@go-to-k/cdkd 0.297.0 → 0.298.1

package/dist/{program-NRnM6vPK.js → program-D5gcmWad.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
+import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $c as derivePartitionAndUrlSuffix, $i as malformedResourceEntriesWarning, $o as isUncertifiedBaselineMaskPosition, $r as AWS_CREDENTIAL_ENV_KEYS, $s as ensureAssetStorage, $t as orphanDeleteNeedsIdentity, A as noEchoExactEchoLeavesOf, Aa as repairMalformedOrphansForReadOnly, Ac as getDefaultStateBucketName, Ai as UNREADABLE_RESOURCES_MAP_ROW, An as maskEventTextWithBoundBags, Ar as deleteSkipReason, As as acceptedCreateOnlyDropsOf, At as isHandledOrphan, Bc as stateBucketExistenceConfirmed, Bi as malformedExportNamesWarning, Bn as ccRoutedFinalSnapshotError, Bo as printingCorpusOf, Br as DiffCalculator, Bs as orphansCarriedFrom, Bt as withStackRecords, C as recordRetainedForReadoption, Ca as refuseMalformedResourcePropertiesForExport, Cc as warnFinchArgvExposure, Ci as withSharedDrainBudget, Cn as collectPublishedOutputNames, Co as maskAtCoordinates, Cr as customResourceResponseExpirationWarning, Cs as CrossPrefixReadError, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as refuseMalformedResourcesForExport, Dc as getDockerImageBySourceHash, Di as STATE_REGION_DIVERGED, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Do as noEchoCoordinatesOf, Dr as UNSPECIFIED_SKIP_REASON, Ds as isAccessDenied, Dt as withNestedStackContext, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcesForDestroy, Ec as AssetManifestLoader, Ei as JSON_LISTING_HOLE_VALUE, En as DEFAULT_RESOURCE_TIMEOUT_MS, Eo as maskedLeafCoordinatesOf, Es as crossPrefixDeniedWarning, F as isProtectionValueActive, Fa as unpreviewableOrphanRecords, Fc as resolveCaptureObservedState, Fi as hasReadableOutputs, Fn as storedSecretNameNeedles, Fo as carryLogOnlyValues, Fs as hasUnverifiableParameterRefusal, Ft as replayFailedOperations, Ga as findReplacedReadersOfRecreateTargets, Gc as MIGRATE_TMP_PREFIX, Gi as malformedOrphanRecordsRefusalMessage, Gn as unsupportedFinalSnapshotError, Go as errorCauseChain, Gr as producerRegionsFromState, Gs as WorkGraph, Gt as isReplacementOrphan, Hc as ssmResolvedValueType, Hi as malformedLocalOutputsWarning, Hn as effectiveDeletionPolicy, Ho as recordLogOnlyValue, Hr as IntrinsicFunctionResolver, Hs as AssetPublisher, Ht as recordAfterRollbackUpdate, I as perType, Ia as unreadableOrphanRecords, Ic as resolveSkipPrefix, Ii as hasReadableResources, In as extractDeploymentEventError, Io as createUnionSecretMasker, Is as importableOutputKeys, It as replayRollback, Ja as isStatefulRecreateTargetForReplace, Jc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ji as malformedOrphansRefusalMessage, Jn as findDestructiveChanges, Jo as markSameGenerationBag, Jr as assertFlagRoleArn, Js as loadPublishableAssetManifest, Jt as recheckFailedPlan, Ka as shownType, Kc as findLargeInlineResources, Ki as malformedOrphanRecordsWarning, Kn as maskingRetryLogger, Ko as maskSecretsInError, Kr as regionLessSecretName, Ks as buildAssetRedirectMap, Kt as planFailedOps, L as readProtection, La as unreadableResourceEntries, Lc as resolveStateBucketWithDefault, Li as isReadableOrphanRecord, Ln as ATOMIC_FINAL_SNAPSHOT_TYPES, Lo as hasMaskableValues, Ls as importableOutputs, M as recordedProtectionEvidence, Ma as repairMalformedResourceEntriesForReadOnly, Mc as loadCdkJson, Mi as deployRefusesOrphanRowsReason, Mn as secretNamePrintingBag, Mo as readsNoEchoSource, Mr as isWaitAbandonedError, Ms as exportNamesCarriedFrom, Mt as loadJournaledOrphans, N as recordedProtectionNote, Na as repairMalformedResourcePropertiesForReadOnly, Nc as resolveApp, Ni as displayLogicalId, Nn as secretNamedRecordNeedles, No as valueAtCoordinate, Ns as hasReadableExportSet, Nt as makeForeignHolderScan, O as noEchoAttributeNamesOf, Oa as refuseMalformedState, Oc as Synthesizer, Oi as STATE_RESOURCES_MALFORMED, On as completedReplayEntries, Oo as noEchoLeavesOf, Or as deleteIndeterminateGuards, Os as isNotImplemented, Ot as deleteJournaledOrphans, P as PROTECTION_PROPERTY_BY_TYPE, Pa as repairMalformedResourcesForReadOnly, Pc as resolveAutoAssetStorage, Pi as hasReadableOrphans, Pn as stateSecretNameNeedles, Po as liveMatchesUnresolvedTokenFrame, Ps as hasReasonlessBaselineRefusal, Pt as sameJournaledOrphans, Qc as canonicalizeRegion, Qi as malformedRenderedContainersWarning, Qn as ledgerForStack, Qo as dynamicReferenceTokens, Qr as sendableAssumeRoleCommand, Qs as assertAssetBucketRegion, Qt as seedsDeleteFirstGuard, Ra as withheldAccountClause, Rc as resolveStateBucketWithDefaultAndSource, Ri as isReadableResourceEntry, Rn as PRE_DELETE_SNAPSHOT_TYPES, Ro as literalSplitDelimitersOf, Rs as isReadableBag, Rt as destroyStackRecordsView, S as keptForReadoption, Sa as refuseMalformedResourcePropertiesForDrift, Sc as runDockerStreaming, Sn as collectDeclaredOutputNames, So as isMarkedCoordinate, Sr as applyCustomResourceResponseExpiration, Ss as rebuildClientForBucketRegion, T as findServiceTokenRefusals, Ta as refuseMalformedResourcesForDeploy, Tc as stripControlChars, Tn as bindingSkippedOutputs, To as maskWholeValue, Tr as slowCcOperationTimeoutMs, Ts as applyCrossPrefixScan, Tt as collectNestedChildUnaddressed, Ua as NO_CC_HANDLERS_REASON, Uc as CFN_TEMPLATE_BODY_LIMIT, Ui as malformedLocalResourceEntriesWarning, Un as isFinalSnapshotError, Uo as shareLogOnlyValues, Ur as poisonRenderedSpellingsCollidingIn, Us as isSensitiveAttributeName, Ut as demoteSupersededOrphans, Va as unwrittenCreateOnlyReplacement, Vc as warnDeprecatedNoPrefixCliFlag, Vi as malformedExportSourceWarning, Vn as createPreDeleteFinalSnapshot, Vo as recordLogOnlyParameterValue, Vr as INTRINSIC_KEYS, Vs as shouldRetainResource, Vt as removeProtectionTypeList, Wa as hasNoCloudControlHandlers, Wc as CFN_TEMPLATE_URL_LIMIT, Wi as malformedLocalResourcesWarning, Wn as refusesFinalSnapshot, Wo as createSecretMasker, Wr as classifyReplaySecretRegion, Ws as stringifyValue, Wt as isJournaledOrphan, Xa as renderStatefulReason, Xc as expectedOwnerParam, Xi as malformedOutputsRefusalMessage, Xn as RollbackInlinePolicyWriters, Xo as scrubResourceRecord, Xr as explicitRoleArnOrThrow, Xs as AssetModeResolver, Xt as replacementNeverSwapped, Ya as isStatefulRecreateTargetSync, Yc as decodeListingKey, Yi as malformedOrphansWarning, Yn as formatDestructiveChange, Yo as redactSecretsForState, Yr as assertSendableRoleArn, Ys as rewriteTemplateAssetReferences, Yt as recordUnderIdIsNotOwn, Zc as PARTITION_TABLE, Zi as malformedOutputsWarning, Zo as DYNAMIC_REFERENCE_TOKEN_SCAN, Zr as isIamRoleArn, Zs as BOOTSTRAP_MARKER_PREFIX, Zt as resolveReplacementOldType, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourceEntriesForDestroy, _c as isMalformedEnvKey, _i as keepsSecretReferenceToken, _n as carriedExportAliasExposure, _r as readsNoEchoDeleteValues, _s as WHOLE_DYNAMIC_REFERENCE_PATTERN, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseDivergentRecordRegionForDestroy, ac as validateContainerRepoName, al as hasPlainPrototype, as as carriesSecretMask, at as gray, ba as refuseMalformedResourceEntriesForOrphan, bc as redactedDockerCause, bi as isStalePlaceholderArnAttribute, bn as isWholeDynamicReferenceValue, bo as TemplateParser, br as withPrintingSecrets, bs as isLockInfoExpired, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedOrphanRecordsForDestroy, cc as resolveDockerContextDirectory, cl as absoluteAssemblyPathEscape, cn as updatePartialReason, cs as recordMaskOnlyValuesIn, ct as yellow, d as conditionInputsFrom, da as refuseMalformedOrphansForOrphan, dc as describeDockerFailure, di as parameterTypeMayLoseSecretIdentity, dl as renderAssemblyPathEscape, dn as WITHHELD_NAME_DISPLAY, dr as CC_BROKEN_REASON, ds as recordProvenPublicExpression, dt as reachableDivergentParameters, ea as malformedResourcePropertiesWarning, ec as getBootstrapMarkerKey, ei as applyCallerIdentityCredentials, el as AssemblyReader, en as findNestedStackTypeChanges, er as withCreateTokenLedger, es as pathCrossesDottedKey, f as parentSuppliedValues, fa as refuseMalformedOutputs, fc as dockerSpawnEnvWithSensitive, fi as getAccountInfo, fl as resolveAssemblyPath, fn as displayTextOrWithheld, fo as prefetchCreateOnlyPropertyPaths, fr as ProviderRegistry, fs as wholeStringLeavesOf, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourceEntriesForDeploy, gc as isDockerClientEnvKey, gi as isNamelessDynamicReferenceError, gn as secretSafeKeyDisplay, gr as TemplateNoEchoReresolver, gs as TEMPLATE_SOURCED_RULES, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourceEntries, hc as getDockerCmd, hi as carriesFetchableDynamicReference, hn as secretBearingStateKeyWarning, ho as withRetry, hr as wouldReturnToSdkProvider, hs as STATE_SOURCED_READBACK_RULES, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as previewableOrphanRecords, ic as validateAssetBucketName, il as hasOwnKey, it as cyan, j as noEchoParameterNamesOf, ja as repairMalformedOutputsForReadOnly, jc as getLegacyStateBucketName, ji as accountArgs, jn as orphanRecordsPrintingBag, jo as readbackPathFor, js as describeRegionValueKind, jt as journaledOrphanLines, k as noEchoComparisonForTemplate, ka as repairMalformedOrphanRecordsForReadOnly, kc as synthesisStatusMessage, ki as UNREADABLE_ORPHANS_CONTAINER_ROW, kn as journaledOrphanPrintingBag, ko as noEchoOutputsComparison, kr as deleteLeftInPlace, ks as splitImportedOps, kt as dropFailedHint, l as templateIdentity, la as refuseMalformedOrphans, lc as describeDockerCapturedOutput, li as coerceParameterTypedValue, ll as describeFileReadFailure, ln as DeploymentEventsReader, ls as recordNoEchoAttributeValues, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourceAttributesForOrphan, mc as formatDockerLoginError, mi as carriesDynamicReference, ml as resolveBucketRegion, mn as secretBearing, mo as describeTypeWithThrottleRetry, mr as isCustomResource, ms as STATE_SOURCED_CROSS_GENERATION_RULES, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedScrubResourceEntriesRefusalMessage, nc as parseBootstrapMarker, ni as envCredentialsAreAssumedRole, nl as processStackMessages, nn as inheritProducerRegions, ns as inheritNestedStackParameterAssociations, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oc as buildDenyExternalAccessPolicy, ol as nullPrototypeRecord, os as provenPublicValue, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedOutputsForDestroy, pc as finchSecretArgvRefusal, pi as isImpossibleEmptyStoredAttribute, pn as exportAliasCollisionScrubWarning, po as templateResourceTypes, pr as ccBrokenReason, ps as STATE_SOURCED_BASELINE_RULES, pt as makeSiblingClaimReader, qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, qc as uploadCfnTemplate, qi as malformedOrphanRowsKeptWarning, qn as constructPathOf, qo as maskSecretsInText, qr as applyRoleArnIfSet, qs as createAssetRedirectResolver, qt as planRollback, r as computeImplicitDeleteEdges, ra as malformedStateRefusalMessage, rc as readBootstrapMarkerBody, rl as defineOwnKey, rs as recordNestedStackParameterExpressions, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedOrphanRecords, sc as buildDockerImage, sl as ownValue, sn as updatePartialMessage, ss as recordMaskOnlyValue, st as red, t as DeployEngine, ta as malformedResourcesWarning, tc as isCrossRegionRedirect, ti as callerEnvCredentials, tl as StageLoadError, ts as identityKeyFor, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedOrphansForDestroy, uc as describeDockerExecFailure, ui as isUnboundTemplateParameter, ul as displayAssemblyPath, un as DeploymentEventsStore, us as recordNoEchoParameterFreshValue, ut as namesAnyDeclaredParameter, va as refuseMalformedResourceEntriesForImport, vc as partitionSensitiveEnv, vi as AWS_NO_VALUE, vn as exportNameNoEchoParameters, vr as isCustomResourceType$1, vs as isSingleDynamicReferenceToken, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as refuseMalformedResourcePropertiesForOrphan, wc as escapeRegExp, wi as parameterInputsFor, wn as isExportAliasCollision, wo as maskReadbackAtCoordinates, wr as CloudControlProvider, ws as CrossPrefixScanCache, wt as withNestedRevertRun, xa as refuseMalformedResourcePropertiesForDestroy, xc as runDockerForeground, xi as refStateLookupFromResource, xn as noEchoParameterValueSeed, xo as canonicalCoordinates, xr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, xs as S3StateBackend, xt as recordDisplacedSkips, ya as refuseMalformedResourceEntriesForImportSave, yc as redactDockerArgvValues, yi as cfnRefValueFromPhysicalId, yn as exportNameSecretExposure, yo as DagBuilder, ys as LockManager, za as findActionableSilentDrops, zc as resolveUseCdkBootstrapAssets, zi as malformedDriftResourcePropertiesWarning, zn as buildFinalSnapshotIdentifier, zo as logOnlyValueCount, zs as orphansAfterRollback } from "./deploy-engine-dvf1UDuo.js";
-import { t as getCdkdVersion } from "./version-DE-djeB0.js";
+import { $a as isStatefulRecreateTargetForReplace, $c as CFN_TEMPLATE_BODY_LIMIT, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as isSensitiveAttributeName, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactedDockerCause, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as isLockInfoExpired, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as getDefaultStateBucketName, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as acceptedCreateOnlyDropsOf, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as finchSecretArgvRefusal, Ci as cfnRefValueFromPhysicalId, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as STATE_SOURCED_BASELINE_RULES, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isMalformedEnvKey, Di as withSharedDrainBudget, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as WHOLE_DYNAMIC_REFERENCE_PATTERN, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as isDockerClientEnvKey, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as TEMPLATE_SOURCED_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as stripControlChars, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as applyCrossPrefixScan, Ft as sameJournaledOrphans, Gc as resolveCaptureObservedState, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasUnverifiableParameterRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as loadCdkJson, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as exportNamesCarriedFrom, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as AssetManifestLoader, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as crossPrefixDeniedWarning, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveStateBucketWithDefaultAndSource, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as isReadableBag, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveSkipPrefix, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as importableOutputKeys, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as getDockerImageBySourceHash, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as isAccessDenied, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as runDockerStreaming, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as rebuildClientForBucketRegion, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as warnFinchArgvExposure, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as CrossPrefixReadError, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as partitionSensitiveEnv, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as isSingleDynamicReferenceToken, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as escapeRegExp, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixScanCache, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as ssmResolvedValueType, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as AssetPublisher, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as Synthesizer, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isNotImplemented, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as dockerSpawnEnvWithSensitive, Si as AWS_NO_VALUE, Sl as resolveAssemblyPath, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as wholeStringLeavesOf, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as getDockerCmd, Ti as refStateLookupFromResource, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_READBACK_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as resolveApp, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as hasReadableExportSet, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as getLegacyStateBucketName, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as describeRegionValueKind, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as resolveAutoAssetStorage, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReasonlessBaselineRefusal, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as stateBucketExistenceConfirmed, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveUseCdkBootstrapAssets, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as orphansAfterRollback, Yt as recheckFailedPlan, Za as shownType, Zc as warnDeprecatedNoPrefixCliFlag, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as shouldRetainResource, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDockerImage, _i as isImpossibleEmptyStoredAttribute, _l as ownValue, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as recordMaskOnlyValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as rewriteTemplateAssetReferences, al as decodeListingKey, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerExecFailure, bi as isNamelessDynamicReferenceError, bl as displayAssemblyPath, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoParameterFreshValue, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as assertAssetBucketRegion, cl as canonicalizeRegion, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as isCrossRegionRedirect, di as producerRegionsFromState, dl as StageLoadError, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as stringifyValue, ei as AWS_CREDENTIAL_ENV_KEYS, el as CFN_TEMPLATE_URL_LIMIT, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as parseBootstrapMarker, fi as regionLessSecretName, fl as processStackMessages, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as buildDenyExternalAccessPolicy, gi as getAccountInfo, gl as nullPrototypeRecord, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as provenPublicValue, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateContainerRepoName, hi as parameterTypeMayLoseSecretIdentity, hl as hasPlainPrototype, hn as secretBearing, hr as isCustomResource, hs as carriesSecretMask, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as loadPublishableAssetManifest, il as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as runDockerForeground, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as S3StateBackend, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as redactDockerArgvValues, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as LockManager, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as ensureAssetStorage, ll as derivePartitionAndUrlSuffix, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as validateAssetBucketName, mi as isUnboundTemplateParameter, ml as hasOwnKey, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as splitGetAttStringForm, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as buildAssetRedirectMap, ni as callerEnvCredentials, nl as findLargeInlineResources, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as AssetModeResolver, ol as expectedOwnerParam, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as readBootstrapMarkerBody, pi as coerceParameterTypedValue, pl as defineOwnKey, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as recordPhysicalNameCopy, pt as resourcesNamingDeclaredParameter, qc as resolveStateBucketWithDefault, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputs, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as createAssetRedirectResolver, ri as envCredentialsAreAssumedRole, rl as uploadCfnTemplate, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as BOOTSTRAP_MARKER_PREFIX, sl as PARTITION_TABLE, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as WorkGraph, ti as applyCallerIdentityCredentials, tl as MIGRATE_TMP_PREFIX, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as getBootstrapMarkerKey, ui as classifyReplaySecretRegion, ul as AssemblyReader, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as resolveDockerContextDirectory, vi as carriesDynamicReference, vl as absoluteAssemblyPathEscape, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValuesIn, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as formatDockerLoginError, wi as isStalePlaceholderArnAttribute, wl as resolveBucketRegion, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_CROSS_GENERATION_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerFailure, xi as keepsSecretReferenceToken, xl as renderAssemblyPathEscape, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordProvenPublicExpression, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as describeDockerCapturedOutput, yi as carriesFetchableDynamicReference, yl as describeFileReadFailure, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordNoEchoAttributeValues, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as synthesisStatusMessage, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as splitImportedOps, zt as destroyStackRecordsView } from "./deploy-engine-A-Ys_mhE.js";
+import { t as getCdkdVersion } from "./version-CItAaDXu.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1921,18 +1921,15 @@ function refuseMalformedNestedTemplateTrees(stacks) {
 const REQUIRE_APPROVAL_VALUES = [
 	"never",
 	"any-change",
+	"broadening",
 	"destructive"
 ];
-const requireApprovalOption = new Option("--require-approval <level>", "What changes require manual approval before they are deployed: \"never\" (default), \"any-change\", or \"destructive\" (a change that replaces, deletes or orphans an existing resource, including in nested stacks). Without a terminal the deploy fails instead of asking, unless --yes is given. Also read from \"requireApproval\" in cdk.json.").choices(REQUIRE_APPROVAL_VALUES);
-function resolveRequireApproval(cliValue, logger, cdkJson = loadCdkJson()) {
+const requireApprovalOption = new Option("--require-approval <level>", "What changes require manual approval before they are deployed: \"never\" (default), \"any-change\", \"broadening\" (a change that broadens IAM permissions or security-group rules), or \"destructive\" (a change that replaces, deletes or orphans an existing resource). Both \"broadening\" and \"destructive\" check nested stacks too. Without a terminal the deploy fails instead of asking, unless --yes is given. Also read from \"requireApproval\" in cdk.json.").choices(REQUIRE_APPROVAL_VALUES);
+function resolveRequireApproval(cliValue, cdkJson = loadCdkJson()) {
 	if (cliValue !== void 0) return cliValue;
 	const configured = cdkJson?.requireApproval;
 	if (configured === void 0) return "never";
 	if (REQUIRE_APPROVAL_VALUES.includes(configured)) return configured;
-	if (configured === "broadening") {
-		logger.warn(`cdk.json "requireApproval": "broadening" is ignored: cdkd does not detect security-broadening changes, so no approval is asked. Use "any-change" or "destructive" to have cdkd ask.`);
-		return "never";
-	}
 	throw new CdkdError(`cdk.json "requireApproval" must be one of ${REQUIRE_APPROVAL_VALUES.join(", ")}, got: ${displayIdent(typeof configured === "string" ? configured : JSON.stringify(configured))}`, "INVALID_REQUIRE_APPROVAL");
 }
 function createApprovalPrompter(options) {
@@ -1949,14 +1946,18 @@ function createApprovalPrompter(options) {
 }
 function renderApprovalRequest(request) {
 	const lines = [""];
-	if (request.destructiveChanges.length > 0) {
+	if (request.securityChanges !== void 0 && request.securityChanges !== "") {
+		lines.push(request.securityChanges.replace(/\n+$/, ""));
+		lines.push("");
+	}
+	if (request.destructiveChanges.length > 0 && request.level !== "broadening") {
 		lines.push("Destructive changes:");
 		for (const change of request.destructiveChanges) lines.push(`  ${formatDestructiveChange(change)}`);
 		lines.push("");
 	}
 	const { create, update, delete: del } = request.counts;
 	lines.push(request.outputsOnly ? `Stack ${displayIdent(request.stackName)}: no resource changes; its Outputs change.` : `Stack ${displayIdent(request.stackName)}: ${create} to create, ${update} to update, ${del} to delete.`);
-	lines.push(request.level === "destructive" ? `Stack includes destructive updates and "--require-approval" is set to 'destructive'.` : `Stack includes updates and "--require-approval" is set to 'any-change'.`);
+	lines.push(request.level === "destructive" ? `Stack includes destructive updates and "--require-approval" is set to 'destructive'.` : request.level === "broadening" ? `Stack includes security-sensitive updates and "--require-approval" is set to 'broadening'.` : `Stack includes updates and "--require-approval" is set to 'any-change'.`);
 	return `${lines.join("\n")}\n`;
 }
 
@@ -2375,12 +2376,13 @@ function inferCrossStackStackDeps(stacks, opts) {
 	const result = /* @__PURE__ */ new Map();
 	for (const stack of stacks) {
 		const producers = /* @__PURE__ */ new Set();
-		collectCrossStackRefs(stack.template, (kind, value) => {
+		collectTemplateCrossStackRefs(stack.template, (kind, value, unconditional) => {
 			let producer;
 			if (kind === "ImportValue") {
 				if (!wantImportValue) return;
 				if (typeof value === "string") producer = exportOwner.get(value);
 			} else {
+				if (opts?.onRoleArnReference && unconditional && value && typeof value === "object" && !Array.isArray(value) && Object.hasOwn(value, "RoleArn")) opts.onRoleArnReference(stack.stackName, value);
 				if (!wantGetStackOutput) return;
 				if (value && typeof value === "object" && !Array.isArray(value)) {
 					const sn = value["StackName"];
@@ -2393,23 +2395,45 @@ function inferCrossStackStackDeps(stacks, opts) {
 	}
 	return result;
 }
-function collectCrossStackRefs(node, onRef) {
+function collectTemplateCrossStackRefs(template, onRef) {
+	if (!template || typeof template !== "object" || Array.isArray(template)) {
+		collectCrossStackRefs(template, onRef, false);
+		return;
+	}
+	for (const [section, body] of Object.entries(template)) {
+		if (section !== "Resources" || !body || typeof body !== "object" || Array.isArray(body)) {
+			collectCrossStackRefs(body, onRef, false);
+			continue;
+		}
+		for (const resource of Object.values(body)) {
+			if (!resource || typeof resource !== "object" || Array.isArray(resource)) {
+				collectCrossStackRefs(resource, onRef, false);
+				continue;
+			}
+			const record = resource;
+			const always = !Object.hasOwn(record, "Condition");
+			for (const [key, value] of Object.entries(record)) collectCrossStackRefs(value, onRef, always && key === "Properties");
+		}
+	}
+}
+function collectCrossStackRefs(node, onRef, unconditional) {
 	if (!node || typeof node !== "object") return;
 	if (Array.isArray(node)) {
-		for (const item of node) collectCrossStackRefs(item, onRef);
+		for (const item of node) collectCrossStackRefs(item, onRef, unconditional);
 		return;
 	}
 	const obj = node;
-	if ("Fn::ImportValue" in obj) onRef("ImportValue", obj["Fn::ImportValue"]);
-	if ("Fn::GetStackOutput" in obj) onRef("GetStackOutput", obj["Fn::GetStackOutput"]);
-	for (const value of Object.values(obj)) collectCrossStackRefs(value, onRef);
+	if ("Fn::ImportValue" in obj) onRef("ImportValue", obj["Fn::ImportValue"], unconditional);
+	if ("Fn::GetStackOutput" in obj) onRef("GetStackOutput", obj["Fn::GetStackOutput"], unconditional);
+	const below = unconditional && !("Fn::If" in obj);
+	for (const value of Object.values(obj)) collectCrossStackRefs(value, onRef, below);
 }
 
 //#endregion
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-uUFRfL9s.js");
+	providerClasses ??= import("./provider-classes-CuZ-P4gB.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2919,7 +2943,7 @@ async function deployCommand(stacks, options) {
 	validateResourceTimeouts(options);
 	setResolvedResourceTimeouts(options.resourceTimeout);
 	applyWaitFlagEnv(options);
-	const requireApproval = resolveRequireApproval(options.requireApproval, logger);
+	const requireApproval = resolveRequireApproval(options.requireApproval);
 	const approveDeployment = requireApproval !== "never" && !options.dryRun ? createApprovalPrompter({ yes: options.yes ?? false }) : void 0;
 	const rawBaseRegion = rawCliRegion(options.region) ?? "us-east-1";
 	foldRegionOption(options);
@@ -3016,7 +3040,12 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			const gone = stacksNoLongerSelected(allStacks, stackPatterns, /* @__PURE__ */ new Set());
 			throw new Error(renderNoStackMatch(stackPatterns, allStacks) + (gone.stacks.length > 0 ? `\n${renderStacksNoLongerSelected(gone.patterns, gone.stacks)}` : ""));
 		}
-		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks);
+		const roleArnReferences = [];
+		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks, { onRoleArnReference: (consumer, args) => roleArnReferences.push({
+			consumer,
+			args
+		}) });
+		const producerLookup = producerLookupOver(allStacks);
 		const effectiveStackDeps = (stackName, deps) => {
 			const union = new Set(deps);
 			for (const producer of inferredCrossStackDeps.get(stackName) ?? []) union.add(producer);
@@ -3058,6 +3087,13 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			ignoreErrors: options.ignoreErrors === true
 		});
 		refuseMalformedNestedTemplateTrees(targetStacks);
+		if (roleArnReferences.length > 0) {
+			const stackByName = new Map(allStacks.map((s) => [s.stackName, s]));
+			refuseUnreadableCdkCrossAccountRefs(roleArnReferences, new Set(targetStacks.map((s) => s.stackName)), (name) => ({
+				region: stackByName.get(name)?.region ?? namedCliRegion(options.region),
+				account: stackByName.get(name)?.account
+			}), producerLookup);
+		}
 		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
@@ -3283,6 +3319,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					finalSnapshotClients: stackAwsClients,
 					...options.strictGetatt && { strictGetAtt: true },
 					...options.cfnFallback === false && { cfnFallback: false },
+					producerLookup,
+					...stackInfo.account && { consumerAccount: stackInfo.account },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -4662,10 +4700,14 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 	return changed ? shown : change;
 }
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
-	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate, inheritedSecrets, inheritedDerivedNames, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
+	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedDerivedNames, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
-	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
+	const intrinsicResolver = new IntrinsicFunctionResolver(region, {
+		cfnFallback: cfnFallback ?? true,
+		...producerLookup && { producerLookup },
+		...consumerAccount && { consumerAccount }
+	});
 	const outputsDigestSource = structuredClone({
 		...template,
 		Resources: {}
@@ -4782,8 +4824,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const diffSecrets = /* @__PURE__ */ new Map();
 	const splitPieces = /* @__PURE__ */ new Map();
 	const derivedNames = /* @__PURE__ */ new Map();
-	const splitDelimiters = literalSplitDelimitersOf(template, new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name)));
-	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && mergedParameters !== void 0 && Object.prototype.hasOwnProperty.call(mergedParameters, name) && !isWholeDynamicReferenceValue(mergedParameters[name])) {
+	const splitDelimiters = literalSplitDelimitersOf(template, new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => declaresNoEcho(definition)).map(([name]) => name)));
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition) && mergedParameters !== void 0 && Object.prototype.hasOwnProperty.call(mergedParameters, name) && !isWholeDynamicReferenceValue(mergedParameters[name])) {
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
 		recordLogOnlyParameterValue(splitPieces, mergedParameters[name], splitDelimiters);
 	}
@@ -4997,6 +5039,13 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	}
 	return {
 		changes: shownChanges,
+		securityDiff: () => diffSecurity({
+			stackName,
+			changes: changes.values(),
+			records: stateForDiff.resources,
+			template: effectiveTemplate,
+			secretMask: () => printing.mask
+		}),
 		outputChanges: shownOutputChanges,
 		adoptedOrphans,
 		adoptedRecords,
@@ -5180,10 +5229,14 @@ function noEchoFedChildParameters(parentStackRow, parentNoEchoParameters, parent
 	})) fed.add(name);
 	return fed;
 }
-async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust, derivedNameSink) {
+async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust, derivedNameSink, producerLookup, consumerAccount) {
 	const rawParams = parentStackRow.Properties?.["Parameters"];
 	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return {};
-	const resolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
+	const resolver = new IntrinsicFunctionResolver(region, {
+		cfnFallback: cfnFallback ?? true,
+		...producerLookup && { producerLookup },
+		...consumerAccount && { consumerAccount }
+	});
 	const resolved = {};
 	for (const [name, value] of Object.entries(rawParams)) {
 		if (trust === void 0 || !rowValueTrusted(value, parentState, parentConditions, trust)) unresolvedKeys?.add(name);
@@ -5219,7 +5272,7 @@ function recordedTemplateResources(template, state) {
 	return recorded;
 }
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, producerLookup, consumerAccount, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery } = args;
 	const attributeHealer = attributeHealerFor?.(stackName, region);
 	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
@@ -5231,6 +5284,8 @@ async function buildDiffTree(args) {
 			...parentUnresolvedParameters && { parentUnresolvedParameters },
 			...canonicalizeProperties && { canonicalizeProperties },
 			...cfnFallback !== void 0 && { cfnFallback },
+			...producerLookup && { producerLookup },
+			...consumerAccount && { consumerAccount },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
 			...inheritedDerivedNames && { inheritedDerivedNames },
@@ -5245,7 +5300,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -5258,6 +5313,7 @@ async function buildDiffTree(args) {
 		displayName,
 		region,
 		changes,
+		securityDiff,
 		ccApiRoutes: collectCcApiRoutes(effectiveTemplate, stateAfterAdoption, changes),
 		outputChanges,
 		adoptedOrphans,
@@ -5295,7 +5351,7 @@ async function buildDiffTree(args) {
 			...inheritedNoEchoParametersAnyVerdict ?? []
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust, rowDerivedNames);
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount);
 		const childDerivedNames = diffPrintingSecrets([
 			inheritedDerivedNames,
 			rowDerivedNames,
@@ -5315,6 +5371,8 @@ async function buildDiffTree(args) {
 			...canonicalizeProperties && { canonicalizeProperties },
 			...assetRedirect && { assetRedirect },
 			...cfnFallback !== void 0 && { cfnFallback },
+			...producerLookup && { producerLookup },
+			...consumerAccount && { consumerAccount },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...attributeHealerFor && { attributeHealerFor },
 			ancestorTemplatePaths: childAncestorTemplatePaths,
@@ -5342,7 +5400,7 @@ async function buildDiffTree(args) {
 async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery, inheritedDerivedNames) {
 	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const derivedNames = diffPrintingSecrets([inheritedDerivedNames, stateDerivedNames(state.resources ?? {})]);
-	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, {
+	const { changes, securityDiff, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, {
 		inheritSecretBearingTemplate: parentHasSecretReference,
 		inheritedSecrets,
 		...hasMaskableValues(derivedNames) && { inheritedDerivedNames: derivedNames },
@@ -5353,6 +5411,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		displayName: stackName,
 		region,
 		changes,
+		securityDiff,
 		ccApiRoutes: /* @__PURE__ */ new Map(),
 		adoptedOrphans: [],
 		blocking: [],
@@ -5649,9 +5708,20 @@ function renderDiffTree(node, isRoot, logFn) {
 
 //#endregion
 //#region src/cli/commands/diff.ts
+function treeNodes(node) {
+	return [node, ...node.children.flatMap(treeNodes)];
+}
+function securityDiffOf(node) {
+	if (node.securityDiff === void 0) throw new CdkdError(safeMsg`No security diff for stack ${node.displayName}; its security changes cannot be decided.`, "SECURITY_DIFF_FAILED");
+	return node.securityDiff();
+}
+function logTable(rendered, log) {
+	for (const row of rendered.replace(/\n+$/, "").split("\n")) log(safeMsg`${row}`);
+}
 const DIFF_FAIL_ON_VALUES = [
 	"never",
 	"any-change",
+	"broadening",
 	"destructive"
 ];
 function parseFailOn(value, previous) {
@@ -5682,6 +5752,8 @@ var DeployRefusalPreviewError = class DeployRefusalPreviewError extends CdkdErro
 };
 async function diffCommand(stacks, options) {
 	const failOn = resolveFailOn(options);
+	const securityOnly = options.securityOnly === true;
+	if (securityOnly && options.json === true) throw new CdkdError("--security-only cannot be used with --json: it prints the security tables only", "INCOMPATIBLE_OPTIONS");
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
 	if (options.json) logger.setLevel("warn");
@@ -5808,7 +5880,7 @@ async function diffCommand(stacks, options) {
 			}).provider,
 			inRegion: (healRegion, fn) => runWithStackAwsClients(stackRegionScope(healRegion).clients, fn)
 		});
-		const recursive = (options.recursive ?? false) || failOn === "destructive";
+		const recursive = (options.recursive ?? false) || failOn === "destructive" || failOn === "broadening" || securityOnly;
 		const resolveAssetRedirect = createAssetRedirectResolver({
 			stateBackend,
 			stsRegion: region,
@@ -5817,6 +5889,7 @@ async function diffCommand(stacks, options) {
 			suppressLegacyNotice: true
 		});
 		const trees = [];
+		const producerLookup = producerLookupOver(allStacks);
 		for (const stackInfo of targetStacks) {
 			logger.info(`\nCalculating diff for stack: ${stackInfo.stackName}`);
 			const stackRegion = stackInfo.region || region;
@@ -5837,13 +5910,41 @@ async function diffCommand(stacks, options) {
 				canonicalizeProperties,
 				...assetRedirect && { assetRedirect },
 				...options.cfnFallback === false && { cfnFallback: false },
+				producerLookup,
+				...stackInfo.account && { consumerAccount: stackInfo.account },
 				previewOrphanAdoption,
 				attributeHealerFor,
 				isNestedChild: false,
 				refusalRecovery
 			}));
 		}
-		if (options.json) process.stdout.write(`${stringifyJsonPayload(trees.map(diffTreeToJson))}\n`);
+		let securityDifferences = 0;
+		let securityBroadening = false;
+		if (securityOnly) for (const tree of trees) {
+			const nodes = treeNodes(tree);
+			for (const node of nodes) for (const reason of node.blocking) logger.error(safeMsg`Blocking (${node.displayName}): ${reason}`);
+			const results = [];
+			for (const node of nodes) results.push({
+				node,
+				security: await securityDiffOf(node)
+			});
+			if (!results.some(({ security }) => security.broadening)) {
+				logger.info(safeMsg`\n✓ No security-broadening changes for stack ${tree.displayName}`);
+				continue;
+			}
+			securityBroadening = true;
+			securityDifferences += results.filter(({ security }) => security.rendered !== "").length;
+			logger.warn("This deployment will make potentially sensitive changes according to your current security approval level.\nPlease confirm you intend to make the following modifications:\n");
+			for (const { node, security } of results) {
+				logger.info(safeMsg`Stack ${node.displayName}`);
+				if (security.rendered === "") {
+					logger.info("There were no security-related changes (limitations: https://github.com/aws/aws-cdk/issues/1299)");
+					continue;
+				}
+				logTable(security.rendered, (row) => logger.info(row));
+			}
+		}
+		else if (options.json) process.stdout.write(`${stringifyJsonPayload(trees.map(diffTreeToJson))}\n`);
 		else for (const tree of trees) {
 			if (!treeIsWorthRendering(tree)) {
 				logger.info(`\n✓ No changes detected for stack ${tree.stackName}`);
@@ -5853,7 +5954,7 @@ async function diffCommand(stacks, options) {
 		}
 		const blockingCount = trees.reduce((n, tree) => n + countBlocking(tree), 0);
 		if (blockingCount > 0) throw new DeployRefusalPreviewError(blockingCount);
-		if (failOn === "any-change" && trees.some(treeHasChanges)) throw new DiffDetectedError();
+		if (failOn === "any-change" && (securityOnly ? securityDifferences > 0 : trees.some(treeHasChanges))) throw new DiffDetectedError();
 		if (failOn === "destructive") {
 			const destructive = trees.flatMap(treeDestructiveChanges);
 			if (destructive.length > 0) {
@@ -5862,13 +5963,26 @@ async function diffCommand(stacks, options) {
 				throw new DiffDetectedError();
 			}
 		}
+		if (failOn === "broadening" && securityOnly) {
+			if (securityBroadening) throw new DiffDetectedError();
+		} else if (failOn === "broadening") {
+			let broadening = 0;
+			for (const node of trees.flatMap(treeNodes)) {
+				const security = await securityDiffOf(node);
+				if (!security.broadening) continue;
+				broadening++;
+				logger.error(safeMsg`\n❌  Stack ${node.displayName} broadens permissions (--fail-on=broadening):`);
+				logTable(security.rendered, (row) => logger.error(row));
+			}
+			if (broadening > 0) throw new DiffDetectedError();
+		}
 	} finally {
 		for (const { clients } of stackRegionScopes.values()) clients.destroy();
 		awsClients.destroy();
 	}
 }
 function createDiffCommand() {
-	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts CDK display paths (e.g. 'MyStage/Api') with wildcards ('MyStage/*', '**'), or exact physical CloudFormation names (e.g. 'MyStage-Api').").option("--all", "Diff every top-level stack (top-level only; Stage stacks: '**')", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). Alias for --fail-on=any-change.").option("--no-fail", "Never exit with code 1 for a change. Alias for --fail-on=never.").addOption(new Option("--fail-on <kind>", "Exit with code 1 when the diff contains the given kind of change: \"any-change\" fails on any difference, \"destructive\" only on changes that replace, delete or orphan a resource, \"never\" does not fail (default). \"destructive\" always checks nested stacks (as --recursive); the others do with --recursive. Cannot be used with --fail / --no-fail.").choices(DIFF_FAIL_ON_VALUES).argParser(parseFailOn)).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).addOption(noCfnFallbackOption).action(withErrorHandling(diffCommand));
+	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts CDK display paths (e.g. 'MyStage/Api') with wildcards ('MyStage/*', '**'), or exact physical CloudFormation names (e.g. 'MyStage-Api').").option("--all", "Diff every top-level stack (top-level only; Stage stacks: '**')", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). Alias for --fail-on=any-change.").option("--no-fail", "Never exit with code 1 for a change. Alias for --fail-on=never.").addOption(new Option("--fail-on <kind>", "Exit with code 1 when the diff contains the given kind of change: \"any-change\" fails on any difference, \"broadening\" only on changes that broaden IAM permissions or security-group rules, \"destructive\" only on changes that replace, delete or orphan a resource, \"never\" does not fail (default). \"broadening\" and \"destructive\" always check nested stacks (as --recursive); \"any-change\" does with --recursive. Cannot be used with --fail / --no-fail.").choices(DIFF_FAIL_ON_VALUES).argParser(parseFailOn)).option("--security-only", "Only print the security changes (IAM and security-group) of each stack whose changes broaden permissions, and count only those stacks as differences for --fail-on (matches cdk diff --security-only). Checks nested stacks too. Cannot be used with --json.").option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).addOption(noCfnFallbackOption).action(withErrorHandling(diffCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -7618,7 +7732,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			...recordedSecretValues && { recordedSecretValues },
 			producerRegions,
 			bestEffort: true,
-			...inheritedSecrets && { inheritedSecrets }
+			...inheritedSecrets && { inheritedSecrets },
+			...nestedInput && copiesOfParentRow(nestedInput.inheritedSecrets)
 		});
 		const resolveCrossStackReads = makeCrossStackPrePass({
 			stackName: stack.stackName,
@@ -8306,6 +8421,10 @@ function noEchoFilledRowParameters(rowProperties, sources, needleSources) {
 		conditional
 	};
 }
+function copiesOfParentRow(bag) {
+	const copies = physicalNameCopiesOf.get(bag);
+	return copies === void 0 || copies.size === 0 ? {} : { inheritedPhysicalNameCopies: copies };
+}
 
 //#endregion
 //#region src/analyzer/drift-normalize.ts
@@ -9959,7 +10078,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					setAtPath(newBaseline, change.path, change.awsValue);
 					accepted.push(change);
 				}
-				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, hasObserved ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES);
+				const redactedBaseline = withPhysicalNameCopies(outcome.secrets, otherPhysicalIds(report.state.resources, outcome.logicalId), () => redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, hasObserved ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 				let recordedChanges = 0;
 				for (const change of accepted) {
 					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
@@ -10452,6 +10571,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						provisionedBy: stateResource.provisionedBy
 					}).provider;
 					const secrets = /* @__PURE__ */ new Map();
+					for (const id of otherPhysicalIds(report.state.resources, outcome.logicalId)) recordPhysicalNameCopy(secrets, id);
 					const revertBaseline = stateResource.observedProperties ?? stateResource.properties ?? {};
 					const unresolvedTokens = /* @__PURE__ */ new Set();
 					const noteUnresolved = (tokens) => {
@@ -10998,6 +11118,11 @@ function maskMarkedNoEchoBaselineWithLeaves(baseline, record, observed) {
 		...widened.length > 0 && { noEchoLeaves: canonicalCoordinates([...marked, ...widened]) }
 	};
 }
+function otherPhysicalIds(resources, logicalId) {
+	const ids = [];
+	for (const [id, record] of Object.entries(resources ?? {})) if (id !== logicalId && typeof record?.physicalId === "string") ids.push(record.physicalId);
+	return ids;
+}
 
 //#endregion
 //#region src/cli/commands/stack-lock-guard.ts
@@ -11156,6 +11281,7 @@ function holdsSecretDerivedPrincipalRecord(resource) {
 
 //#endregion
 //#region src/cli/commands/destroy-runner.ts
+const NOECHO_PRINTING_BIND_CAP_MS = 1e4;
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
 function recordDestroyEvent(recorder, event) {
 	recorder?.record(maskEventTextWithBoundBags(event));
@@ -11284,15 +11410,37 @@ async function runDestroyForStack(stackName, state, ctx) {
 	logger.info(`\nResources to be deleted (${resourceCount}):`);
 	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)})`);
 	const protectedCount = ctx.removeProtection ? countProtectedResources(state) + countProtectedJournaledOrphans(journaledOrphans, state.region) : 0;
+	let binding;
+	const stackNoEchoValues = () => {
+		if (binding === void 0) {
+			let timer;
+			const capped = new Promise((resolve) => {
+				timer = setTimeout(() => {
+					logger.warn(safeMsg`The stack's NoEcho values were not bound within ${NOECHO_PRINTING_BIND_CAP_MS / 1e3}s, ` + "so a resource name taken from one may print unmasked where state holds it in plaintext (state written before schema v11).");
+					resolve(void 0);
+				}, NOECHO_PRINTING_BIND_CAP_MS);
+				timer.unref?.();
+			});
+			binding = {
+				bound: Promise.resolve().then(() => ctx.noEchoReresolver?.printingNoEchoValues()).catch(() => void 0).finally(() => clearTimeout(timer)),
+				capped
+			};
+		}
+		return Promise.race([binding.bound, binding.capped]);
+	};
 	const orphansAtDestroy = state.orphans ?? [];
 	if (orphansAtDestroy.length > 0) {
 		logger.info(`\n${orphansAtDestroy.length} resource(s) are still in AWS from an earlier failed deploy. cdkd left them there because their DeletionPolicy is Retain (CDK's RemovalPolicy.RETAIN), and has been tracking them so a later deploy of this stack could adopt them back instead of colliding with their names.`);
 		logger.info("Destroying this stack deletes that record. The resources stay in AWS, may continue to incur charges, and cdkd will no longer know about them:");
-		for (const entry of orphansAtDestroy) logger.info(`  - ${displaySafe(entry.logicalId)} (${displaySafe(entry.state.resourceType)})  ${displaySafe(entry.state.physicalId)}`);
+		const orphanListing = orphanRecordsPrintingBag(orphansAtDestroy, await stackNoEchoValues());
+		for (const entry of orphansAtDestroy) withPrintingSecrets(orphanListing, () => logger.info(`  - ${displaySafe(entry.logicalId)} (${displaySafe(entry.state.resourceType)})  ${displaySafe(entry.state.physicalId)}`));
 	}
 	if (journaledOrphans.count > 0) {
 		logger.info(`\n${journaledOrphans.count} resource(s) were created by a failed deploy and are recorded only in the rollback journal. Each is deleted first as its DeletionPolicy directs (Retain keeps it in AWS, Snapshot takes the final snapshot), unless state or a later deploy may own it, which is warned about instead:`);
-		for (const line of journaledOrphanLines(journaledOrphans, logger)) logger.info(line);
+		const listing = journaledOrphanPrintingBag(journaledOrphans.segments.flatMap(({ ops }) => ops), state.resources, await stackNoEchoValues());
+		withPrintingSecrets(listing, () => {
+			for (const line of journaledOrphanLines(journaledOrphans, logger)) logger.info(line);
+		});
 	}
 	if (!ctx.skipConfirmation) {
 		if (process.stdin.isTTY !== true) throw new CdkdError(`The destroy confirmation prompt for stack ${displayStackName(stackName)} cannot run in a non-interactive environment. Pass --yes / -y to confirm the destroy (cdkd destroy also accepts -f / --force), or run the command from a real terminal.`, "NON_INTERACTIVE_CONFIRM");
@@ -11439,9 +11587,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 		secretPrincipalRegions = ctx.resolveSecretDerivedPrincipals !== void 0 && (state.parentStack === void 0 || ctx.resolveSecretDerivedPrincipals.inheritedProducerRegions !== void 0) ? destroyProducerRegions(state, ctx.resolveSecretDerivedPrincipals.inheritedProducerRegions) : void 0;
 		if (ctx.resolveSecretDerivedPrincipals !== void 0 && secretPrincipalRegions === void 0 && Object.values(state.resources ?? {}).some((r) => holdsSecretDerivedPrincipalRecord(r))) logger.warn(safeMsg`${stackName}: this nested child's secret-derived principal records resolve when destroyed through its parent stack; destroyed on its own they are skipped.`);
 		renderer.start();
+		stackNoEchoValues();
 		const journaledUnderLock = await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, state.orphans, journaledOrphans.unreadable === true ? { warn: () => void 0 } : logger);
 		if (journaledUnderLock.unreadable === true && journaledOrphans.unreadable !== true) throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was readable when this run started and cannot be read now (see the warning above). Nothing was deleted; re-run the destroy once it can be read.`);
 		if (!sameJournaledOrphans(journaledUnderLock, journaledOrphans)) throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) recorded ${journaledOrphans.count} resource(s) a failed deploy created when this run started and ${journaledUnderLock.count} now, not the same ones — another cdkd process wrote to it. Nothing was deleted; re-run the destroy to act on the current journal.`);
+		const noEchoValues = await stackNoEchoValues();
 		if (journaledUnderLock.count > 0) {
 			const orphanOutcome = await deleteJournaledOrphans(journaledUnderLock, { ...state.resources }, stackName, {
 				providerRegistry: destroyProviderRegistry,
@@ -11457,7 +11607,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 				}),
 				importedProducerRegions: producerRegionsFromState(state),
 				...state.parentStack !== void 0 && { producerRegionsIncomplete: true }
-			}, { isInterrupted: () => lock.interrupted });
+			}, {
+				isInterrupted: () => lock.interrupted,
+				noEchoValues
+			});
 			result.errorCount += orphanOutcome.failures;
 			journaledOrphanFailures = orphanOutcome.failures;
 			result.skippedCount += orphanOutcome.skipped;
@@ -11518,6 +11671,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		const graph = dagBuilder.buildGraph(template);
 		const executionLevels = dagBuilder.getExecutionLevels(graph);
 		logger.debug(`Dependency graph: ${executionLevels.length} level(s)`);
+		const printingBagOf = secretNamePrintingBags(state.resources, noEchoValues);
 		for (let levelIndex = executionLevels.length - 1; levelIndex >= 0; levelIndex--) {
 			if (lock.interrupted) {
 				logger.debug("Interrupted (draining) — not scheduling further deletion levels");
@@ -11527,7 +11681,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (!level) continue;
 			logger.debug(`Deletion level ${executionLevels.length - levelIndex}/${executionLevels.length} (${level.length} resources)`);
 			const stackRegion = state.region ?? ctx.baseRegion;
-			const deletePromises = level.map((logicalId) => withPrintingSecrets(secretNamePrintingBag(logicalId, state.resources), async () => {
+			const deletePromises = level.map((logicalId) => withPrintingSecrets(printingBagOf(logicalId), async () => {
 				if (lock.interrupted) return;
 				const resource = state.resources[logicalId];
 				if (!resource) {
@@ -20639,10 +20793,53 @@ function noEchoAttributeNamesCarried(prior, attributes) {
 	const kept = prior.filter((name) => typeof name === "string" && hasOwnKey(attributes, name) && carriesSecretMask(attributes[name]));
 	return kept.length > 0 ? { noEchoAttributeNames: kept } : {};
 }
+const READS_EVERY_KEY = Symbol("reads every key");
+function templateGetAttReads(template) {
+	const reads = /* @__PURE__ */ new Map();
+	const addRead = (logicalId, attribute) => {
+		let attributes = reads.get(logicalId);
+		if (!attributes) {
+			attributes = /* @__PURE__ */ new Set();
+			reads.set(logicalId, attributes);
+		}
+		if (typeof attribute === "string") {
+			const segments = attribute.split(".");
+			for (let i = 1; i <= segments.length; i++) attributes.add(segments.slice(0, i).join("."));
+		} else attributes.add(READS_EVERY_KEY);
+	};
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		for (const [key, inner] of Object.entries(value)) {
+			if (key === "Fn::GetAtt") {
+				if (Array.isArray(inner) && typeof inner[0] === "string") addRead(inner[0], inner[1]);
+				else if (typeof inner === "string") {
+					const split = splitGetAttStringForm(inner);
+					if (split) addRead(split.logicalId, split.attributeName);
+				}
+			} else if (key === "Fn::Sub") {
+				const text = Array.isArray(inner) ? inner[0] : inner;
+				if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}]*)\}/g)) {
+					const ref = match[1] ?? "";
+					if (ref.startsWith("!")) continue;
+					const split = splitGetAttStringForm(ref);
+					if (split) addRead(split.logicalId, split.attributeName);
+				}
+			}
+			walk(inner);
+		}
+	};
+	walk(template);
+	return reads;
+}
 function buildStackState(stackName, region, rows, templateParser, template, existingState, selectiveMode) {
 	const resources = selectiveMode && existingState ? { ...existingState.resources } : {};
 	const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
 	let namesParameter;
+	const getAttReads = templateGetAttReads(template);
 	for (const row of rows) {
 		if (row.outcome !== "imported" || !row.physicalId) continue;
 		const tmplResource = template.Resources[row.logicalId];
@@ -20654,10 +20851,14 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		const { stillMaskedKeys, keptRecordedKeys } = reimported;
 		const attributes = withDeclaredNoEchoMasked(reimported.attributes, prior && prior.physicalId === row.physicalId ? prior.noEchoAttributeNames : void 0);
 		if (keptRecordedKeys.length > 0) getLogger().info(safeMsg`${displayIdent(row.logicalId)}: this import recorded ` + safeMsg`${keptRecordedKeys.map((key) => displayIdent(key)).join(", ")} only as the ` + "redaction mask, so the previously recorded value is kept; a deploy that updates the resource rewrites it.");
-		if (stillMaskedKeys.length > 0) {
-			const keys = stillMaskedKeys.map((key) => displayIdent(key)).join(", ");
-			const pronoun = stillMaskedKeys.length === 1 ? "it" : "them";
-			getLogger().warn(safeMsg`${displayIdent(row.logicalId)}: this import produced no value to replace the redaction ` + safeMsg`mask recorded under ${keys}, so the mask is kept and an Fn::GetAtt reading ${pronoun} ` + "is still refused at deploy. It is kept rather than cleared because an attribute missing from state resolves to the physical id instead of failing.");
+		const readAttributes = getAttReads.get(row.logicalId);
+		const refusedKeys = stillMaskedKeys.filter((key) => readAttributes?.has(key) === true || readAttributes?.has(READS_EVERY_KEY) === true);
+		const unreadKeys = stillMaskedKeys.filter((key) => !refusedKeys.includes(key));
+		if (unreadKeys.length > 0) getLogger().debug(safeMsg`${displayIdent(row.logicalId)}: the redaction mask stays recorded under ` + safeMsg`${unreadKeys.map((key) => displayIdent(key)).join(", ")}; this template reads none of them.`);
+		if (refusedKeys.length > 0) {
+			const keys = refusedKeys.map((key) => displayIdent(key)).join(", ");
+			const pronoun = refusedKeys.length === 1 ? "it" : "them";
+			getLogger().warn(safeMsg`${displayIdent(row.logicalId)}: this import produced no value to replace the redaction ` + safeMsg`mask recorded under ${keys}, so the mask is kept and an Fn::GetAtt reading ${pronoun} ` + "in this template is still refused at deploy. It is kept rather than cleared because an attribute missing from state resolves to the physical id instead of failing.");
 		}
 		resources[row.logicalId] = {
 			physicalId: row.physicalId,
@@ -28594,4 +28795,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-NRnM6vPK.js.map
+//# sourceMappingURL=program-D5gcmWad.js.map