUz.js";
+import { $ as gray, $a as templateResourceTypes, $i as refuseMalformedOutputsForDestroy, $o as STATE_SOURCED_BASELINE_RULES, $r as isImpossibleEmptyStoredAttribute, $s as redactDockerArgvValues, $t as updatePartialMessage, A as perType, Aa as hasNoCloudControlHandlers, Ac as expectedOwnerParam, Ai as malformedLocalResourcesWarning, An as collectDeclaredOutputNames, Ao as createSecretMasker, Ar as classifyReplaySecretRegion, As as AssetModeResolver, Bc as nullPrototypeRecord, Bi as malformedResourcePropertiesWarning, Bn as RollbackInlinePolicyWriters, Bo as pathCrossesDottedKey, Br as applyCallerIdentityCredentials, Bs as buildDenyExternalAccessPolicy, Bt as planRollback, C as noEchoComparisonForTemplate, Ca as unreadableResourceEntries, Cc as CFN_TEMPLATE_BODY_LIMIT, Ci as isReadableOrphanRecord, Cn as secretBearingStateKeyWarning, Co as hasMaskableValues, Cs as isSensitiveAttributeName, Ct as isHandledOrphan, D as recordedProtectionNote, Da as unwrittenCreateOnlyReplacement, Dc as uploadCfnTemplate, Di as malformedExportSourceWarning, Dn as exportNameSecretExposure, Do as recordLogOnlyParameterValue, Dr as INTRINSIC_KEYS, Ds as createAssetRedirectResolver, Dt as sameJournaledOrphans, E as recordedProtectionEvidence, Ec as findLargeInlineResources, Ei as malformedExportNamesWarning, En as exportNameNoEchoParameters, Eo as printingCorpusOf, Er as DiffCalculator, Es as buildAssetRedirectMap, Et as makeForeignHolderScan, Fa as isStatefulRecreateTargetSync, Fc as StageLoadError, Fi as malformedOrphansWarning, Fn as DEFAULT_RESOURCE_WARN_AFTER_MS, Fo as redactSecretsForState, Fr as assertSendableRoleArn, Fs as isCrossRegionRedirect, Ft as recordAfterRollbackUpdate, Gc as renderAssemblyPathEscape, Gi as refuseDivergentRecordRegionForDestroy, Go as carriesSecretMask, Gs as describeDockerFailure, Gt as orphanDeleteNeedsIdentity, Hc as absoluteAssemblyPathEscape, Hi as malformedScrubResourceEntriesRefusalMessage, Hn as ledgerForStack, Ho as inheritNestedStackParameterAssociations, Hr as envCredentialsAreAssumedRole, Hs as resolveDockerContextDirectory, Ht as recordUnderIdIsNotOwn, Ia as renderStatefulReason, Ic as processStackMessages, Ii as malformedOutputsRefusalMessage, In as maskingRetryLogger, Io as scrubResourceRecord, Ir as explicitRoleArnOrThrow, Is as parseBootstrapMarker, It as demoteSupersededOrphans, Jc as resolveBucketRegion, Ji as refuseMalformedOrphanRecordsForDestroy, Jo as recordMaskOnlyValuesIn, Js as formatDockerLoginError, Jt as inheritProducerRegions, Kc as resolveAssemblyPath, Ko as provenPublicValue, Ks as dockerSpawnEnvWithSensitive, Kt as findNestedStackTypeChanges, Lc as defineOwnKey, Li as malformedOutputsWarning, Ln as constructPathOf, Lo as DYNAMIC_REFERENCE_TOKEN_SCAN, Lr as isIamRoleArn, Ls as readBootstrapMarkerBody, Lt as isJournaledOrphan, Ma as shownType, Mc as canonicalizeRegion, Mi as malformedOrphanRecordsWarning, Mn as isExportAliasCollision, Mo as maskSecretsInError, Mr as regionLessSecretName, Ms as assertAssetBucketRegion, Na as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nc as derivePartitionAndUrlSuffix, Ni as malformedOrphanRowsKeptWarning, Nn as bindingSkippedOutputs, No as maskSecretsInText, Nr as applyRoleArnIfSet, Ns as ensureAssetStorage, Nt as withStackRecords, O as PROTECTION_PROPERTY_BY_TYPE, Oc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Oi as malformedLocalOutputsWarning, On as isWholeDynamicReferenceValue, Oo as recordLogOnlyValue, Or as IntrinsicFunctionResolver, Os as loadPublishableAssetManifest, Ot as replayFailedOperations, Pa as isStatefulRecreateTargetForReplace, Pc as AssemblyReader, Pi as malformedOrphansRefusalMessage, Pn as DEFAULT_RESOURCE_TIMEOUT_MS, Po as markSameGenerationBag, Pr as assertFlagRoleArn, Ps as getBootstrapMarkerKey, Pt as removeProtectionTypeList, Q as cyan, Qa as prefetchCreateOnlyPropertyPaths, Qi as refuseMalformedOutputs, Qo as wholeStringLeavesOf, Qr as getAccountInfo, Qs as partitionSensitiveEnv, Rc as hasOwnKey, Ri as malformedRenderedContainersWarning, Rn as findDestructiveChanges, Ro as dynamicReferenceTokens, Rr as sendableAssumeRoleCommand, Rs as validateAssetBucketName, Rt as isReplacementOrphan, S as noEchoAttributeNamesOf, Sa as unreadableOrphanRecords, Sc as ssmResolvedValueType, Si as hasReadableResources, Sn as secretBearing, So as createUnionSecretMasker, Ss as AssetPublisher, St as dropFailedHint, T as noEchoParameterNamesOf, Ta as findActionableSilentDrops, Tc as MIGRATE_TMP_PREFIX, Ti as malformedDriftResourcePropertiesWarning, Tn as carriedExportAliasExposure, To as logOnlyValueCount, Ts as WorkGraph, Tt as loadJournaledOrphans, Uc as describeFileReadFailure, Ui as malformedStateRefusalMessage, Uo as recordNestedStackParameterExpressions, Us as describeDockerCapturedOutput, Ut as replacementNeverSwapped, Vc as ownValue, Vi as malformedResourcesWarning, Vo as identityKeyFor, Vr as callerEnvCredentials, Vs as buildDockerImage, Vt as recheckFailedPlan, Wc as displayAssemblyPath, Wi as previewableOrphanRecords, Wn as withCreateTokenLedger, Ws as describeDockerExecFailure, Wt as resolveReplacementOldType, X as createReadOnlyAttributeHealerFactory, Xi as refuseMalformedOrphansForDestroy, Xo as recordNoEchoParameterFreshValue, Xr as isUnboundTemplateParameter, Xs as isDockerClientEnvKey, Y as formatResourceLine, Yi as refuseMalformedOrphans, Yo as recordNoEchoAttributeValues, Yr as coerceParameterTypedValue, Ys as getDockerCmd, Z as bold, Zi as refuseMalformedOrphansForOrphan, Zo as recordProvenPublicExpression, Zr as parameterTypeMayLoseSecretIdentity, Zs as isMalformedEnvKey, _ as makeCanonicalizePropertiesFn, _a as repairMalformedOutputsForReadOnly, _c as resolveStateBucketWithDefault, _i as accountArgs, _n as DeploymentEventsStore, _o as readbackPathFor, _s as importableOutputs, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForImportSave, ac as stripControlChars, ai as cfnRefValueFromPhysicalId, an as secretNamePrintingBag, ao as DagBuilder, ar as wouldReturnToSdkProvider, as as LockManager, at as reachableDivergentParameters, b as serviceTokenBlockingReason, ba as repairMalformedResourcesForReadOnly, bc as stateBucketExistenceConfirmed, bi as hasReadableOrphans, bn as displayTextOrWithheld, bo as liveMatchesUnresolvedTokenFrame, bs as orphansCarriedFrom, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForDrift, cc as Synthesizer, cn as PRE_DELETE_SNAPSHOT_TYPES, co as isMarkedCoordinate, cr as isCustomResourceType$1, cs as rebuildClientForBucketRegion, ct as planOrphanAdoption, d as conditionInputsFrom, da as refuseMalformedResourcesForDeploy, dc as getLegacyStateBucketName, dn as createPreDeleteFinalSnapshot, do as maskWholeValue, dr as CloudControlProvider, ds as describeRegionValueKind, dt as displacedPhysicalIdShown, ea as refuseMalformedResourceAttributesForOrphan, ec as redactedDockerCause, ei as carriesDynamicReference, en as updatePartialReason, eo as describeTypeWithThrottleRetry, es as STATE_SOURCED_CROSS_GENERATION_RULES, et as green, f as parentSuppliedValues, fa as refuseMalformedResourcesForDestroy, fc as loadCdkJson, fi as JSON_LISTING_HOLE_VALUE, fn as effectiveDeletionPolicy, fo as maskedLeafCoordinatesOf, fr as slowCcOperationTimeoutMs, fs as exportNamesCarriedFrom, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, ga as repairMalformedOrphansForReadOnly, gc as resolveSkipPrefix, gi as UNREADABLE_RESOURCES_MAP_ROW, gn as DeploymentEventsReader, gr as deleteSkipReason, gs as importableOutputKeys, h as keptWholeReasonText, ha as repairMalformedOrphanRecordsForReadOnly, hc as resolveCaptureObservedState, hi as UNREADABLE_ORPHANS_CONTAINER_ROW, hn as unsupportedFinalSnapshotError, ho as noEchoOutputsComparison, hr as deleteIndeterminateGuards, hs as hasUnverifiableParameterRefusal, ht as recordDisplacedSkips, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForImport, ic as escapeRegExp, ii as AWS_NO_VALUE, in as orphanRecordsPrintingBag, ir as isCustomResource, is as isSingleDynamicReferenceToken, it as namesAnyDeclaredParameter, j as readProtection, ja as findReplacedReadersOfRecreateTargets, jc as PARTITION_TABLE, ji as malformedOrphanRecordsRefusalMessage, jn as collectPublishedOutputNames, jo as errorCauseChain, jr as producerRegionsFromState, js as BOOTSTRAP_MARKER_PREFIX, jt as destroyStackRecordsView, k as isProtectionValueActive, ka as NO_CC_HANDLERS_REASON, kc as decodeListingKey, ki as malformedLocalResourceEntriesWarning, kn as noEchoParameterValueSeed, ko as shareLogOnlyValues, kr as poisonRenderedSpellingsCollidingIn, ks as rewriteTemplateAssetReferences, kt as replayRollback, l as templateIdentity, la as refuseMalformedResourcePropertiesForExport, lc as synthesisStatusMessage, li as withSharedDrainBudget, ln as buildFinalSnapshotIdentifier, lo as maskAtCoordinates, ls as splitImportedOps, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, ma as refuseMalformedState, mc as resolveAutoAssetStorage, mi as STATE_RESOURCES_MALFORMED, mn as refusesFinalSnapshot, mo as noEchoLeavesOf, mr as UNSPECIFIED_SKIP_REASON, ms as hasReasonlessBaselineRefusal, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntriesForDeploy, nc as runDockerStreaming, ni as isNamelessDynamicReferenceError, nn as journaledOrphanPrintingBag, nr as ProviderRegistry, ns as TEMPLATE_SOURCED_RULES, nt as yellow, o as isAbsoluteAssetPath, oa as refuseMalformedResourceEntriesForOrphan, oc as AssetManifestLoader, oi as isStalePlaceholderArnAttribute, on as stateSecretNameNeedles, oo as TemplateParser, or as TemplateNoEchoReresolver, os as isLockInfoExpired, ot as resourcesNamingDeclaredParameter, p as readRecordedConditionVerdicts, pa as refuseMalformedResourcesForExport, pc as resolveApp, pi as STATE_REGION_DIVERGED, pn as isFinalSnapshotError, po as noEchoCoordinatesOf, ps as hasReadableExportSet, qi as refuseMalformedOrphanRecords, qo as recordMaskOnlyValue, qs as finchSecretArgvRefusal, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForDestroy, rc as warnFinchArgvExposure, ri as keepsSecretReferenceToken, rn as maskEventTextWithBoundBags, rr as ccBrokenReason, rs as WHOLE_DYNAMIC_REFERENCE_PATTERN, rt as computeParameterTaint, s as listNestedTemplateRows, sa as refuseMalformedResourcePropertiesForDestroy, sc as getDockerImageBySourceHash, si as refStateLookupFromResource, sn as ATOMIC_FINAL_SNAPSHOT_TYPES, so as canonicalCoordinates, sr as readsNoEchoDeleteValues, ss as S3StateBackend, st as makeSiblingClaimReader, t as DeployEngine, ta as refuseMalformedResourceEntries, tc as runDockerForeground, ti as carriesFetchableDynamicReference, tn as completedReplayEntries, to as withRetry, tr as CC_BROKEN_REASON, ts as STATE_SOURCED_READBACK_RULES, tt as red, u as conditionFingerprint, ua as refuseMalformedResourcePropertiesForOrphan, uc as getDefaultStateBucketName, ui as parameterInputsFor, un as ccRoutedFinalSnapshotError, uo as maskReadbackAtCoordinates, ur as withPrintingSecrets, us as acceptedCreateOnlyDropsOf, ut as displacedOpClause, v as deferredServiceTokenWarning, va as repairMalformedResourceEntriesForReadOnly, vc as resolveStateBucketWithDefaultAndSource, vi as deployRefusesOrphanRowsReason, vn as extractDeploymentEventError, vo as readsNoEchoSource, vr as isWaitAbandonedError, vs as isReadableBag, vt as withNestedRevertRun, w as noEchoExactEchoLeavesOf, wa as withheldAccountClause, wc as CFN_TEMPLATE_URL_LIMIT, wi as isReadableResourceEntry, wn as secretSafeKeyDisplay, wo as literalSplitDelimitersOf, ws as stringifyValue, wt as journaledOrphanLines, x as withResourceDeadline, xa as unpreviewableOrphanRecords, xc as warnDeprecatedNoPrefixCliFlag, xi as hasReadableOutputs, xn as exportAliasCollisionScrubWarning, xo as carryLogOnlyValues, xs as shouldRetainResource, xt as deleteJournaledOrphans, y as findServiceTokenRefusals, ya as repairMalformedResourcePropertiesForReadOnly, yc as resolveUseCdkBootstrapAssets, yi as displayLogicalId, yn as WITHHELD_NAME_DISPLAY, yo as valueAtCoordinate, ys as orphansAfterRollback, zc as hasPlainPrototype, zi as malformedResourceEntriesWarning, zn as formatDestructiveChange, zo as isUncertifiedBaselineMaskPosition, zr as AWS_CREDENTIAL_ENV_KEYS, zs as validateContainerRepoName, zt as planFailedOps } from "./deploy-engine-DC4Yblxp.js";
+import { t as getCdkdVersion } from "./version-Cs9QbaaH.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -242,7 +242,7 @@ function parsePinCcApiToken(value, previous) {
 }
 const pinCcApiOption = new Option("--pin-cc-api <logicalId>", "Keep the named resource (by CloudFormation logical id) on the Cloud Control route in this deploy, declining the automatic return to the SDK Provider that a type-level sdk-coverage exemption would otherwise apply to a resource recorded as provisionedBy: cc-api. Repeatable — pass the flag once per resource. Has no effect on a resource already on the SDK path, and does not override an exemption admitted because Cloud Control cannot manage the type.").argParser(parsePinCcApiToken);
 const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <logicalId>", "Destroy + recreate the named resource (by CloudFormation logical id) via cdkd's SDK Provider in this deploy, so a resource currently sticky on provisionedBy: cc-api flips back to provisionedBy: sdk. Used after a #609 backfill release adds SDK coverage for a type the user originally needed CC for (e.g. Lambda LoggingConfig). Repeatable — pass the flag once per resource. Per-resource opt-in. Stateful resource types refuse unless --force-stateful-recreation is ALSO passed.").argParser(parseRecreateViaSdkProviderToken);
-const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Confirm a data-losing destroy + recreate of a stateful resource. Required whenever a replacement target is a stateful type on the --recreate-via-cc-api / --recreate-via-sdk-provider pre-flight, with --replace, AND on the paths a plain deploy reaches with no flag: a template immutable-property change, and an in-place update the provisioning layer rejects. Stateful types are databases, filesystems, KMS keys, table / vector storage, source repositories, and more; docs/cli-deploy-safety.md carries the full list. S3 buckets and log groups are the conditional cases: at pre-flight, a non-empty bucket, or a log group with retention, with log streams, or whose emptiness the probe could not settle; mid-deploy, ANY bucket or log group, because the emptiness probe cannot run there. The two probes differ on failure — the bucket fails open, the log group closed. Destroy + recreate loses ALL data in the resource — no automatic data migration. Full opt-in for CI use: --recreate-via-cc-api '<id>' --force-stateful-recreation --yes.").default(false);
+const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Confirm a data-losing destroy + recreate of a stateful resource. Required whenever a replacement target is a stateful type on the --recreate-via-cc-api / --recreate-via-sdk-provider pre-flight, with --replace, AND on the paths a plain deploy reaches with no flag: a template immutable-property change, and an in-place update the provisioning layer rejects. Stateful types are databases, filesystems, KMS keys, table / vector storage, source repositories, and more; https://cdkd.dev/cli-deploy-safety/ carries the full list. S3 buckets and log groups are the conditional cases: at pre-flight, a non-empty bucket, or a log group with retention, with log streams, or whose emptiness the probe could not settle; mid-deploy, ANY bucket or log group, because the emptiness probe cannot run there. The two probes differ on failure — the bucket fails open, the log group closed. Destroy + recreate loses ALL data in the resource — no automatic data migration. Full opt-in for CI use: --recreate-via-cc-api '<id>' --force-stateful-recreation --yes.").default(false);
 const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / any S3 bucket / any Logs log group / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE — mid-deploy neither emptiness probe can run, so both conditional types count as stateful there.").default(false);
 const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Publish assets to the CDK bootstrap bucket/repo named by the asset manifest verbatim, skipping the cdkd asset-storage redirection even when this region is opted in via 'cdkd bootstrap'. For apps deployed via both CloudFormation and cdkd during a migration window. Per-app pin: cdk.json context.cdkd.useCdkBootstrapAssets. Also suppresses the legacy-mode 'cdk gc' notice.").default(false);
 const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
@@ -2396,7 +2396,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-N6aXDqij.js");
+	providerClasses ??= import("./provider-classes-BcSDENeH.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -5621,12 +5621,13 @@ function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
 			continue;
 		}
 		const stateValue = outputs[exportName];
-		if (!carriesDynamicReference(stateValue)) continue;
+		if (!carriesDynamicReference(stateValue) && !carriesSecretMask(stateValue)) continue;
 		if (JSON.stringify(entry.value) === JSON.stringify(stateValue)) continue;
 		findings.push({
 			kind: "converge",
 			exportName,
-			stateValue
+			stateValue,
+			entryValue: entry.value
 		});
 	}
 	return {
@@ -5713,9 +5714,9 @@ async function saveScrubbedState(stateBackend, stackName, region, state, loaded)
 			try {
 				survives = await stateBackend.getRawObject(legacyKey) !== null;
 			} catch (err) {
-				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${describeAwsFailure(err).detail}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
+				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${describeAwsFailure(err).detail}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as https://cdkd.dev/cli-scrub/#what-a-real-run-removes-and-what-it-cannot describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
 			}
-			if (survives) throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but its legacy key ${legacyKey} could not be deleted and still holds the ` + "pre-scrub record as its CURRENT object. Delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes.", "SCRUB_LEGACY_STATE_KEY_SURVIVES");
+			if (survives) throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but its legacy key ${legacyKey} could not be deleted and still holds the ` + "pre-scrub record as its CURRENT object. Delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as https://cdkd.dev/cli-scrub/#what-a-real-run-removes-and-what-it-cannot describes.", "SCRUB_LEGACY_STATE_KEY_SURVIVES");
 		}
 	} finally {
 		if (mayHaveWritten) await stateBackend.purgeNoncurrentVersions(stateHistoryKeys(stateBackend, stackName, region, loaded.migrationPending), { objectDescription: SCRUBBED_STATE_OBJECT_DESCRIPTION });
@@ -6084,16 +6085,17 @@ async function scrubCommand(stacks, options) {
 			const absentNamed = (exportName, entryValue) => /[^A-Za-z0-9]/.test(exportName) ? "(name withheld: an export name, which may carry a secret)" : named(exportName, entryValue);
 			const named = (exportName, alsoMask) => renderStateKeyForLine(scrubbed.exportNameDisplay(exportName, alsoMask), "it may carry a secret");
 			const unwrittenNames = new Set(repair.unwritten);
+			const entryValueOf = new Map(repair.findings.map((finding) => [finding.exportName, finding.entryValue]));
 			for (const exportName of repair.unwritten) indexUnwritten.push({
 				region: stackRegion,
-				shown: named(exportName)
+				shown: named(exportName, entryValueOf.get(exportName))
 			});
 			for (const finding of repair.findings) if (finding.kind === "converge") {
 				indexConverged++;
-				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName, finding.entryValue)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
 				else {
 					totalIndexEntriesConverged++;
-					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName, finding.entryValue)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
 				}
 			} else {
 				totalIndexEntriesAbsent++;
@@ -7339,6 +7341,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const collisions = [];
 		let outputsSourceUntrusted = false;
 		let everyExportAliasReproduced = true;
+		const conditionalNameParameters = new Set(nestedInput?.noEchoConditionalParameters ?? []);
+		const noEchoNameParameters = /* @__PURE__ */ new Set([...noEchoParameterNamesOf(stack.template), ...(nestedInput?.noEchoParameters ?? []).filter((name) => !conditionalNameParameters.has(name))]);
+		const declaredAliasOf = /* @__PURE__ */ new Map();
+		const noEchoNameSeed = noEchoParameterValueSeed(stack.template.Parameters, parameters, inheritedSecrets);
 		const nestedRowParameters = /* @__PURE__ */ new Map();
 		await withSharedDrainBudget(async () => {
 			for (const logicalId of Object.keys(state.resources ?? {})) {
@@ -7470,7 +7476,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				const exportNameUnresolved = declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName));
 				if (typeof exportName === "string" && !exportNameUnresolved) accountedOutputKeys.add(exportName);
 				const literalCollision = typeof declaredExportName === "string" && isExportAliasCollision(declaredExportName, name, declaredOutputNames);
-				if (declaredExportName !== void 0 && !literalCollision && !(typeof exportName === "string" && !exportNameUnresolved && isReadableBag(state.outputs) && Object.hasOwn(state.outputs, exportName) && (knownExportNamesOf(state.exportNames)?.has(exportName) ?? (typeof declaredExportName === "string" || !declaredOutputNames.has(exportName))))) everyExportAliasReproduced = false;
+				const refusedForNoEcho = declaredExportName !== void 0 && !JSON.stringify(declaredExportName).includes("\"Fn::If\"") && (typeof exportName === "string" && !exportNameUnresolved && carriedExportAliasExposure(exportName, outputSecrets, noEchoNameSeed) !== void 0 || readsNoEchoSource(declaredExportName, { parameters: noEchoNameParameters }));
+				if (typeof exportName === "string" && !exportNameUnresolved) declaredAliasOf.set(name, exportName);
+				if (declaredExportName !== void 0 && !literalCollision && !refusedForNoEcho && !(typeof exportName === "string" && !exportNameUnresolved && isReadableBag(state.outputs) && Object.hasOwn(state.outputs, exportName) && (knownExportNamesOf(state.exportNames)?.has(exportName) ?? (typeof declaredExportName === "string" || !declaredOutputNames.has(exportName))))) everyExportAliasReproduced = false;
 				if (exportNameUnresolved) {
 					outputsSourceUntrusted = true;
 					logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
@@ -7521,6 +7529,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretBearingKeys.push(key);
 			logger.warn(secretBearingStateKeyWarning(stack.stackName, display));
 		}
+		const noEchoPlans = planScrubNoEcho(state, stack.template, perResourceTemplateProps, conditions, nestedInput?.noEchoParameters ?? [], nestedInput?.noEchoConditionalParameters ?? []);
 		const nestedChildren = [];
 		const nestedRowIds = /* @__PURE__ */ new Set();
 		for (const [logicalId, resource] of Object.entries(templateResources)) if (resource?.Type === NESTED_STACK_TYPE$1) nestedRowIds.add(logicalId);
@@ -7553,7 +7562,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				stackName: childStackName,
 				input: {
 					parameters,
-					inheritedSecrets: perResourceSecrets.get(logicalId) ?? /* @__PURE__ */ new Map()
+					inheritedSecrets: perResourceSecrets.get(logicalId) ?? /* @__PURE__ */ new Map(),
+					...(() => {
+						const filled = noEchoFilledRowParameters(templateResources[logicalId]?.Properties, noEchoPlans.sources, noEchoPlans.needleSources);
+						return {
+							noEchoParameters: filled.names,
+							...filled.conditional.length > 0 && { noEchoConditionalParameters: filled.conditional }
+						};
+					})()
 				}
 			});
 		}
@@ -7586,8 +7602,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const needles = new Map([...allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets), ...outputSecrets]);
 			return JSON.stringify(redactSecretsForState(value, needles)) !== JSON.stringify(value);
 		};
+		const noEchoPublicTokens = /* @__PURE__ */ new Set([region, stack.stackName]);
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
-		if (totalSecrets === 0) {
+		if (totalSecrets === 0 && !noEchoPlans.changesAny) {
 			emitAbandonedScanNotes();
 			return {
 				...await purgeExaminedHistory(loaded.migrationPending),
@@ -7621,8 +7638,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				properties: redactSecretsForState(record.properties, ownSecrets, templateProps, TEMPLATE_SOURCED_RULES)
 			} : record;
 			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
-			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
-			newResources[logicalId] = scrubbed;
+			const plan = noEchoPlans.byLogicalId.get(logicalId);
+			const migrationNeedles = scrubMigrationNeedles(plan, noEchoPublicTokens);
+			const written = applyScrubNoEcho(migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES), record, plan);
+			if (JSON.stringify(written) !== JSON.stringify(record)) recordsChanged++;
+			newResources[logicalId] = written;
 		}
 		const newOrphans = (state.orphans ?? []).map((record, orphanIndex) => {
 			const own = orphanSecrets.get(String(orphanIndex));
@@ -7667,9 +7687,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const producer = list === "imports" ? `producer ${displayStackName(maskSecretsInText(entry.sourceStack, crossStackNeedles))}, ` : "";
 			logger.warn(safeMsg`Scrub of ${shownStack}: state.${list}[${index}] (${producer}${displayIdent(String(entry.sourceRegion))}) ` + "holds a cross-stack read name in plaintext that has the shape of a secret-bearing read in today's template but not the secret's current value — most likely a value from before the secret was ROTATED. Scrub cannot repair it (it matches only the current value) and does not print it; treat that earlier value as exposed. A deploy " + safeMsg`that updates ${shownStack} rewrites this list from the reads it performs.`);
 		}
-		const redactedOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
 		emitAbandonedScanNotes();
-		let newOutputs = redactedOutputs;
+		let newOutputs = noEchoMaskedOutputs;
 		let newExportNames = state.exportNames;
 		let droppedOutputKeys = 0;
 		let keptReadOutputKeys = 0;
@@ -7677,11 +7697,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		let droppedOutputReadersUnverified = false;
 		const droppedDisplayCorpus = /* @__PURE__ */ new Map();
 		const withheldOutputKeys = /* @__PURE__ */ new Set();
-		if (isReadableBag(state.outputs) && isReadableBag(redactedOutputs)) {
+		if (isReadableBag(state.outputs) && isReadableBag(noEchoMaskedOutputs)) {
 			const stored = state.outputs;
 			const plan = planUnnamedOutputDrop({
 				stored,
-				rewritten: redactedOutputs,
+				rewritten: noEchoMaskedOutputs,
 				accountedKeys: accountedOutputKeys,
 				reportedKeys: new Set(secretBearingKeys),
 				exportNames: state.exportNames,
@@ -7715,7 +7735,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				}
 				if (dropping.size > 0) {
 					droppedOutputKeys = dropping.size;
-					newOutputs = Object.fromEntries(Object.entries(redactedOutputs).filter(([key]) => !dropping.has(key)));
+					newOutputs = Object.fromEntries(Object.entries(noEchoMaskedOutputs).filter(([key]) => !dropping.has(key)));
 					if (Array.isArray(state.exportNames)) newExportNames = state.exportNames.filter((name) => !(typeof name === "string" && dropping.has(name)));
 					logger.info(safeMsg`${opts.dryRun ? "Would drop" : "Dropped"} ${dropping.size} output key(s) from ` + safeMsg`${shownStack} that its template no longer declares: ${shownKeys(dropping)}. ` + "Their values are not printed: scrub could not identify them as a secret's plaintext, and left beside the references it writes, cdkd diff would print them. A deploy of today's template does not write them either.");
 				}
@@ -7798,6 +7818,179 @@ function createScrubCommand() {
 	cmd.action(withErrorHandling(scrubCommand));
 	return cmd;
 }
+function planScrubNoEcho(state, template, templateProps, conditions, passedParameters = [], conditionalParameters = []) {
+	const byLogicalId = /* @__PURE__ */ new Map();
+	const parameters = /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...passedParameters]);
+	const resources = state.resources ?? {};
+	const declared = /* @__PURE__ */ new Map();
+	for (const [id, record] of Object.entries(resources)) declared.set(id, new Set(noEchoAttributeNamesOf(record) ?? []));
+	const sources = {
+		parameters,
+		attributeIsNoEcho: (id, attribute) => declared.get(id)?.has(attribute) === true,
+		...Object.keys(conditions).length > 0 && { conditions }
+	};
+	const persisted = (value) => carriesSecretMask(value) || typeof value === "string" && isSingleDynamicReferenceToken(value);
+	const templateResources = template.Resources ?? {};
+	const eligible = Object.entries(resources).filter(([logicalId, record]) => templateProps.has(logicalId) && Object.hasOwn(templateResources, logicalId) && templateResources[logicalId]?.Type === record.resourceType);
+	const positionFrom = (params, names) => {
+		const from = {
+			...sources,
+			parameters: params,
+			attributeIsNoEcho: (id, attribute) => names.get(id)?.has(attribute) === true
+		};
+		const leavesOf = /* @__PURE__ */ new Map();
+		for (let round = 0; round <= eligible.length; round++) {
+			let grew = false;
+			for (const [logicalId, record] of eligible) {
+				const own = noEchoLeavesOf(record);
+				const leaves = canonicalCoordinates(own ?? noEchoCoordinatesOf(templateProps.get(logicalId), record.properties, from));
+				leavesOf.set(logicalId, leaves);
+				for (const [name, attribute] of Object.entries(record.attributes ?? {})) {
+					if (attribute === record.physicalId || persisted(attribute)) continue;
+					const echoes = leaves.some((coordinate) => coordinate[0] === name && JSON.stringify(valueAtCoordinate(record.properties, coordinate)) === JSON.stringify(attribute));
+					const recordNames = names.get(logicalId);
+					if (echoes && !recordNames.has(name)) {
+						recordNames.add(name);
+						grew = true;
+					}
+				}
+			}
+			if (!grew) break;
+		}
+		return leavesOf;
+	};
+	const leavesOf = positionFrom(parameters, declared);
+	const conditional = new Set(conditionalParameters);
+	const needleParameters = new Set([...parameters].filter((name) => !conditional.has(name)));
+	const needleDeclared = conditional.size === 0 ? declared : new Map(Object.entries(resources).map(([id, record]) => [id, new Set(noEchoAttributeNamesOf(record) ?? [])]));
+	const needleLeavesOf = conditional.size === 0 ? leavesOf : positionFrom(needleParameters, needleDeclared);
+	let changesAny = false;
+	for (const [logicalId, record] of eligible) {
+		const leaves = leavesOf.get(logicalId) ?? [];
+		const attributeNames = [...declared.get(logicalId) ?? []].sort();
+		if (leaves.length === 0 && attributeNames.length === 0) continue;
+		const stored = [];
+		const needleCoordinates = new Set((needleLeavesOf.get(logicalId) ?? []).map((coordinate) => JSON.stringify(coordinate)));
+		for (const coordinate of leaves) {
+			const value = valueAtCoordinate(record.properties, coordinate);
+			if (value === void 0 || value === null || persisted(value)) continue;
+			stored.push({
+				coordinate,
+				value,
+				needle: needleCoordinates.has(JSON.stringify(coordinate))
+			});
+		}
+		byLogicalId.set(logicalId, {
+			leaves,
+			stored,
+			attributeNames
+		});
+		const unmaskedAttribute = attributeNames.some((name) => Object.hasOwn(record.attributes ?? {}, name) && !persisted(record.attributes[name]));
+		if (stored.length > 0 || unmaskedAttribute || leaves.length > 0 && JSON.stringify(record.noEchoLeaves) !== JSON.stringify(leaves)) changesAny = true;
+	}
+	const outputSources = {
+		parameters,
+		attributeIsNoEcho: sources.attributeIsNoEcho
+	};
+	const outputKeys = [];
+	const stored = state.outputs;
+	if (stored !== null && typeof stored === "object" && !Array.isArray(stored)) for (const [key, output] of Object.entries(template.Outputs ?? {})) {
+		if (!Object.hasOwn(stored, key)) continue;
+		const value = stored[key];
+		if (value === void 0 || value === null || persisted(value)) continue;
+		if (!readsNoEchoSource(output?.Value, outputSources)) continue;
+		outputKeys.push(key);
+	}
+	if (outputKeys.length > 0) changesAny = true;
+	return {
+		byLogicalId,
+		outputKeys,
+		changesAny,
+		parameters,
+		sources: outputSources,
+		needleSources: {
+			parameters: needleParameters,
+			attributeIsNoEcho: (id, attribute) => needleDeclared.get(id)?.has(attribute) === true
+		}
+	};
+}
+function scrubMigrationNeedles(plan, publicTokens) {
+	if (plan === void 0 || plan.stored.length === 0) return void 0;
+	const needles = /* @__PURE__ */ new Map();
+	for (const { value, needle } of plan.stored) if (needle) recordNoEchoParameterFreshValue(value, needles, publicTokens);
+	return needles.size > 0 ? needles : void 0;
+}
+function maskScrubNoEchoOutputs(outputs, keys, declared, aliasOf) {
+	if (outputs === void 0 || keys.length === 0) return outputs;
+	const ownAliases = new Set(keys.flatMap((key) => aliasOf.has(key) ? [aliasOf.get(key)] : []));
+	const otherAliases = new Set([...aliasOf].filter(([key]) => !keys.includes(key)).map(([, alias]) => alias));
+	const spelled = new Set(keys.filter((key) => Object.hasOwn(outputs, key)).map((key) => JSON.stringify(outputs[key])));
+	const masked = nullPrototypeRecord();
+	for (const [key, value] of Object.entries(outputs)) {
+		const byValue = !declared.has(key) && !otherAliases.has(key) && spelled.has(JSON.stringify(value));
+		masked[key] = keys.includes(key) || ownAliases.has(key) || byValue ? maskWholeValue(value) : value;
+	}
+	return masked;
+}
+function applyScrubNoEcho(scrubbed, record, plan) {
+	if (plan === void 0) return scrubbed;
+	const { leaves, attributeNames } = plan;
+	const next = {
+		...scrubbed,
+		properties: maskAtCoordinates(scrubbed.properties, leaves),
+		...leaves.length > 0 && { noEchoLeaves: leaves.map((coordinate) => [...coordinate]) },
+		...scrubbed.observedProperties !== void 0 && { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) }
+	};
+	const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+	const exact = noEchoExactEchoLeavesOf(scrubbed);
+	if (exact !== void 0) {
+		const kept = exact.filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (kept.length > 0) next.noEchoExactEchoLeaves = kept;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	const attributes = next.attributes;
+	if (attributes !== void 0 && attributes !== null && attributeNames.length > 0) {
+		const masked = { ...attributes };
+		for (const name of attributeNames) if (Object.hasOwn(masked, name)) masked[name] = maskWholeValue(masked[name]);
+		next.attributes = masked;
+		next.noEchoAttributeNames = [...attributeNames];
+	}
+	return next;
+}
+function withoutFnIf(value) {
+	if (Array.isArray(value)) return value.map(withoutFnIf);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.hasOwn(value, "Fn::If")) return null;
+	const out = nullPrototypeRecord();
+	for (const [key, inner] of Object.entries(value)) out[key] = withoutFnIf(inner);
+	return out;
+}
+function noEchoFilledRowParameters(rowProperties, sources, needleSources) {
+	const names = [];
+	const conditional = [];
+	if (rowProperties === null || typeof rowProperties !== "object") return {
+		names,
+		conditional
+	};
+	const passed = rowProperties["Parameters"];
+	if (passed === null || typeof passed !== "object" || Array.isArray(passed)) return {
+		names,
+		conditional
+	};
+	const unconditioned = {
+		parameters: sources.parameters,
+		...sources.attributeIsNoEcho !== void 0 && { attributeIsNoEcho: sources.attributeIsNoEcho }
+	};
+	for (const [name, value] of Object.entries(passed)) {
+		if (!readsNoEchoSource(value, unconditioned)) continue;
+		names.push(name);
+		if (!readsNoEchoSource(withoutFnIf(value), needleSources)) conditional.push(name);
+	}
+	return {
+		names,
+		conditional
+	};
+}
 
 //#endregion
 //#region src/analyzer/drift-normalize.ts
@@ -14349,15 +14542,16 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			continue;
 		}
 		const noEchoLeaves = noEchoLeavesOf(stateEntry);
-		if (noEchoLeaves !== void 0 && noEchoLeaves.length > 0 && carriesSecretMask(stateEntry.properties) && !carriesSecretMask(withoutCoordinates(stateEntry.properties, noEchoLeaves))) {
+		const masksOnlyAtNoEchoLeaves = noEchoLeaves !== void 0 && noEchoLeaves.length > 0 && carriesSecretMask(stateEntry.properties) && !carriesSecretMask(withoutCoordinates(stateEntry.properties, noEchoLeaves));
+		if (masksOnlyAtNoEchoLeaves && IMPORT_UNSUPPORTED_RECREATABLE_TYPES.has(resourceType) && noEchoLeaves.some((coordinate) => typeof coordinate[0] === "string" && NOECHO_PRE_DELETE_KEYS.has(coordinate[0]))) {
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "a NoEcho template parameter feeds at least one property, and cdkd state holds only the redaction mask ('***') there, so the export has no value to declare for it. Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
+				reason: "a NoEcho template parameter feeds a property this resource's pre-delete reads (its principals or its name), and cdkd state holds only the redaction mask ('***') there, so the export cannot tell what to remove. Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
 			});
 			continue;
 		}
-		if (carriesSecretMask(stateEntry.properties)) {
+		if (!masksOnlyAtNoEchoLeaves && carriesSecretMask(stateEntry.properties)) {
 			blocked.push({
 				logicalId,
 				resourceType,
@@ -14448,6 +14642,14 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			continue;
 		}
 		const propertiesOverlay = resolved.propertiesOverlay ?? resolved.resourceIdentifier;
+		if ((JSON.stringify(resolved.resourceIdentifier).includes("***") || JSON.stringify(propertiesOverlay).includes("***")) && !(carriesSecretMask(resolved.resourceIdentifier) || carriesSecretMask(propertiesOverlay))) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: "the CloudFormation import identifier of this resource embeds the redaction mask ('***'): it is built from a value cdkd stores only as the mask (a NoEcho value). Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
+			});
+			continue;
+		}
 		if (carriesSecretMask(resolved.resourceIdentifier) || carriesSecretMask(propertiesOverlay)) {
 			blocked.push({
 				logicalId,
@@ -15262,28 +15464,31 @@ async function resolveChildImportParameters(parentTemplate, parentResolverContex
 	const stillSkipped = [];
 	for (const key of base.intrinsicSkipped) {
 		const intrinsicValue = rawParams[key];
+		let result;
 		try {
-			const result = await resolver.resolve(intrinsicValue, parentResolverContext);
-			if (result === void 0 || result === null) {
-				stillSkipped.push(key);
-				continue;
-			}
-			if (typeof result === "string") resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: result
-			});
-			else if (typeof result === "number" || typeof result === "boolean") resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: String(result)
-			});
-			else if (Array.isArray(result)) resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: result.map((e) => String(e)).join(",")
-			});
-			else stillSkipped.push(key);
+			result = await resolver.resolve(intrinsicValue, parentResolverContext);
 		} catch {
 			stillSkipped.push(key);
+			continue;
+		}
+		if (JSON.stringify(result ?? null).includes("***")) throw new CdkdError(`Cannot export the nested stack row ${quotedOrNotShown(childLogicalId)}: its parameter ${quotedOrNotShown(key)} resolves from a value cdkd stores only as the redaction mask (***), a NoEcho value, so the export has no value to pass to the child. Export the stack without that nested stack and adopt it into CloudFormation by hand, passing the parameter value yourself.`, "EXPORT_MASKED_CHILD_PARAMETER");
+		if (result === void 0 || result === null) {
+			stillSkipped.push(key);
+			continue;
 		}
+		if (typeof result === "string") resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: result
+		});
+		else if (typeof result === "number" || typeof result === "boolean") resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: String(result)
+		});
+		else if (Array.isArray(result)) resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: result.map((e) => String(e)).join(",")
+		});
+		else stillSkipped.push(key);
 	}
 	return {
 		params: resolvedParams,
@@ -15863,6 +16068,12 @@ function createExportCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+const NOECHO_PRE_DELETE_KEYS = /* @__PURE__ */ new Set([
+	"Roles",
+	"Users",
+	"Groups",
+	"PolicyName"
+]);
 function withoutCoordinates(bag, coordinates) {
 	const placeholder = Symbol("noecho-leaf");
 	const marked = coordinates.reduce((current, coordinate) => replaceAtCoordinate(current, coordinate, placeholder), bag);
@@ -19694,6 +19905,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stateBackend,
 		stackName: stackState.stackName
 	};
+	const noEchoInputs = /* @__PURE__ */ new Map();
 	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
 		const unresolvedProperties = resource.properties ?? {};
@@ -19704,6 +19916,11 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 				recordedSecretValues
 			});
 			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
+			noEchoInputs.set(logicalId, {
+				template: unresolvedProperties,
+				resolved,
+				attributes: resource.attributes
+			});
 		} catch (err) {
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(describeAwsFailure(err).detail, recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
@@ -19735,8 +19952,94 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			logger.warn(`${refusedHere.length} resource(s) in ${displayStackName(stackState.stackName)} depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
 		}
 	}
+	positionImportedNoEcho(stackState, noEchoInputs, template, conditions, unsafeObservedBaselineLogicalIds, logger);
 	return unsafeObservedBaselineLogicalIds;
 }
+function positionImportedNoEcho(stackState, inputs, template, conditions, refusals, logger) {
+	if (inputs.size === 0) return;
+	const resources = stackState.resources ?? {};
+	const declared = /* @__PURE__ */ new Map();
+	for (const [id, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0) declared.set(id, new Set(names));
+	}
+	const sources = {
+		parameters: noEchoParametersOrAll(template),
+		attributeIsNoEcho: (id, attribute) => declared.get(id)?.has(attribute) === true,
+		...Object.keys(conditions).length > 0 && { conditions }
+	};
+	const leavesOf = /* @__PURE__ */ new Map();
+	const failed = /* @__PURE__ */ new Map();
+	for (let round = 0; round <= inputs.size; round++) {
+		let grew = false;
+		for (const [id, input] of inputs) {
+			let leaves = failed.get(id);
+			if (leaves === void 0) try {
+				leaves = canonicalCoordinates(noEchoCoordinatesOf(input.template, input.resolved, sources));
+			} catch (err) {
+				logger.debug(safeMsg`NoEcho position walk failed for imported ${id}: ${err instanceof Error ? err.name : typeof err} — masking each property that reads a NoEcho source whole and refusing its baseline, fail-closed.`);
+				leaves = topLevelNoEchoProperties(input.template, sources);
+				failed.set(id, leaves);
+				refusals.add(id);
+			}
+			leavesOf.set(id, leaves);
+			const physicalId = Object.hasOwn(resources, id) ? resources[id].physicalId : void 0;
+			for (const [name, attribute] of Object.entries(input.attributes ?? {})) {
+				if (attribute === physicalId) continue;
+				if (!leaves.some((coordinate) => coordinate[0] === name && JSON.stringify(valueAtCoordinate(input.resolved, coordinate)) === JSON.stringify(attribute))) continue;
+				let names = declared.get(id);
+				if (names === void 0) {
+					names = /* @__PURE__ */ new Set();
+					declared.set(id, names);
+				}
+				if (!names.has(name)) {
+					names.add(name);
+					grew = true;
+				}
+			}
+		}
+		if (!grew) break;
+	}
+	for (const [id, leaves] of leavesOf) {
+		if (!Object.hasOwn(resources, id)) continue;
+		const resource = resources[id];
+		if (leaves.length > 0) {
+			resource.properties = maskAtCoordinates(resource.properties, leaves);
+			resource.noEchoLeaves = leaves.map((coordinate) => [...coordinate]);
+		}
+		const echoed = [...declared.get(id) ?? []].filter((name) => resource.attributes !== void 0 && Object.hasOwn(resource.attributes, name));
+		if (echoed.length > 0 && resource.attributes !== void 0) {
+			const attributes = { ...resource.attributes };
+			for (const name of echoed) attributes[name] = maskWholeValue(attributes[name]);
+			resource.attributes = attributes;
+			resource.noEchoAttributeNames = [.../* @__PURE__ */ new Set([...noEchoAttributeNamesOf(resource) ?? [], ...echoed])].sort();
+		}
+	}
+}
+function topLevelNoEchoProperties(template, sources) {
+	const leaves = [];
+	for (const [key, value] of Object.entries(template)) {
+		let reads;
+		try {
+			reads = readsNoEchoSource(value, sources);
+		} catch {
+			reads = true;
+		}
+		if (reads) leaves.push([key]);
+	}
+	return canonicalCoordinates(leaves);
+}
+function noEchoParametersOrAll(template) {
+	try {
+		return noEchoParameterNamesOf(template);
+	} catch {
+		try {
+			return new Set(Object.keys(template.Parameters ?? {}));
+		} catch {
+			return /* @__PURE__ */ new Set();
+		}
+	}
+}
 const DYNAMIC_REFERENCE_OPENER = "{{resolve:";
 function countDynamicReferenceOpeners(bag) {
 	let text;
@@ -19883,7 +20186,10 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
-			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) {
+				const marked = noEchoLeavesOf(resource) ?? [];
+				resource.observedProperties = redactSecretsForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+			}
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
@@ -23431,7 +23737,7 @@ function warnVpcConfigLambdas(routesWithAuth, stacks) {
 		const resource = stack.template.Resources?.[logicalId];
 		if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
 		const vpcConfig = (resource.Properties ?? {})["VpcConfig"];
-		if (vpcConfig && typeof vpcConfig === "object" && Object.keys(vpcConfig).length > 0) logger.warn(`Lambda ${logicalId} has VpcConfig — local container will reach external services via the host's network, NOT through the deployed VPC's NAT/private subnets. Calls to private RDS/ElastiCache will fail. See https://github.com/go-to-k/cdkd/blob/main/docs/cli-reference.md (cdkd local start-api — Limitations) for details.`);
+		if (vpcConfig && typeof vpcConfig === "object" && Object.keys(vpcConfig).length > 0) logger.warn(`Lambda ${logicalId} has VpcConfig — local container will reach external services via the host's network, NOT through the deployed VPC's NAT/private subnets. Calls to private RDS/ElastiCache will fail. See https://cdkd.dev/local-start-api/#vpc-config-lambdas for details.`);
 		break;
 	}
 }
@@ -23440,7 +23746,7 @@ function warnIamRoutes(routesWithAuth) {
 	const iamRoutes = [];
 	for (const entry of routesWithAuth) if (entry.authorizer?.kind === "iam") iamRoutes.push(entry.route.declaredAt);
 	if (iamRoutes.length === 0) return false;
-	logger.warn(`${iamRoutes.length} route(s) declare AuthorizationType: AWS_IAM — cdkd local start-api verifies SigV4 signatures against your local AWS credentials, but does NOT emulate IAM policy evaluation (resource / action / condition rules). Signature-verified callers reach the handler under their own identity; downstream authorization is the dev's responsibility. See https://github.com/go-to-k/cdkd/blob/main/docs/cli-reference.md (cdkd local start-api — AWS_IAM authorizer) for details.`);
+	logger.warn(`${iamRoutes.length} route(s) declare AuthorizationType: AWS_IAM — cdkd local start-api verifies SigV4 signatures against your local AWS credentials, but does NOT emulate IAM policy evaluation (resource / action / condition rules). Signature-verified callers reach the handler under their own identity; downstream authorization is the dev's responsibility. See https://cdkd.dev/local-start-api/#aws-iam-authorization for details.`);
 	for (const declaredAt of iamRoutes) logger.warn(`  - ${declaredAt}`);
 	return true;
 }
@@ -24106,7 +24412,7 @@ function resolveMtlsConfig(options) {
 	});
 }
 function createLocalStartApiCommand() {
-	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated; see https://github.com/go-to-k/cdkd/blob/main/docs/local-emulation.md). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: watch the CDK app source tree and re-synth + re-discover routes on a source edit (cdk.out / node_modules / .git excluded; honors cdk.json watch.include / watch.exclude). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives BOTH event.stageVariables and requestContext.stage, for REST v1 and HTTP API v2 alike: when a route's API has a matching templated Stage, the selected StageName is threaded into requestContext.stage. An HTTP API v2 route reports '$default' only when its API carries no AWS::ApiGatewayV2::Stage in the template — that is v2's auto-deployed stage, not a limit on what this flag can select (AWS's CreateStage accepts named stages on v2 too). An API with no Stage matching the selected name is warned about at start-up and its routes get stageVariables: null.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: enforce strict AWS_IAM SigV4 verification. When set, requests whose signature cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) are denied. DEFAULT off — warn-and-pass with a placeholder principalId, matching cdk-local's `cdkl start-api`. Enable this when you want local parity with the deployed API Gateway's signature enforcement.").default(false)).action(withErrorHandling(localStartApiCommand));
+	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated; see https://cdkd.dev/local-start-api/#aws-iam-authorization). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: watch the CDK app source tree and re-synth + re-discover routes on a source edit (cdk.out / node_modules / .git excluded; honors cdk.json watch.include / watch.exclude). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives BOTH event.stageVariables and requestContext.stage, for REST v1 and HTTP API v2 alike: when a route's API has a matching templated Stage, the selected StageName is threaded into requestContext.stage. An HTTP API v2 route reports '$default' only when its API carries no AWS::ApiGatewayV2::Stage in the template — that is v2's auto-deployed stage, not a limit on what this flag can select (AWS's CreateStage accepts named stages on v2 too). An API with no Stage matching the selected name is warned about at start-up and its routes get stageVariables: null.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: enforce strict AWS_IAM SigV4 verification. When set, requests whose signature cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) are denied. DEFAULT off — warn-and-pass with a placeholder principalId, matching cdk-local's `cdkl start-api`. Enable this when you want local parity with the deployed API Gateway's signature enforcement.").default(false)).action(withErrorHandling(localStartApiCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -27439,4 +27745,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-GmKPVK8p.js.map
+//# sourceMappingURL=program-BwNb3_Ot.js.map