@go-to-k/cdkd 0.298.1 → 0.298.3

package/dist/{program-D5gcmWad.js → program-BQnReLnG.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
-import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as isStatefulRecreateTargetForReplace, $c as CFN_TEMPLATE_BODY_LIMIT, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as isSensitiveAttributeName, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactedDockerCause, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as isLockInfoExpired, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as getDefaultStateBucketName, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as acceptedCreateOnlyDropsOf, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as finchSecretArgvRefusal, Ci as cfnRefValueFromPhysicalId, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as STATE_SOURCED_BASELINE_RULES, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isMalformedEnvKey, Di as withSharedDrainBudget, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as WHOLE_DYNAMIC_REFERENCE_PATTERN, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as isDockerClientEnvKey, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as TEMPLATE_SOURCED_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as stripControlChars, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as applyCrossPrefixScan, Ft as sameJournaledOrphans, Gc as resolveCaptureObservedState, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasUnverifiableParameterRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as loadCdkJson, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as exportNamesCarriedFrom, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as AssetManifestLoader, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as crossPrefixDeniedWarning, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveStateBucketWithDefaultAndSource, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as isReadableBag, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveSkipPrefix, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as importableOutputKeys, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as getDockerImageBySourceHash, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as isAccessDenied, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as runDockerStreaming, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as rebuildClientForBucketRegion, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as warnFinchArgvExposure, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as CrossPrefixReadError, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as partitionSensitiveEnv, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as isSingleDynamicReferenceToken, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as escapeRegExp, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixScanCache, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as ssmResolvedValueType, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as AssetPublisher, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as Synthesizer, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isNotImplemented, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as dockerSpawnEnvWithSensitive, Si as AWS_NO_VALUE, Sl as resolveAssemblyPath, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as wholeStringLeavesOf, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as getDockerCmd, Ti as refStateLookupFromResource, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_READBACK_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as resolveApp, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as hasReadableExportSet, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as getLegacyStateBucketName, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as describeRegionValueKind, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as resolveAutoAssetStorage, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReasonlessBaselineRefusal, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as stateBucketExistenceConfirmed, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveUseCdkBootstrapAssets, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as orphansAfterRollback, Yt as recheckFailedPlan, Za as shownType, Zc as warnDeprecatedNoPrefixCliFlag, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as shouldRetainResource, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDockerImage, _i as isImpossibleEmptyStoredAttribute, _l as ownValue, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as recordMaskOnlyValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as rewriteTemplateAssetReferences, al as decodeListingKey, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerExecFailure, bi as isNamelessDynamicReferenceError, bl as displayAssemblyPath, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoParameterFreshValue, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as assertAssetBucketRegion, cl as canonicalizeRegion, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as isCrossRegionRedirect, di as producerRegionsFromState, dl as StageLoadError, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as stringifyValue, ei as AWS_CREDENTIAL_ENV_KEYS, el as CFN_TEMPLATE_URL_LIMIT, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as parseBootstrapMarker, fi as regionLessSecretName, fl as processStackMessages, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as buildDenyExternalAccessPolicy, gi as getAccountInfo, gl as nullPrototypeRecord, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as provenPublicValue, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateContainerRepoName, hi as parameterTypeMayLoseSecretIdentity, hl as hasPlainPrototype, hn as secretBearing, hr as isCustomResource, hs as carriesSecretMask, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as loadPublishableAssetManifest, il as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as runDockerForeground, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as S3StateBackend, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as redactDockerArgvValues, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as LockManager, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as ensureAssetStorage, ll as derivePartitionAndUrlSuffix, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as validateAssetBucketName, mi as isUnboundTemplateParameter, ml as hasOwnKey, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as splitGetAttStringForm, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as buildAssetRedirectMap, ni as callerEnvCredentials, nl as findLargeInlineResources, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as AssetModeResolver, ol as expectedOwnerParam, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as readBootstrapMarkerBody, pi as coerceParameterTypedValue, pl as defineOwnKey, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as recordPhysicalNameCopy, pt as resourcesNamingDeclaredParameter, qc as resolveStateBucketWithDefault, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputs, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as createAssetRedirectResolver, ri as envCredentialsAreAssumedRole, rl as uploadCfnTemplate, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as BOOTSTRAP_MARKER_PREFIX, sl as PARTITION_TABLE, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as WorkGraph, ti as applyCallerIdentityCredentials, tl as MIGRATE_TMP_PREFIX, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as getBootstrapMarkerKey, ui as classifyReplaySecretRegion, ul as AssemblyReader, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as resolveDockerContextDirectory, vi as carriesDynamicReference, vl as absoluteAssemblyPathEscape, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValuesIn, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as formatDockerLoginError, wi as isStalePlaceholderArnAttribute, wl as resolveBucketRegion, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_CROSS_GENERATION_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerFailure, xi as keepsSecretReferenceToken, xl as renderAssemblyPathEscape, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordProvenPublicExpression, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as describeDockerCapturedOutput, yi as carriesFetchableDynamicReference, yl as describeFileReadFailure, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordNoEchoAttributeValues, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as synthesisStatusMessage, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as splitImportedOps, zt as destroyStackRecordsView } from "./deploy-engine-A-Ys_mhE.js";
-import { t as getCdkdVersion } from "./version-CItAaDXu.js";
+import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
+import { $a as isStatefulRecreateTargetForReplace, $c as warnDeprecatedNoPrefixCliFlag, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as AssetPublisher, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactDockerArgvValues, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as LockManager, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as Synthesizer, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as splitImportedOps, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as dockerSpawnEnvWithSensitive, Ci as cfnRefValueFromPhysicalId, Cl as renderAssemblyPathEscape, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as wholeStringLeavesOf, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isDockerClientEnvKey, Di as withSharedDrainBudget, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as TEMPLATE_SOURCED_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as getDockerCmd, El as resolveBucketRegion, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as STATE_SOURCED_READBACK_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as escapeRegExp, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as CrossPrefixScanCache, Ft as sameJournaledOrphans, Gc as resolveApp, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasReasonlessBaselineRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as getDefaultStateBucketName, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as describeRegionValueKind, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as stripControlChars, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as applyCrossPrefixScan, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveSkipPrefix, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as importableOutputs, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveAutoAssetStorage, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as hasUnverifiableParameterRefusal, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as stripForDisplay, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as crossPrefixDeniedWarning, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as runDockerForeground, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as S3StateBackend, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as runDockerStreaming, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as rebuildClientForBucketRegion, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as isMalformedEnvKey, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as warnFinchArgvExposure, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixReadError, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as stateBucketExistenceConfirmed, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as shouldRetainResource, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as AssetManifestLoader, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isAccessDenied, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as describeDockerFailure, Si as AWS_NO_VALUE, Sl as displayAssemblyPath, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as recordProvenPublicExpression, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as formatDockerLoginError, Ti as refStateLookupFromResource, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_CROSS_GENERATION_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as getLegacyStateBucketName, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as exportNamesCarriedFrom, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as synthesisStatusMessage, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as acceptedCreateOnlyDropsOf, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as loadCdkJson, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReadableExportSet, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as resolveStateBucketWithDefaultAndSource, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansAfterRollback, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveStateBucketWithDefault, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as isReadableBag, Yt as recheckFailedPlan, Za as shownType, Zc as resolveUseCdkBootstrapAssets, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as orphansCarriedFrom, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDenyExternalAccessPolicy, _i as isImpossibleEmptyStoredAttribute, _l as hasPlainPrototype, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as provenPublicValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as loadPublishableAssetManifest, al as uploadCfnTemplate, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerCapturedOutput, bi as isNamelessDynamicReferenceError, bl as absoluteAssemblyPathEscape, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoAttributeValues, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as BOOTSTRAP_MARKER_PREFIX, cl as expectedOwnerParam, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as getBootstrapMarkerKey, di as producerRegionsFromState, dl as derivePartitionAndUrlSuffix, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as isSensitiveAttributeName, ei as AWS_CREDENTIAL_ENV_KEYS, el as ssmResolvedValueType, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as isCrossRegionRedirect, fi as regionLessSecretName, fl as AssemblyReader, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as validateContainerRepoName, gi as getAccountInfo, gl as hasOwnKey, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as carriesSecretMask, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateAssetBucketName, hi as parameterTypeMayLoseSecretIdentity, hl as defineOwnKey, hn as secretBearing, hr as isCustomResource, hs as splitGetAttStringForm, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as createAssetRedirectResolver, il as findLargeInlineResources, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as redactedDockerCause, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as isLockInfoExpired, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as partitionSensitiveEnv, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as isSingleDynamicReferenceToken, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as assertAssetBucketRegion, ll as PARTITION_TABLE, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as readBootstrapMarkerBody, mi as isUnboundTemplateParameter, ml as processStackMessages, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as recordPhysicalNameCopy, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as WorkGraph, ni as callerEnvCredentials, nl as CFN_TEMPLATE_URL_LIMIT, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as rewriteTemplateAssetReferences, ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as parseBootstrapMarker, pi as coerceParameterTypedValue, pl as StageLoadError, pn as displayTextOrWithheld, pr as ProviderRegistry, pt as resourcesNamingDeclaredParameter, qc as resolveCaptureObservedState, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputKeys, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as buildAssetRedirectMap, ri as envCredentialsAreAssumedRole, rl as MIGRATE_TMP_PREFIX, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as AssetModeResolver, sl as decodeListingKey, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as stringifyValue, ti as applyCallerIdentityCredentials, tl as CFN_TEMPLATE_BODY_LIMIT, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as ensureAssetStorage, ui as classifyReplaySecretRegion, ul as canonicalizeRegion, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as buildDockerImage, vi as carriesDynamicReference, vl as nullPrototypeRecord, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValue, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as finchSecretArgvRefusal, wi as isStalePlaceholderArnAttribute, wl as resolveAssemblyPath, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_BASELINE_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerExecFailure, xi as keepsSecretReferenceToken, xl as describeFileReadFailure, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordNoEchoParameterFreshValue, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as resolveDockerContextDirectory, yi as carriesFetchableDynamicReference, yl as ownValue, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordMaskOnlyValuesIn, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as getDockerImageBySourceHash, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as isNotImplemented, zt as destroyStackRecordsView } from "./deploy-engine-DLGCuN4i.js";
+import { t as getCdkdVersion } from "./version-CWATUXWX.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -28,8 +28,8 @@ import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, describeCredentialLoadFailure, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -2088,6 +2088,11 @@ var ExportIndexStore = class {
 		if (this.loadState.kind !== "loaded") return;
 		return this.loadState.entries.get(exportName);
 	}
+	async prefetch() {
+		try {
+			await this.ensureLoaded();
+		} catch {}
+	}
 	async updateForStack(stackName, producerRegion, outputs) {
 		await this.enqueueWrite("update", () => this.applyStackUpdate(stackName, producerRegion, outputs));
 	}
@@ -2433,7 +2438,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CuZ-P4gB.js");
+	providerClasses ??= import("./provider-classes-BTP4rLU6.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3196,7 +3201,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				region: baseRegion,
 				...options.profile && { profile: options.profile }
 			});
-			const stackLockManager = new LockManager(stateS3Client.s3, stateConfig);
+			const stackLockManager = new LockManager(stateS3Client.s3, stateConfig, { deferReleasePurge: true });
 			const stackProviderRegistry = new ProviderRegistry();
 			registerAllProviders(stackProviderRegistry, providerClasses);
 			stackProviderRegistry.setCustomResourceResponseBucket(stateBucket);
@@ -3395,7 +3400,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				recordRunFailed(eventRecorder, stackInfo.stackName, deployError);
 				throw deployError;
 			} finally {
-				if (eventRecorder) await eventRecorder.finalize(runResult);
+				await Promise.all([eventRecorder?.finalize(runResult), stackLockManager.settleDeferredPurges()]);
 				stackAwsClients.destroy();
 				stateS3Client.destroy();
 			}
@@ -3656,12 +3661,12 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 	};
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
 		if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
-			logger.debug(`Skipping output ${stripControlChars(outputKey)} — condition ${stripControlChars(String(output.Condition))} is false`);
+			logger.debug(`Skipping output ${stripForDisplay(outputKey)} — condition ${stripForDisplay(String(output.Condition))} is false`);
 			await recordSkippedSecretExportName(output);
 			continue;
 		}
 		if (skippedOutputKeys?.has(outputKey) && !(storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, outputKey))) {
-			logger.debug(`Diff previewing output ${stripControlChars(outputKey)} as absent — the last deploy could not resolve it and its template inputs are unchanged`);
+			logger.debug(`Diff previewing output ${stripForDisplay(outputKey)} as absent — the last deploy could not resolve it and its template inputs are unchanged`);
 			if (outputsPass !== void 0) try {
 				await resolveValue(structuredClone(output.Value));
 			} catch {}
@@ -3673,7 +3678,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 		try {
 			value = await resolveValue(structuredClone(output.Value));
 		} catch (error) {
-			logger.debug(`Diff could not resolve output ${stripControlChars(outputKey)}: ${stripControlChars(String(error))}`);
+			logger.debug(`Diff could not resolve output ${stripForDisplay(outputKey)}: ${stripForDisplay(String(error))}`);
 			resolutionFailed = true;
 			recordFailure(outputKey, output);
 			failedOutputKeys.add(outputKey);
@@ -3681,7 +3686,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			continue;
 		}
 		if (isUnresolvedValue(value, sourceUsedSub)) {
-			logger.debug(`Diff left output ${stripControlChars(outputKey)} unresolved (references a pending resource)`);
+			logger.debug(`Diff left output ${stripForDisplay(outputKey)} unresolved (references a pending resource)`);
 			resolutionFailed = true;
 			recordFailure(outputKey, output);
 			if (value === void 0) failedOutputKeys.add(outputKey);
@@ -3708,7 +3713,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			if (typeof exportName !== "string") try {
 				exportName = await (outputsPass?.resolveInto(nameBag) ?? resolveFn)(structuredClone(exportName));
 			} catch (error) {
-				logger.debug(`Diff could not resolve Export.Name of ${stripControlChars(outputKey)}: ${stripControlChars(String(error))}`);
+				logger.debug(`Diff could not resolve Export.Name of ${stripForDisplay(outputKey)}: ${stripForDisplay(String(error))}`);
 				resolutionFailed = true;
 				failuresMirrorDeploy = false;
 				continue;
@@ -3737,8 +3742,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 	} else if (refusesNoEchoName(exportName, nameBag)) {
 		refusedNoEchoExportNames.push(exportName);
 		logger.debug(safeMsg`Diff skipping export alias of ${ownerDisplay(outputKey)} — the name carries a value this pass recorded as secret`);
-	} else if (declaredExportIsIntrinsic && keepsSecretReferenceToken(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
-	else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
+	} else if (declaredExportIsIntrinsic && keepsSecretReferenceToken(exportName)) logger.debug(`Diff skipping export alias of ${stripForDisplay(outputKey)} — the name carries a secret reference`);
+	else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripForDisplay(exportName)} of ${stripForDisplay(outputKey)} — collides with an output name`);
 	else pendingAliases.push({
 		outputKey,
 		exportName,
@@ -3756,7 +3761,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			outputs[exportName] = value;
 			exportNames.add(exportName);
 		} else {
-			logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
+			logger.debug(`Diff cannot decide the export alias of ${stripForDisplay(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
 			failedKeys.add(exportName);
 			resolutionFailed = true;
 			failuresMirrorDeploy = false;
@@ -5018,10 +5023,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			const isStored = (key) => Object.prototype.hasOwnProperty.call(storedOutputs, key);
 			const compared = failed.filter(isStored);
 			const unstored = failed.filter((key) => !isStored(key));
-			const names = (keys) => keys.map(stripControlChars).join(", ");
+			const names = (keys) => keys.map(stripForDisplay).join(", ");
 			const explainWithheld = withheld && outputChanges.some((change) => change.oldValueRedacted === true);
-			logger.warn(`Outputs of stack ${stripControlChars(stackName)}: ${failed.length} output(s) could not be resolved for this diff.` + (compared.length > 0 ? ` Compared at their stored values: ${names(compared)}.` : "") + (unstored.length > 0 ? ` No stored value under their own names: ${names(unstored)}.` : "") + ` The next deploy may write a value for any of them it can resolve.` + (explainWithheld ? ` Previous values in this Outputs section are withheld because a value carried from state for a failed output is not a secret reference, so this diff cannot rule out legacy plaintext in state. That reason no longer applies once every failed output resolves, though other legacy-plaintext checks still can withhold them.` : ""));
-		} else if (diffOutputsAgainst(resolved.outputs, resolved.exportNames).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stripControlChars(stackName)} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. ` + (merge?.kind === "kept" ? keptWholeReasonText(merge.reason) : resourcesChange ? `It is usually an output referencing a resource this deploy has yet to create.` : `The stack has no resource change; this diff cannot preview what the deploy does with the outputs that failed here.`));
+			logger.warn(`Outputs of stack ${stripForDisplay(stackName)}: ${failed.length} output(s) could not be resolved for this diff.` + (compared.length > 0 ? ` Compared at their stored values: ${names(compared)}.` : "") + (unstored.length > 0 ? ` No stored value under their own names: ${names(unstored)}.` : "") + ` The next deploy may write a value for any of them it can resolve.` + (explainWithheld ? ` Previous values in this Outputs section are withheld because a value carried from state for a failed output is not a secret reference, so this diff cannot rule out legacy plaintext in state. That reason no longer applies once every failed output resolves, though other legacy-plaintext checks still can withhold them.` : ""));
+		} else if (diffOutputsAgainst(resolved.outputs, resolved.exportNames).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stripForDisplay(stackName)} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. ` + (merge?.kind === "kept" ? keptWholeReasonText(merge.reason) : resourcesChange ? `It is usually an output referencing a resource this deploy has yet to create.` : `The stack has no resource change; this diff cannot preview what the deploy does with the outputs that failed here.`));
 	}
 	const printingSecrets = printing.corpus();
 	let shownChanges = changes;
@@ -5030,7 +5035,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let shownDeployRefusals = deployRefusals;
 	if (hasMaskableValues(printing.maskCorpus())) {
 		const mask = printing.mask;
-		const maskReason = (reason) => mask(stripControlChars(mask(reason)));
+		const maskReason = (reason) => mask(stripForDisplay(mask(stripControlChars(mask(reason)))));
 		shownBlocking = blocking.map(maskReason);
 		shownDeployRefusals = deployRefusals.map(maskReason);
 		shownChanges = new Map([...changes].map(([logicalId, change]) => [logicalId, maskResourceChangeForDisplay(change, mask)]));
@@ -5632,7 +5637,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 }
 const REDACTED_LEGACY_PLAINTEXT = "<redacted: may be legacy plaintext in state — run `cdkd scrub`>";
 function stripDisplayOnlyChars(value) {
-	return value.replace(/[\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+	return value.replace(/[\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "").replace(/[\u2028\u2029]/g, " ");
 }
 function renderOutputChangeLines(outputChanges, logFn) {
 	const counts = {
@@ -5684,7 +5689,7 @@ function unreadableRowNames(node, limit) {
 }
 function renderDiffTree(node, isRoot, logFn) {
 	const hasChanges = nodeHasChanges(node);
-	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${stripControlChars(node.stackName)}:` : `\nNested stack: ${stripControlChars(node.displayName)}`);
+	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${stripForDisplay(node.stackName)}:` : `\nNested stack: ${stripForDisplay(node.displayName)}`);
 	if (hasChanges) {
 		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes, node.adoptedOrphans);
 		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
@@ -5701,7 +5706,7 @@ function renderDiffTree(node, isRoot, logFn) {
 	}
 	if (node.blocking.length > 0) {
 		logFn("\n  Blocking (cdkd deploy will refuse):");
-		for (const reason of node.blocking) logFn(`    ! ${stripControlChars(reason)}`);
+		for (const reason of node.blocking) logFn(`    ! ${stripForDisplay(reason)}`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
 }
@@ -17235,7 +17240,7 @@ async function stateResourcesCommand(stackName, options) {
 		if (options.long) {
 			const lines = [];
 			for (const detail of details) {
-				lines.push(stripControlChars(detail.logicalId));
+				lines.push(stripForDisplay(detail.logicalId));
 				lines.push(`  Type: ${formatAttributeValue(detail.resourceType)}`);
 				lines.push(`  PhysicalID: ${formatAttributeValue(detail.physicalId)}`);
 				lines.push(`  Dependencies: ${formatDependencyList(detail.dependencies)}`);
@@ -17243,7 +17248,7 @@ async function stateResourcesCommand(stackName, options) {
 				if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 				else {
 					lines.push("  Attributes:");
-					for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
+					for (const [k, v] of attrEntries) lines.push(`    ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
 				}
 				lines.push("");
 			}
@@ -17252,7 +17257,7 @@ async function stateResourcesCommand(stackName, options) {
 			return;
 		}
 		const rows = details.map((d) => ({
-			logicalId: stripControlChars(d.logicalId),
+			logicalId: stripForDisplay(d.logicalId),
 			resourceType: formatAttributeValue(d.resourceType),
 			physicalId: formatAttributeValue(d.physicalId)
 		}));
@@ -17266,14 +17271,14 @@ async function stateResourcesCommand(stackName, options) {
 function formatAttributeValue(value) {
 	if (value === null) return "null";
 	if (value === void 0) return "undefined";
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return stripControlChars(String(value));
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return stripForDisplay(String(value));
 	let json;
 	try {
 		json = JSON.stringify(value);
 	} catch {
 		json = void 0;
 	}
-	return json === void 0 ? UNSERIALIZABLE : stripControlChars(json);
+	return json === void 0 ? UNSERIALIZABLE : stripForDisplay(json);
 }
 function formatIdentField(value, maxCodePoints) {
 	if (typeof value !== "string") return formatAttributeValue(value);
@@ -17415,7 +17420,7 @@ function renderStateBlock(state, lockInfo, withLegend) {
 	if (outputEntries.length > 0) {
 		lines.push("");
 		lines.push("Outputs:");
-		for (const [k, v] of outputEntries) lines.push(`  ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
+		for (const [k, v] of outputEntries) lines.push(`  ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
 	}
 	if (rendersSkippedBlock(state)) {
 		lines.push("");
@@ -17424,7 +17429,7 @@ function renderStateBlock(state, lockInfo, withLegend) {
 			const fullDigest = formatAttributeValue(digest);
 			const cut = truncateCodePoints(fullDigest, SKIPPED_DIGEST_PREVIEW_LEN);
 			const shownDigest = cut.truncated && fullDigest !== UNSERIALIZABLE ? `${cut.text}…` : fullDigest;
-			lines.push(`  ${stripControlChars(k)}: ${shownDigest}`);
+			lines.push(`  ${stripForDisplay(k)}: ${shownDigest}`);
 		}
 		if (withLegend) lines.push(...skippedOutputsLegend());
 	}
@@ -17433,7 +17438,7 @@ function renderStateBlock(state, lockInfo, withLegend) {
 	lines.push(`Resources (${resourceEntries.length}):`);
 	for (const [logicalId, resource] of resourceEntries) {
 		lines.push("");
-		lines.push(stripControlChars(logicalId));
+		lines.push(stripForDisplay(logicalId));
 		lines.push(`  Type: ${formatAttributeValue(resource.resourceType)}`);
 		lines.push(`  PhysicalID: ${formatAttributeValue(resource.physicalId)}`);
 		const provisionedBy = resource.provisionedBy ?? "(sdk, legacy default)";
@@ -17447,13 +17452,13 @@ function renderStateBlock(state, lockInfo, withLegend) {
 		if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 		else {
 			lines.push("  Attributes:");
-			for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of attrEntries) lines.push(`    ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
 		}
 		const propEntries = Object.entries(resource.properties ?? {});
 		if (propEntries.length === 0) lines.push("  Properties: (none)");
 		else {
 			lines.push("  Properties:");
-			for (const [k, v] of propEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of propEntries) lines.push(`    ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
 		}
 	}
 	return lines;
@@ -21381,6 +21386,22 @@ function constructPathField(path) {
 	return path === void 0 ? {} : { constructPath: path };
 }
 
+//#endregion
+//#region src/cli/commands/local-aws-failure.ts
+function describeLocalAwsFailureForWarn(err, operation) {
+	if (err instanceof CdkdError) return displaySafe(err.message);
+	const rendered = describeAwsFailureForWarn(err, operation);
+	if (rendered === describeCredentialLoadFailure(err)) getLogger().debug(safeMsg`${operation}: the AWS SDK's own failure message was: ${thrownText(err)}`);
+	return displaySafe(rendered);
+}
+function thrownText(err) {
+	try {
+		return err instanceof Error ? String(err.message) : String(err);
+	} catch {
+		return "[unstringifiable throw]";
+	}
+}
+
 //#endregion
 //#region src/cli/commands/local-state-loader.ts
 async function loadStateForStack(stackName, synthRegion, opts) {
@@ -25426,7 +25447,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 			sts.destroy();
 		}
 	} catch (err) {
-		logger.warn(`${sourceFlag}: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped for AWS::AccountId; affected env entries will be dropped with per-key warnings.`);
+		logger.warn(`${sourceFlag}: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped for AWS::AccountId; affected env entries will be dropped with per-key warnings.`);
 	}
 	const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 	const bag = {
@@ -26618,7 +26639,7 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 				fromState: options.fromState
 			});
 		} catch (err) {
-			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
+			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
 		}
 		const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 		ctx.pseudoParameters = {
@@ -26759,6 +26780,32 @@ function createLocalRunTaskCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/local-host-synthesizer.ts
+function cdkdHostSynthesizer(readOptions) {
+	return { synthesize: async (opts) => {
+		const { stateBucket, verbose, roleArn } = readOptions();
+		if (verbose === true) getLogger().setLevel("debug");
+		if ((roleArn || process.env["CDKD_ROLE_ARN"]) && getAssumedRoleCredentials() === void 0) publishAssumedRoleFromEnv();
+		return new Synthesizer().synthesize({
+			...opts,
+			...stateBucket !== void 0 && { stateBucket },
+			...opts.profile !== void 0 && { macroExpandS3ClientOpts: { profile: opts.profile } }
+		});
+	} };
+}
+function publishAssumedRoleFromEnv() {
+	const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
+	const sessionToken = process.env["AWS_SESSION_TOKEN"];
+	if (!accessKeyId || !secretAccessKey || !sessionToken) throw new Error("--role-arn was given, but the assumed role left no session credentials in the environment; refusing to synthesize as another identity.");
+	setAssumedRoleCredentials({
+		accessKeyId,
+		secretAccessKey,
+		sessionToken
+	});
+}
+
 //#endregion
 //#region src/cli/commands/local-start-service.ts
 function serviceStrategy() {
@@ -26776,8 +26823,8 @@ function serviceStrategy() {
 	};
 }
 function createLocalStartServiceCommand() {
-	const cmd = new Command("start-service").description("Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as `cdkd local run-task`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay. Omit <targets> in an interactive terminal to multi-select the ECS services from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
+	const cmd = new Command("start-service").description("Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as `cdkd local run-task`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay. Omit <targets> in an interactive terminal to multi-select the ECS services from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
+		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
 	}));
 	addStartServiceSpecificOptions(cmd);
 	warnEngineRoleExposure(cmd, "start-service", [
@@ -27696,7 +27743,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	try {
 		accountId = await resolveStackAccountId(region, options.profile, options.fromState);
 	} catch (err) {
-		logger.warn(safeMsg`${stateProvider.label}: STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. ` + "A same-stack ECR image URI referencing ${AWS::AccountId} may not resolve.");
+		logger.warn(safeMsg`${stateProvider.label}: STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. ` + "A same-stack ECR image URI referencing ${AWS::AccountId} may not resolve.");
 	}
 	const context = {};
 	const pseudo = derivePseudoParametersFromRegion$1(region, accountId);
@@ -27750,7 +27797,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${describeLocalAwsFailureForWarn(err, "STS AssumeRole")}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -27764,7 +27811,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 }
 function assumeRoleFallbackWarning(args) {
 	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
-	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed for ${args.purpose}: ${describeLocalAwsFailureForWarn(args.error, "STS AssumeRole")}. Falling back to ${fallback}.`;
 }
 function resolveAssumeRoleArn(options, resolved, loaded) {
 	const hit = assumeRoleResolutionMemo.get(resolved);
@@ -27875,7 +27922,7 @@ function forwardAwsEnv$1(env) {
 	applyCallerIdentityCredentials(env);
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
-	assertSendableRoleArn(roleArn);
+	assertSendableRoleArn(roleArn, (m) => new CdkdError(m, "LOCAL_INVOKE_AGENTCORE_ASSUME_ROLE_INVALID"));
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
 		...awsClientDefaults({ ignoreAssumedRole: true }),
@@ -27982,10 +28029,11 @@ function createLocalInvokeAgentCoreCommand() {
 function createLocalStartAgentCoreCommand$1() {
 	const cmd = createLocalStartAgentCoreCommand({
 		embedConfig: getEmbedConfig(),
-		extraStateProviders: cdkdExtraStateProviders
+		extraStateProviders: cdkdExtraStateProviders,
+		synthesizer: cdkdHostSynthesizer(() => cmd.opts())
 	});
 	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in the AgentCore runtime container image and environment variables. Mutually exclusive with --from-cfn-stack.").default(false));
-	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
+	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
 	warnEngineRoleExposure(cmd, "start-agentcore", [
@@ -28031,8 +28079,8 @@ function buildAlbEmulatorStrategy(options) {
 	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
 }
 function createLocalStartAlbCommand() {
-	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token '<jwt>' to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Does NOT reach a Lambda target group's container environment (a boot warning names the affected functions) — use --from-cfn-stack for those. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders);
+	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token '<jwt>' to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Does NOT reach a Lambda target group's container environment (a boot warning names the affected functions) — use --from-cfn-stack for those. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
+		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
 	}));
 	addAlbSpecificOptions(cmd);
 	warnEngineRoleExposure(cmd, "start-alb", [
@@ -28049,7 +28097,14 @@ function createLocalStartAlbCommand() {
 function createLocalStartCloudFrontCommand$1() {
 	const cmd = createLocalStartCloudFrontCommand({
 		embedConfig: getEmbedConfig(),
-		extraStateProviders: cdkdExtraStateProviders
+		extraStateProviders: cdkdExtraStateProviders,
+		synthesizer: cdkdHostSynthesizer(() => {
+			const { verbose, roleArn } = cmd.opts();
+			return {
+				verbose,
+				roleArn
+			};
+		})
 	});
 	cmd.addOption(new Option("--from-state", "[not supported on start-cloudfront] Read cdkd's S3 state for the target stack. Refused at startup: the CloudFront emulator consults a state source only under --from-cfn-stack. Use --from-cfn-stack instead.").default(false));
 	cmd.addOption(new Option("--state-bucket <bucket>", "[not supported on start-cloudfront] S3 bucket for --from-state. Refused at startup with --from-state."));
@@ -28503,7 +28558,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 			sts.destroy();
 		}
 	} catch (err) {
-		logger.warn(`${sourceFlag}: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped; affected env entries will be dropped with per-key warnings.`);
+		logger.warn(`${sourceFlag}: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env entries will be dropped with per-key warnings.`);
 	}
 	const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 	const bag = {
@@ -28571,8 +28626,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${describeLocalAwsFailureForWarn(err, "STS AssumeRole")}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -28585,7 +28639,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 	}
 }
 async function assumeLambdaExecutionRole(roleArn, region) {
-	assertSendableRoleArn(roleArn);
+	assertSendableRoleArn(roleArn, (m) => new CdkdError(m, "LOCAL_INVOKE_ASSUME_ROLE_INVALID"));
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
 		...awsClientDefaults({ ignoreAssumedRole: true }),
@@ -28597,7 +28651,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_INVOKE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -28795,4 +28849,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-D5gcmWad.js.map
+//# sourceMappingURL=program-BQnReLnG.js.map