@go-to-k/cdkd 0.301.2 → 0.301.4

package/dist/{program-DEPit8lD.js → program-DYfZCsxM.js}

@@ -1,20 +1,18 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
-import { a as setAssumedRoleCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as unpreviewableOrphanRecords, $c as stripControlChars, $i as hasReadableOutputs, $n as unsupportedFinalSnapshotError, $o as carryLogOnlyValues, $r as poisonRenderedSpellingsCollidingIn, $s as crossPrefixDeniedWarning, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOutputs, Ac as readBootstrapMarkerBody, Ai as isImpossibleEmptyStoredAttribute, Al as StageLoadError, An as collectPublishedOutputNames, Ao as prefetchCreateOnlyPropertyPaths, Ar as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, As as recordPhysicalNameCopy, At as NESTED_PENDING_PARENT_REASON, B as readProtection, Ba as refuseMalformedResourcePropertiesForDrift, Bc as finchSecretArgvRefusal, Bi as withSharedDrainBudget, Bl as renderAssemblyPathEscape, Bn as secretNamePrintingBags, Bo as isMarkedCoordinate, Br as deleteSkipReason, Bs as STATE_SOURCED_BASELINE_RULES, Bt as collectNestedChildUnaddressed, Ca as refuseDivergentRecordRegionForDestroy, Cc as AssetModeResolver, Ci as classifyReplaySecretRegion, Cl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Cn as secretSafeKeyDisplay, Cr as isCustomResource, Cs as pathCrossesDottedKey, Ct as dropFailedCommands, D as findServiceTokenRefusals, Da as refuseMalformedOrphans, Dc as getBootstrapMarkerKey, Di as isUnboundTemplateParameter, Dl as canonicalizeRegion, Dn as isWholeDynamicReferenceValue, Dr as isCustomResourceType$1, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphanRecordsForDestroy, Ec as ensureAssetStorage, Ei as coerceParameterTypedValue, El as PARTITION_TABLE, En as exportNameSecretExposure, Er as readsNoEchoDeleteValues, Es as recordNestedStackParameterExpressions, Et as journaledOrphanLines, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForDestroy, Fc as resolveDockerContextDirectory, Fi as AWS_NO_VALUE, Fl as nullPrototypeRecord, Fn as completedReplayEntries, Fs as recordMaskOnlyValuesIn, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcesForExport, Gc as partitionSensitiveEnv, Gi as STATE_REGION_DIVERGED, Gl as resolveBucketRegion, Gn as ATOMIC_FINAL_SNAPSHOT_TYPES, Go as noEchoCoordinatesOf, Gs as isSingleDynamicReferenceToken, Ha as refuseMalformedResourcePropertiesForOrphan, Hc as getDockerCmd, Hl as injectAwsRegion, Hn as stateSecretNameNeedles, Ho as maskReadbackAtCoordinates, Hr as isWaitAbandonedError, Hs as STATE_SOURCED_READBACK_RULES, Ht as withNestedStackContext, I as recordedProtectionNote, Ia as refuseMalformedResourceEntriesForImport, Ic as describeDockerCapturedOutput, Ii as cfnRefValueFromPhysicalId, Il as ownValue, In as journaledOrphanPrintingBag, Ir as RollbackInlinePolicyWriters, Is as recordNoEchoAttributeValues, It as recordDisplacedSkips, Ja as repairMalformedOrphansForReadOnly, Jc as redactedDockerCause, Ji as UNREADABLE_RESOURCES_MAP_ROW, Jn as ccRoutedFinalSnapshotError, Js as S3StateBackend, Jt as withStackRecords, Ka as refuseMalformedState, Kc as redactDockerArgvValues, Ki as STATE_RESOURCES_MALFORMED, Kn as PRE_DELETE_SNAPSHOT_TYPES, Ko as noEchoLeavesOf, Ks as LockManager, Kt as destroyStackRecordsView, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourceEntriesForImportSave, Lc as describeDockerExecFailure, Li as isStalePlaceholderArnAttribute, Ll as absoluteAssemblyPathEscape, Ln as maskEventTextWithBoundBags, Lo as DagBuilder, Lr as UNSPECIFIED_SKIP_REASON, Ls as recordNoEchoParameterFreshValue, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceAttributesForOrphan, Mc as validateContainerRepoName, Mi as carriesFetchableDynamicReference, Ml as defineOwnKey, Mn as bindingSkippedOutputs, Mo as describeTypeWithThrottleRetry, Mr as customResourceResponseExpirationWarning, Ms as carriesSecretMask, Mt as displacedPhysicalIdShown, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntries, Nc as buildDenyExternalAccessPolicy, Ni as isNamelessDynamicReferenceError, Nl as hasOwnKey, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as withRetry, Nr as CloudControlProvider, Ns as provenPublicValue, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphansForDestroy, Oc as isCrossRegionRedirect, Oi as parameterTypeMayLoseSecretIdentity, Ol as derivePartitionAndUrlSuffix, On as noEchoParameterValueSeed, Os as physicalNameCopiesOf, Ot as makeForeignHolderScan, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntriesForDeploy, Pc as buildDockerImage, Pi as keepsSecretReferenceToken, Pl as hasPlainPrototype, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Pr as slowCcOperationTimeoutMs, Ps as recordMaskOnlyValue, Qa as repairMalformedResourcesForReadOnly, Qc as escapeRegExp, Qi as hasReadableOrphans, Qn as refusesFinalSnapshot, Qo as liveMatchesUnresolvedTokenFrame, Qr as IntrinsicFunctionResolver, Qs as applyCrossPrefixScan, Qt as demoteSupersededOrphans, R as isProtectionValueActive, Ra as refuseMalformedResourceEntriesForOrphan, Rc as describeDockerFailure, Ri as refStateLookupFromResource, Rl as describeFileReadFailure, Rn as orphanRecordsPrintingBag, Ro as TemplateParser, Rr as deleteIndeterminateGuards, Rs as recordProvenPublicExpression, Rt as revertedNestedRowIds, Sa as previewableOrphanRecords, Sc as rewriteTemplateAssetReferences, Si as classifyRecordedSecretRegion, Sl as uploadCfnTemplate, Sn as secretBearingStateKeyWarning, Sr as ccBrokenReason, Ss as isUncertifiedBaselineMaskPosition, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as refuseMalformedOrphanRecords, Tc as assertAssetBucketRegion, Ti as regionLessSecretName, Tl as expectedOwnerParam, Tn as exportNameNoEchoParameters, Tr as TemplateNoEchoReresolver, Ts as inheritNestedStackParameterAssociations, Tt as isHandledOrphan, Ua as refuseMalformedResourcesForDeploy, Uc as isDockerClientEnvKey, Ui as declaresNoEcho, Ul as injectedAwsRegionValue, Un as storedSecretNameNeedles, Uo as maskWholeValue, Us as TEMPLATE_SOURCED_RULES, Ut as replayFailedOperations, Va as refuseMalformedResourcePropertiesForExport, Vc as formatDockerLoginError, Vi as parameterInputsFor, Vl as resolveAssemblyPath, Vn as secretNamedRecordNeedles, Vo as maskAtCoordinates, Vs as STATE_SOURCED_CROSS_GENERATION_RULES, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcesForDestroy, Wc as isMalformedEnvKey, Wi as JSON_LISTING_HOLE_VALUE, Wn as extractDeploymentEventError, Wo as maskedLeafCoordinatesOf, Ws as WHOLE_DYNAMIC_REFERENCE_PATTERN, Wt as replayRollback, Xa as repairMalformedResourceEntriesForReadOnly, Xc as runDockerStreaming, Xi as deployRefusesOrphanRowsReason, Xn as effectiveDeletionPolicy, Xo as readsNoEchoSource, Xr as DiffCalculator, Xs as CrossPrefixReadError, Ya as repairMalformedOutputsForReadOnly, Yc as runDockerForeground, Yi as accountArgs, Yn as createPreDeleteFinalSnapshot, Yo as readbackPathFor, Ys as rebuildClientForBucketRegion, Yt as removeProtectionTypeList, Za as repairMalformedResourcePropertiesForReadOnly, Zc as warnFinchArgvExposure, Zi as displayLogicalId, Zn as isFinalSnapshotError, Zo as valueAtCoordinate, Zr as INTRINSIC_KEYS, Zs as CrossPrefixScanCache, Zt as recordAfterRollbackUpdate, _ as keptWholeReasonText, _a as malformedResourceEntriesWarning, _c as stringifyValue, _l as ssmResolvedValueType, _n as orphanNeedsIdentity, _s as scrubResourceRecord, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedExportSourceWarning, ac as exportNamesCarriedFrom, ai as explicitRoleArnOrThrow, al as getDefaultStateBucketName, an as replacementNeverSwapped, ao as unwrittenCreateOnlyReplacement, ar as ledgerForStack, as as recordLogOnlyParameterValue, at as createReadOnlyAttributeHealerFactory, ba as malformedScrubResourceEntriesRefusalMessage, bc as createAssetRedirectResolver, bl as MIGRATE_TMP_PREFIX, bn as exportAliasCollisionScrubWarning, br as CC_BROKEN_REASON, bs as DYNAMIC_REFERENCE_TOKEN_SCAN, bt as pendingRequestCount, c as isAbsoluteAssetPath, ca as malformedLocalResourcesWarning, cc as hasUnverifiableParameterRefusal, ci as AWS_CREDENTIAL_ENV_KEYS, cl as resolveApp, cn as findNestedStackTypeChanges, co as hasNoCloudControlHandlers, cs as unionOfSecretBags, ct as gray, d as templateIdentity, da as malformedOrphanRowsKeptWarning, dc as isReadableBag, di as envCredentialsAreAssumedRole, dl as resolveSkipPrefix, do as MULTI_REGION_RECREATE_BLOCKED_TYPES, ds as maskSecretsInError, dt as yellow, ea as hasReadableResources, ec as isAccessDenied, ei as producerLookupOver, el as stripForDisplay, en as isReplacementOrphan, eo as unreadableOrphanRecords, er as maskingRetryLogger, es as createUnionSecretMasker, f as conditionFingerprint, fa as malformedOrphansRefusalMessage, fc as orphansAfterRollback, fl as resolveStateBucketWithDefault, fo as isStatefulRecreateTargetForReplace, fs as maskSecretsInText, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedRenderedContainersWarning, gc as isSensitiveAttributeName, gi as recordedReferenceRegions, gl as warnDeprecatedNoPrefixCliFlag, gn as updatePartialReason, gs as redactSecretsForState, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedOutputsWarning, hc as AssetPublisher, hi as recordedOutputReferenceRegions, hl as stateBucketExistenceConfirmed, hn as updatePartialMessage, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedExportNamesWarning, ic as describeRegionValueKind, ii as assertSendableRoleArn, il as synthesisStatusMessage, in as recordUnderIdIsNotOwn, is as printingCorpusOf, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedOutputsForDestroy, jc as validateAssetBucketName, ji as carriesDynamicReference, jl as processStackMessages, jn as isExportAliasCollision, jo as templateResourceTypes, jr as applyCustomResourceResponseExpiration, js as splitGetAttStringForm, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphansForOrphan, kc as parseBootstrapMarker, ki as getAccountInfo, kl as AssemblyReader, kn as collectDeclaredOutputNames, kr as withPrintingSecrets, kt as sameJournaledOrphans, l as listNestedTemplateRows, la as malformedOrphanRecordsRefusalMessage, lc as importableOutputKeys, li as applyCallerIdentityCredentials, ll as resolveAutoAssetStorage, lo as findReplacedReadersOfRecreateTargets, ls as createSecretMasker, lt as green, m as parentSuppliedValues, ma as malformedOutputsRefusalMessage, mc as shouldRetainResource, ml as resolveUseCdkBootstrapAssets, mo as renderStatefulReason, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as isReadableResourceEntry, nc as splitImportedOps, ni as applyRoleArnIfSet, nl as getDockerImageBySourceHash, nn as planRollback, no as withheldAccountClause, nr as findDestructiveChanges, ns as literalSplitDelimitersOf, o as childTemplateLoader, oa as malformedLocalOutputsWarning, oc as hasReadableExportSet, oi as isIamRoleArn, ol as getLegacyStateBucketName, on as resolveReplacementOldType, os as recordLogOnlyValue, ot as bold, p as conditionInputsFrom, pa as malformedOrphansWarning, pc as orphansCarriedFrom, pi as keepHeldTokenProvenance, pl as resolveStateBucketWithDefaultAndSource, po as isStatefulRecreateTargetSync, ps as markSameGenerationBag, pt as namesAnyDeclaredParameter, qa as repairMalformedOrphanRecordsForReadOnly, qc as redactedCause, qi as UNREADABLE_ORPHANS_CONTAINER_ROW, qn as buildFinalSnapshotIdentifier, qo as noEchoOutputsComparison, qs as isLockInfoExpired, r as computeImplicitDeleteEdges, ra as malformedDriftResourcePropertiesWarning, rc as acceptedCreateOnlyDropsOf, ri as assertFlagRoleArn, rl as Synthesizer, rn as recheckFailedPlan, ro as findActionableSilentDrops, rr as formatDestructiveChange, rs as logOnlyValueCount, s as findNestedTemplateTreeDefect, sa as malformedLocalResourceEntriesWarning, sc as hasReasonlessBaselineRefusal, si as sendableAssumeRoleCommand, sl as loadCdkJson, sn as seedsDeleteFirstGuard, so as NO_CC_HANDLERS_REASON, sr as withCreateTokenLedger, ss as shareLogOnlyValues, st as cyan, t as DeployEngine, ta as isReadableOrphanRecord, tc as isNotImplemented, ti as refuseUnreadableCdkCrossAccountRefs, tl as AssetManifestLoader, tn as planFailedOps, to as unreadableResourceEntries, tr as constructPathOf, ts as hasMaskableValues, u as renderNestedTemplateTreeDefect, ua as malformedOrphanRecordsWarning, uc as importableOutputs, ui as callerEnvCredentials, ul as resolveCaptureObservedState, un as inheritProducerRegions, uo as shownType, us as errorCauseChain, ut as red, v as mergeNoChangeOutputs, va as malformedResourcePropertiesWarning, vc as WorkGraph, vl as CFN_TEMPLATE_BODY_LIMIT, vn as WITHHELD_NAME_DISPLAY, vs as withPhysicalNameCopies, vt as DeploymentEventsReader, w as keptForReadoption, wc as BOOTSTRAP_MARKER_PREFIX, wi as producerRegionsFromState, wl as decodeListingKey, wn as carriedExportAliasExposure, wr as wouldReturnToSdkProvider, ws as identityKeyFor, wt as dropFailedHint, xa as malformedStateRefusalMessage, xc as loadPublishableAssetManifest, xl as findLargeInlineResources, xn as secretBearing, xr as ProviderRegistry, xs as dynamicReferenceTokens, xt as resolvePendingCloudControlRequests, y as makeCanonicalizePropertiesFn, ya as malformedResourcesWarning, yc as buildAssetRedirectMap, yl as CFN_TEMPLATE_URL_LIMIT, yn as displayTextOrWithheld, yt as DeploymentEventsStore, z as perType, za as refuseMalformedResourcePropertiesForDestroy, zc as dockerSpawnEnvWithSensitive, zl as displayAssemblyPath, zn as secretNamePrintingBag, zo as canonicalCoordinates, zr as deleteLeftInPlace, zs as wholeStringLeavesOf, zt as withNestedRevertRun } from "./deploy-engine--5XWdjW3.js";
-import { t as getCdkdVersion } from "./version-DUYEmFtp.js";
+import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
+import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
+import { $a as repairMalformedResourceEntriesForReadOnly, $c as runDockerForeground, $i as deployRefusesOrphanRowsReason, $n as isFinalSnapshotError, $o as readsNoEchoSource, $r as DiffCalculator, $s as rebuildClientForBucketRegion, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphans, Ac as ensureAssetStorage, Ai as isUnboundTemplateParameter, Al as PARTITION_TABLE, An as collectPublishedOutputNames, Ar as isCustomResourceType$1, As as recordNestedStackParameterExpressions, At as NESTED_PENDING_PARENT_REASON, Ba as refuseMalformedResourceEntriesForImportSave, Bc as describeDockerCapturedOutput, Bi as isStalePlaceholderArnAttribute, Bl as ownValue, Bn as secretNamePrintingBag, Bo as DagBuilder, Br as UNSPECIFIED_SKIP_REASON, Bs as recordNoEchoAttributeValues, Bt as collectNestedChildUnaddressed, C as computeImplicitDeleteEdges, Ca as malformedScrubResourceEntriesRefusalMessage, Cc as buildAssetRedirectMap, Cl as CFN_TEMPLATE_URL_LIMIT, Cn as secretSafeKeyDisplay, Cr as ProviderRegistry, Ct as dropFailedCommands, D as findServiceTokenRefusals, Dc as AssetModeResolver, Di as producerRegionsFromState, Dl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as isWholeDynamicReferenceValue, Ds as pathCrossesDottedKey, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseDivergentRecordRegionForDestroy, Ec as rewriteTemplateAssetReferences, Ei as classifyReplaySecretRegion, El as uploadCfnTemplate, En as exportNameSecretExposure, Er as wouldReturnToSdkProvider, Es as isUncertifiedBaselineMaskPosition, Et as journaledOrphanLines, F as perType, Fa as refuseMalformedResourceAttributesForOrphan, Fc as validateAssetBucketName, Fi as carriesFetchableDynamicReference, Fl as processStackMessages, Fn as completedReplayEntries, Fo as describeTypeWithThrottleRetry, Fr as customResourceResponseExpirationWarning, Fs as splitGetAttStringForm, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcePropertiesForOrphan, Gc as formatDockerLoginError, Gl as resolveAssemblyPath, Gn as storedSecretNameNeedles, Go as maskReadbackAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_CROSS_GENERATION_RULES, Ha as refuseMalformedResourcePropertiesForDestroy, Hc as describeDockerFailure, Hl as describeFileReadFailure, Ho as canonicalCoordinates, Hr as deleteLeftInPlace, Hs as recordProvenPublicExpression, Ht as withNestedStackContext, I as readProtection, Ia as refuseMalformedResourceEntries, Ic as validateContainerRepoName, Ii as isNamelessDynamicReferenceError, Il as defineOwnKey, In as journaledOrphanPrintingBag, Io as withRetry, Ir as CloudControlProvider, Is as carriesSecretMask, It as recordDisplacedSkips, Ja as refuseMalformedResourcesForExport, Jc as isMalformedEnvKey, Ji as STATE_REGION_DIVERGED, Jn as PRE_DELETE_SNAPSHOT_TYPES, Jo as noEchoCoordinatesOf, Js as WHOLE_DYNAMIC_REFERENCE_PATTERN, Jt as withStackRecords, Ka as refuseMalformedResourcesForDeploy, Kc as getDockerCmd, Ki as declaresNoEcho, Kl as injectAwsRegion, Kn as extractDeploymentEventError, Ko as maskWholeValue, Ks as STATE_SOURCED_READBACK_RULES, Kt as destroyStackRecordsView, La as refuseMalformedResourceEntriesForDeploy, Lc as buildDenyExternalAccessPolicy, Li as keepsSecretReferenceToken, Ll as hasOwnKey, Ln as maskEventTextWithBoundBags, Lr as slowCcOperationTimeoutMs, Ls as provenPublicValue, M as recordedProtectionNote, Ma as refuseMalformedOrphansForOrphan, Mc as isCrossRegionRedirect, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mn as bindingSkippedOutputs, Mr as withPrintingSecrets, Ms as physicalNameCopiesOf, Mt as displacedPhysicalIdShown, N as PROTECTION_PROPERTY_BY_TYPE, Na as refuseMalformedOutputs, Nc as parseBootstrapMarker, Ni as isImpossibleEmptyStoredAttribute, Nl as AssemblyReader, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as prefetchCreateOnlyPropertyPaths, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphanRecords, Oc as BOOTSTRAP_MARKER_PREFIX, Oi as regionLessSecretName, Ol as decodeListingKey, On as noEchoParameterValueSeed, Or as TemplateNoEchoReresolver, Os as identityKeyFor, Ot as makeForeignHolderScan, P as isProtectionValueActive, Pa as refuseMalformedOutputsForDestroy, Pc as readBootstrapMarkerBody, Pi as carriesDynamicReference, Pl as StageLoadError, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as templateResourceTypes, Pr as applyCustomResourceResponseExpiration, Ps as recordPhysicalNameCopy, Qa as repairMalformedOutputsForReadOnly, Qc as redactedDockerCause, Qi as accountArgs, Qn as effectiveDeletionPolicy, Qo as readbackPathFor, Qs as S3StateBackend, Qt as demoteSupersededOrphans, Ra as refuseMalformedResourceEntriesForDestroy, Rc as buildDockerImage, Ri as AWS_NO_VALUE, Rl as hasPlainPrototype, Rn as namingSecretsWithRecordedNoEcho, Rs as recordMaskOnlyValue, Rt as revertedNestedRowIds, S as IMPLICIT_DELETE_DEPENDENCIES, Sa as malformedResourcesWarning, Sc as WorkGraph, Sl as CFN_TEMPLATE_BODY_LIMIT, Sn as secretBearingStateKeyWarning, Sr as CC_BROKEN_REASON, Ss as withPhysicalNameCopies, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as previewableOrphanRecords, Tc as loadPublishableAssetManifest, Ti as classifyRecordedSecretRegion, Tl as findLargeInlineResources, Tn as exportNameNoEchoParameters, Tr as isCustomResource, Ts as dynamicReferenceTokens, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForDrift, Uc as dockerSpawnEnvWithSensitive, Ui as withSharedDrainBudget, Ul as displayAssemblyPath, Un as secretNamedRecordNeedles, Uo as isMarkedCoordinate, Ur as deleteSkipReason, Us as wholeStringLeavesOf, Ut as replayFailedOperations, Va as refuseMalformedResourceEntriesForOrphan, Vc as describeDockerExecFailure, Vi as refStateLookupFromResource, Vl as absoluteAssemblyPathEscape, Vn as secretNamePrintingBags, Vo as TemplateParser, Vr as deleteIndeterminateGuards, Vs as recordNoEchoParameterFreshValue, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcePropertiesForExport, Wc as finchSecretArgvRefusal, Wi as parameterInputsFor, Wl as renderAssemblyPathEscape, Wn as stateSecretNameNeedles, Wo as maskAtCoordinates, Ws as STATE_SOURCED_BASELINE_RULES, Wt as replayRollback, Xa as repairMalformedOrphanRecordsForReadOnly, Xc as redactDockerArgvValues, Xi as UNREADABLE_ORPHANS_CONTAINER_ROW, Xn as ccRoutedFinalSnapshotError, Xo as noEchoOutputsComparison, Xs as LockManager, Ya as refuseMalformedState, Yc as partitionSensitiveEnv, Yi as STATE_RESOURCES_MALFORMED, Yl as resolveBucketRegion, Yn as buildFinalSnapshotIdentifier, Yo as noEchoLeavesOf, Ys as isSingleDynamicReferenceToken, Yt as removeProtectionTypeList, Za as repairMalformedOrphansForReadOnly, Zc as redactedCause, Zi as UNREADABLE_RESOURCES_MAP_ROW, Zn as createPreDeleteFinalSnapshot, Zs as isLockInfoExpired, Zt as recordAfterRollbackUpdate, _ as makeCanonicalizePropertiesFn, _a as malformedOutputsRefusalMessage, _c as orphansCarriedFrom, _l as resolveStateBucketWithDefaultAndSource, _n as orphanNeedsIdentity, _o as renderStatefulReason, _s as markSameGenerationBag, _t as planOrphanAdoption, a as findNestedTemplateTreeDefect, aa as isReadableResourceEntry, ac as isNotImplemented, ai as applyRoleArnIfSet, al as AssetManifestLoader, an as replacementNeverSwapped, ao as withheldAccountClause, ar as formatDestructiveChange, as as hasMaskableValues, at as red, ba as malformedResourceEntriesWarning, bc as isSensitiveAttributeName, bl as warnDeprecatedNoPrefixCliFlag, bn as exportAliasCollisionScrubWarning, bs as redactSecretsForState, bt as pendingRequestCount, c as renderNestedTemplateTreeDefect, ca as malformedExportSourceWarning, cc as describeRegionValueKind, ci as explicitRoleArnOrThrow, cl as synthesisStatusMessage, cn as findNestedStackTypeChanges, co as unwrittenCreateOnlyReplacement, cs as printingCorpusOf, ct as namesAnyDeclaredParameter, d as conditionInputsFrom, da as malformedLocalResourcesWarning, dc as hasReasonlessBaselineRefusal, di as AWS_CREDENTIAL_ENV_KEYS, dl as loadCdkJson, do as hasNoCloudControlHandlers, ds as shareLogOnlyValues, dt as noEchoAttributeNamesOf, ea as displayLogicalId, ec as CrossPrefixReadError, ei as INTRINSIC_KEYS, el as runDockerStreaming, en as isReplacementOrphan, eo as repairMalformedResourcePropertiesForReadOnly, er as refusesFinalSnapshot, es as recordedNoEchoValuesOf, et as formatResourceLine, f as parentSuppliedValues, fa as malformedOrphanRecordsRefusalMessage, fc as hasUnverifiableParameterRefusal, fi as applyCallerIdentityCredentials, fl as resolveApp, fo as findReplacedReadersOfRecreateTargets, fs as unionOfSecretBags, ft as noEchoComparisonForTemplate, g as mergeNoChangeOutputs, ga as malformedOrphansWarning, gc as orphansAfterRollback, gi as keepHeldTokenProvenance, gl as resolveStateBucketWithDefault, gn as updatePartialReason, go as isStatefulRecreateTargetSync, gs as maskSecretsInText, gt as makeSiblingClaimReader, h as keptWholeReasonText, ha as malformedOrphansRefusalMessage, hc as isReadableBag, hl as resolveSkipPrefix, hn as updatePartialMessage, ho as isStatefulRecreateTargetForReplace, hs as maskSecretsInError, ht as createReadOnlyAttributeHealerFactory, i as childTemplateLoader, ia as isReadableOrphanRecord, ic as isAccessDenied, ii as refuseUnreadableCdkCrossAccountRefs, il as stripForDisplay, in as recordUnderIdIsNotOwn, io as unreadableResourceEntries, ir as findDestructiveChanges, is as createUnionSecretMasker, it as green, j as recordedProtectionEvidence, ja as refuseMalformedOrphansForDestroy, jc as getBootstrapMarkerKey, ji as parameterTypeMayLoseSecretIdentity, jl as canonicalizeRegion, jn as isExportAliasCollision, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphanRecordsForDestroy, kc as assertAssetBucketRegion, ki as coerceParameterTypedValue, kl as expectedOwnerParam, kn as collectDeclaredOutputNames, kr as readsNoEchoDeleteValues, ks as inheritNestedStackParameterAssociations, kt as sameJournaledOrphans, l as templateIdentity, la as malformedLocalOutputsWarning, lc as exportNamesCarriedFrom, li as isIamRoleArn, ll as getDefaultStateBucketName, lr as withCreateTokenLedger, ls as recordLogOnlyParameterValue, lt as reachableDivergentParameters, m as isSecretBearingReferenceString, ma as malformedOrphanRowsKeptWarning, mc as importableOutputs, mi as envCredentialsAreAssumedRole, ml as resolveCaptureObservedState, mo as MULTI_REGION_RECREATE_BLOCKED_TYPES, ms as errorCauseChain, mt as noEchoParameterNamesOf, n as crossStackOutputProvenanceSource, na as hasReadableOutputs, nc as applyCrossPrefixScan, ni as poisonRenderedSpellingsCollidingIn, nl as escapeRegExp, nn as planRollback, no as unpreviewableOrphanRecords, nr as maskingRetryLogger, ns as liveMatchesUnresolvedTokenFrame, nt as cyan, o as isAbsoluteAssetPath, oa as malformedDriftResourcePropertiesWarning, oc as splitImportedOps, oi as assertFlagRoleArn, ol as getDockerImageBySourceHash, on as resolveReplacementOldType, oo as findActionableSilentDrops, os as literalSplitDelimitersOf, ot as yellow, p as readRecordedConditionVerdicts, pa as malformedOrphanRecordsWarning, pc as importableOutputKeys, pi as callerEnvCredentials, pl as resolveAutoAssetStorage, po as shownType, ps as createSecretMasker, pt as noEchoExactEchoLeavesOf, qa as refuseMalformedResourcesForDestroy, qc as isDockerClientEnvKey, qi as JSON_LISTING_HOLE_VALUE, ql as injectedAwsRegionValue, qn as ATOMIC_FINAL_SNAPSHOT_TYPES, qo as maskedLeafCoordinatesOf, qs as TEMPLATE_SOURCED_RULES, r as inheritedProvenanceForChildDiff, ra as hasReadableResources, rc as crossPrefixDeniedWarning, ri as producerLookupOver, rl as stripControlChars, rn as recheckFailedPlan, ro as unreadableOrphanRecords, rr as constructPathOf, rs as carryLogOnlyValues, rt as gray, s as listNestedTemplateRows, sa as malformedExportNamesWarning, sc as acceptedCreateOnlyDropsOf, si as assertSendableRoleArn, sl as Synthesizer, sn as seedsDeleteFirstGuard, sr as ledgerForStack, ss as logOnlyValueCount, st as computeParameterTaint, t as DeployEngine, ta as hasReadableOrphans, tc as CrossPrefixScanCache, ti as IntrinsicFunctionResolver, tl as warnFinchArgvExposure, tn as planFailedOps, to as repairMalformedResourcesForReadOnly, tr as unsupportedFinalSnapshotError, ts as valueAtCoordinate, tt as bold, u as conditionFingerprint, ua as malformedLocalResourceEntriesWarning, uc as hasReadableExportSet, ui as sendableAssumeRoleCommand, ul as getLegacyStateBucketName, un as inheritProducerRegions, uo as NO_CC_HANDLERS_REASON, us as recordLogOnlyValue, ut as resourcesNamingDeclaredParameter, va as malformedOutputsWarning, vc as shouldRetainResource, vi as recordedOutputReferenceRegions, vl as resolveUseCdkBootstrapAssets, vn as WITHHELD_NAME_DISPLAY, vt as DeploymentEventsReader, w as keptForReadoption, wa as malformedStateRefusalMessage, wc as createAssetRedirectResolver, wl as MIGRATE_TMP_PREFIX, wn as carriedExportAliasExposure, wr as ccBrokenReason, ws as DYNAMIC_REFERENCE_TOKEN_SCAN, wt as dropFailedHint, xa as malformedResourcePropertiesWarning, xc as stringifyValue, xl as ssmResolvedValueType, xn as secretBearing, xs as scrubResourceRecord, xt as resolvePendingCloudControlRequests, ya as malformedRenderedContainersWarning, yc as AssetPublisher, yi as recordedReferenceRegions, yl as stateBucketExistenceConfirmed, yn as displayTextOrWithheld, yt as DeploymentEventsStore, za as refuseMalformedResourceEntriesForImport, zc as resolveDockerContextDirectory, zi as cfnRefValueFromPhysicalId, zl as nullPrototypeRecord, zn as orphanRecordsPrintingBag, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValuesIn, zt as withNestedRevertRun } from "./deploy-engine-BIPU9Xdh.js";
+import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
-import { LambdaClient } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { DescribeSecurityGroupRulesCommand } from "@aws-sdk/client-ec2";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { DescribeLogStreamsCommand, ResourceNotFoundException as ResourceNotFoundException$2 } from "@aws-sdk/client-cloudwatch-logs";
-import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
+import { DescribeLogStreamsCommand, ResourceNotFoundException as ResourceNotFoundException$1 } from "@aws-sdk/client-cloudwatch-logs";
 import * as fs from "node:fs";
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -28,8 +26,8 @@ import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
-import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, recordAssumedRole, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
+import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -1778,7 +1776,7 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 					});
 				}
 			} catch (e) {
-				if (e instanceof ResourceNotFoundException$2) {
+				if (e instanceof ResourceNotFoundException$1) {
 					let regionVerified = true;
 					if (clients.expectedRegionDiverged) {
 						regionVerified = false;
@@ -2561,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CDxfoC_T.js");
+	providerClasses ??= import("./provider-classes-BSUoljqw.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4951,7 +4949,8 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
 	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedSecretTokens, inheritedDerivedNames, attributeHealer: unboundAttributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
 	let healResources = currentState.resources ?? {};
-	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources);
+	let healNamingSecrets;
+	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources, (map) => healNamingSecrets?.(map));
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
 	const secretStandInTokens = standInTokensOf(inheritedSecretTokens);
@@ -5081,9 +5080,36 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
 		recordLogOnlyParameterValue(splitPieces, mergedParameters[name], splitDelimiters);
 	}
-	const noEchoJudge = new Map(diffSecrets);
-	carryLogOnlyValues(diffSecrets, noEchoJudge);
-	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge, /* @__PURE__ */ new Map(), currentState.outputs);
+	const noEchoJudgeValues = new Map(diffSecrets);
+	carryLogOnlyValues(diffSecrets, noEchoJudgeValues);
+	const namingNoEchoParameters = noEchoParametersOf(effectiveTemplate);
+	const namingConditions = conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name)));
+	const namingTemplateResources = effectiveTemplate.Resources ?? {};
+	const recordedNamingValues = (resources, logicalId) => {
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		const templateResource = Object.hasOwn(namingTemplateResources, logicalId) ? namingTemplateResources[logicalId] : void 0;
+		const bag = recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, namingNoEchoParameters, namingConditions);
+		return hasMaskableValues(bag) ? bag : void 0;
+	};
+	const noEchoJudge = (resources) => namingSecretsWithRecordedNoEcho(noEchoJudgeValues, (logicalId) => recordedNamingValues(resources, logicalId));
+	const liveNamingJudge = (resources) => {
+		const memo = /* @__PURE__ */ new Map();
+		return (logicalId) => {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			let hit = memo.get(logicalId);
+			if (hit === void 0 || hit.record !== record) {
+				hit = {
+					record,
+					bag: recordedNamingValues(resources, logicalId)
+				};
+				memo.set(logicalId, hit);
+			}
+			const stored = hit.bag;
+			return stored === void 0 ? diffSecrets : unionOfSecretBags([diffSecrets, stored]);
+		};
+	};
+	healNamingSecrets = noEchoJudge;
+	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge(currentState.resources ?? {}), /* @__PURE__ */ new Map(), currentState.outputs);
 	const outputsPassSecrets = /* @__PURE__ */ new Map();
 	const printing = createDiffPrintingMasker([
 		diffSecrets,
@@ -5100,7 +5126,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordedSecretValues: bag,
 		...printingSecrets && { printingSecrets },
 		...crossStackReads && { crossStackReads },
-		secretNameNeedles: stateSecretNameNeedles(currentState.resources, diffSecrets),
+		secretNameNeedles: stateSecretNameNeedles(currentState.resources, liveNamingJudge(currentState.resources)),
 		secretNameSink: derivedNames,
 		...inheritedForResolver && { inheritedSecrets: inheritedForResolver },
 		...secretStandInTokens && { secretStandInTokens },
@@ -5153,7 +5179,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
-			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge, stateNames, currentState.outputs);
+			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources), stateNames, currentState.outputs);
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
@@ -5180,7 +5206,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				return {
 					value: await intrinsicResolver.resolve(structuredClone(node), {
 						recordedSecretValues: secrets,
-						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, diffSecrets),
+						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, liveNamingJudge(resourcesForInputs)),
 						secretNameSink: derivedNames,
 						template: effectiveTemplate,
 						resources: resourcesForInputs,
@@ -5314,7 +5340,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate,
 		printingSecrets,
 		derivedNames: diffPrintingSecrets([derivedNames, inheritedDerivedNames]),
-		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge),
+		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources)),
+		namingSecretsFor: noEchoJudge,
 		resolvedParameters: mergedParameters,
 		conditions,
 		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
@@ -5542,17 +5569,20 @@ function recordedTemplateResources(template, state) {
 	for (const [logicalId, resource] of Object.entries(resources)) if (Object.prototype.hasOwnProperty.call(stateResources, logicalId)) recorded[logicalId] = resource;
 	return recorded;
 }
-function healerUnderRecordPrintingBag(healer, resources) {
+function healerUnderRecordPrintingBag(healer, resources, namingSecrets) {
 	let judged;
 	const bagFor = (logicalId, resource) => {
 		const map = resources();
-		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
-			...map,
-			[logicalId]: resource
-		});
+		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) {
+			const withSelf = {
+				...map,
+				[logicalId]: resource
+			};
+			return secretNamePrintingBags(withSelf, namingSecrets?.(withSelf))(logicalId);
+		}
 		if (judged?.map !== map) judged = {
 			map,
-			bagOf: secretNamePrintingBags(map, void 0)
+			bagOf: secretNamePrintingBags(map, namingSecrets?.(map))
 		};
 		return judged.bagOf(logicalId);
 	};
@@ -5590,7 +5620,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, namingSecretsFor, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -5642,7 +5672,7 @@ async function buildDiffTree(args) {
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
 		const childSecretTokens = /* @__PURE__ */ new Map();
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}, namingSecretsFor), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
 			inherited: inheritedSecretTokens,
 			child: childSecretTokens
 		});
@@ -10981,7 +11011,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							const markedRefused = marked === void 0 ? [] : maskPreserved.unpreservablePaths.filter((path) => isMarkedCoordinate(revertPathSegments(path), marked));
 							const markedAmong = markedRefused.length > 0;
 							const markedPaths = maskSecretsInText(markedRefused.join(", "), secrets);
-							logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. ${markedAmong ? `Where a NoEcho template parameter feeds a path (${markedPaths}), deploy the stack with the parameter's value to set it. For the other paths, three` : "Three"} causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value); the Fn::Base64 encoding of a secret value, which cdkd never records (deploy a change to this resource, which sends it the encoded value again); or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so its baseline is re-captured). A re-deploy that leaves this resource unchanged sends it nothing, so it resolves this refusal for none of them.`);
+							logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. ${markedAmong ? `Where a NoEcho template parameter feeds a path (${markedPaths}), deploy the stack with the parameter's value to set it. For the other paths, four` : "Four"} causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value); the Fn::Base64 encoding of a secret value, which cdkd never records (deploy a change to this resource, which sends it the encoded value again); two secret values that overlap inside the value, which no single reference renders (change the property, or rotate one of the secrets, so that they no longer overlap, and deploy that change); or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so its baseline is re-captured). A re-deploy that leaves this resource unchanged sends it nothing, so it resolves this refusal for none of them.`);
 							return;
 						}
 						newProperties = maskPreserved.properties;
@@ -12180,7 +12210,16 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		const graph = dagBuilder.buildGraph(template);
 		const executionLevels = dagBuilder.getExecutionLevels(graph);
 		logger.debug(`Dependency graph: ${executionLevels.length} level(s)`);
-		const printingBagOf = secretNamePrintingBags(state.resources, noEchoValues);
+		const reresolver = ctx.noEchoReresolver;
+		const judgedBagOf = secretNamePrintingBags(state.resources, reresolver === void 0 ? noEchoValues : namingSecretsWithRecordedNoEcho(noEchoValues, (logicalId) => {
+			try {
+				return reresolver.recordedNoEchoValuesFor(logicalId, Object.hasOwn(state.resources, logicalId) ? state.resources[logicalId] : void 0);
+			} catch (error) {
+				logger.debug(safeMsg`Could not read ${logicalId}'s stored NoEcho values for its printing bag (${error instanceof Error ? error.name : typeof error}).`);
+				return;
+			}
+		}));
+		const printingBagOf = (logicalId) => withStackName(stackName, () => judgedBagOf(logicalId));
 		for (let levelIndex = executionLevels.length - 1; levelIndex >= 0; levelIndex--) {
 			if (lock.interrupted) {
 				logger.debug("Interrupted (draining) — not scheduling further deletion levels");
@@ -15736,7 +15775,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: `cdkd state holds only the redaction mask ('***') for at least one property, and cdkd cannot re-derive the value. There are three ways a record comes to hold it. (1) A NoEcho custom-resource value: forcing the custom resource to update does NOT clear this — the handler supplies the value to the deploy and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData): cdkd never records that encoding, so re-deploying the same template does not clear this. Stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear) and re-deploy, then export again. (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask with cdkd import ${commandHole("stack")} --resource ${commandHole("logicalId")}=${commandHole("physicalId")} --force (granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. In every case you can also export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274.`
+				reason: `cdkd state holds only the redaction mask ('***') for at least one property, and cdkd cannot re-derive the value. There are four ways a record comes to hold it. (1) A NoEcho custom-resource value: forcing the custom resource to update does NOT clear this — the handler supplies the value to the deploy and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData): cdkd never records that encoding, so re-deploying the same template does not clear this. Stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear) and re-deploy, then export again. (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask with cdkd import ${commandHole("stack")} --resource ${commandHole("logicalId")}=${commandHole("physicalId")} --force (granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it: change the property (or rotate one of the secrets) so that they no longer overlap, re-deploy, then export again. In every case you can also export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274.`
 			});
 			continue;
 		}
@@ -22161,6 +22200,19 @@ function hasSdkMetadata(error) {
 	return error.$metadata !== void 0;
 }
 
+//#endregion
+//#region src/local/local-role-arn.ts
+async function applyRoleArnForLocal(opts) {
+	await applyRoleArnIfSet(opts);
+	const role = getAssumedRoleCredentials();
+	if (role === void 0) return;
+	recordAssumedRole(getPreAssumeEnvCredentials(), {
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		sessionToken: role.sessionToken
+	});
+}
+
 //#endregion
 //#region src/cli/commands/local-state-loader.ts
 async function loadStateForStack(stackName, synthRegion, opts) {
@@ -22503,175 +22555,7 @@ const fromStateFactory = (options) => {
 };
 const cdkdExtraStateProviders = { fromState: fromStateFactory };
 function createLocalStateProvider$1(options, cdkdStackName, synthRegion) {
-	const provider = createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
-	if (provider instanceof CfnLocalStateProvider) bindCallerIdentityClients(provider, options.profile);
-	else if (isCfnFlagPresent(options) && cannotLeaveUnbound(options.profile)) throw new Error(cfnProviderRefusal(["a --from-cfn-stack provider that is not CfnLocalStateProvider"]));
-	return provider;
-}
-function cannotLeaveUnbound(profile) {
-	if (getAssumedRoleCredentials() === void 0) return false;
-	return !(profile || process.env["AWS_PROFILE"]);
-}
-function cfnProviderRefusal(drift) {
-	return `--from-cfn-stack cannot run under --role-arn with this cdk-local version: it has ${drift.join(", ")}, so cdkd cannot make it read the stack with your own credentials instead of the role's. Pass --profile <name> (your own profile), or use the cdk-local version this cdkd release ships with.`;
-}
-const CFN_PROVIDER_CLIENT_GETTERS = [
-	"getClient",
-	"getLambdaClient",
-	"getSsmClient",
-	"getAgentCoreControlClient"
-];
-const CFN_PROVIDER_CLIENT_SLOTS = [
-	"client",
-	"lambdaClient",
-	"ssmClient",
-	"agentCoreControlClient"
-];
-const CFN_PROVIDER_PROTOTYPE_MEMBERS = [
-	"constructor",
-	...CFN_PROVIDER_CLIENT_GETTERS,
-	"resolveTemplateSsmParameters",
-	"resolveDeployedFunctionEnv",
-	"resolveLambdaExecutionRoleArn",
-	"resolveAgentCoreRuntimeRoleArn",
-	"load",
-	"getLastLoadError",
-	"buildCrossStackResolver",
-	"dispose"
-];
-function cfnProviderShapeDrift(provider) {
-	const proto = Object.getPrototypeOf(provider);
-	const allowed = CFN_PROVIDER_PROTOTYPE_MEMBERS;
-	const slots = CFN_PROVIDER_CLIENT_SLOTS;
-	const drift = [];
-	for (const name of CFN_PROVIDER_CLIENT_GETTERS) if (typeof proto?.[name] !== "function") drift.push(`no ${name}()`);
-	for (let p = proto; p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) for (const name of Object.getOwnPropertyNames(p)) if (!allowed.includes(name)) drift.push(`an unknown ${name}()`);
-	for (const slot of CFN_PROVIDER_CLIENT_SLOTS) if (!Object.hasOwn(provider, slot)) drift.push(`no ${slot} slot`);
-	if (typeof provider.region !== "string" || !Object.hasOwn(provider, "region")) drift.push("no region field");
-	for (const name of Object.getOwnPropertyNames(provider)) if (/Client$/.test(name) && !slots.includes(name)) drift.push(`an unknown ${name} slot`);
-	return drift;
-}
-function bindCallerIdentityClients(provider, profile) {
-	const drift = cfnProviderShapeDrift(provider);
-	if (drift.length > 0) {
-		if (!cannotLeaveUnbound(profile)) return;
-		throw new Error(cfnProviderRefusal(drift));
-	}
-	const slots = provider;
-	const live = () => {
-		if (slots.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
-	};
-	const config = () => ({
-		region: slots.region,
-		...profile && { profile }
-	});
-	slots.getClient = () => {
-		live();
-		return slots.client ??= new CloudFormationClient({
-			...awsClientDefaults({
-				profile,
-				ignoreAssumedRole: true
-			}),
-			...config()
-		});
-	};
-	slots.getLambdaClient = () => {
-		live();
-		return slots.lambdaClient ??= new LambdaClient({
-			...awsClientDefaults({
-				profile,
-				ignoreAssumedRole: true
-			}),
-			...config()
-		});
-	};
-	slots.getSsmClient = () => {
-		live();
-		return slots.ssmClient ??= new SSMClient({
-			...awsClientDefaults({
-				profile,
-				ignoreAssumedRole: true
-			}),
-			...config()
-		});
-	};
-	slots.getAgentCoreControlClient = () => {
-		live();
-		return slots.agentCoreControlClient ??= new BedrockAgentCoreControlClient({
-			...awsClientDefaults({
-				profile,
-				ignoreAssumedRole: true
-			}),
-			...config()
-		});
-	};
-}
-function engineCredentialTripleChannel(containers) {
-	return {
-		what: `the role's AWS credentials are copied into ${containers}, so that code runs as the role`,
-		flagOnly: true
-	};
-}
-const ENGINE_ECS_SECRETS_CHANNEL = {
-	what: "ECS task secrets are fetched with the role and injected as plaintext into the container's environment",
-	flagOnly: false
-};
-const ENGINE_DYNAMIC_REFERENCE_CHANNEL = {
-	what: "CloudFormation dynamic references ({{resolve:...}}) are fetched with the role and injected as plaintext into the container's environment",
-	flagOnly: false
-};
-const ENGINE_ASSUME_ROLE_CHANNEL = {
-	what: "the role --assume-role / --assume-task-role assumes for the container is assumed BY the --role-arn role, so the container can receive a role you could not assume yourself",
-	flagOnly: false
-};
-function engineFromCfnStackChannel(alsoReads) {
-	return {
-		what: "--from-cfn-stack reads the deployed stack, including SecureString parameters decrypted into the container's environment" + (alsoReads ? `, and ${alsoReads}` : ""),
-		flagOnly: false
-	};
-}
-function engineFromStateChannel(reads) {
-	return {
-		what: `--from-state makes the engine read ${reads}`,
-		flagOnly: false
-	};
-}
-const ENGINE_ACCOUNT_ID_CHANNEL = {
-	what: "${AWS::AccountId} resolves to the role's account in the container's environment, secret references and image URIs",
-	flagOnly: false
-};
-function warnEngineRoleExposure(cmd, commandName, channels, fromCfnStackChannel = engineFromCfnStackChannel(), fromStateChannel) {
-	cmd.hook("preAction", (_thisCommand, actionCommand) => {
-		const options = actionCommand.optsWithGlobals();
-		const message = engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, {
-			roleArn: options.roleArn || process.env["CDKD_ROLE_ARN"],
-			profileFlag: options.profile,
-			envProfile: process.env["AWS_PROFILE"],
-			fromCfnStack: isCfnFlagPresent(options),
-			assumesForWorkload: isAssumeRequested(options.assumeRole) || isAssumeRequested(options.assumeTaskRole),
-			fromState: options.fromState === true
-		}, fromStateChannel);
-		if (message !== void 0) getLogger().warn(message);
-	});
-	return cmd;
-}
-function isAssumeRequested(value) {
-	if (typeof value === "string") return value !== "";
-	if (value !== null && typeof value === "object") return Object.keys(value).length > 0;
-	return value === true;
-}
-function engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, input, fromStateChannel) {
-	if (!input.roleArn || !isIamRoleArn(input.roleArn) || input.profileFlag) return void 0;
-	const all = [
-		...channels,
-		...input.assumesForWorkload ? [ENGINE_ASSUME_ROLE_CHANNEL] : [],
-		...input.fromCfnStack ? [fromCfnStackChannel] : [],
-		...input.fromState && fromStateChannel ? [fromStateChannel] : []
-	];
-	const envProfileSet = !!input.envProfile;
-	const open = envProfileSet ? all.filter((c) => c.flagOnly) : all;
-	if (open.length === 0) return void 0;
-	return `cdkd local ${commandName}: --role-arn ${envProfileSet ? "is set, and the exported AWS_PROFILE does not cover what follows (only the --profile flag does)" : "is set and no profile is selected"}, so the local emulation engine resolves these AS THE ROLE and hands them to your local code: ${open.map((c) => c.what).join("; ")}. Pass --profile <name> with your own profile to keep them on your identity, or do not pass a role whose permissions you would not give the code in the container.`;
+	return createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
 }
 
 //#endregion
@@ -24153,7 +24037,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger)
 	assertSendableRoleArn(roleArn, (message) => new LocalInvokeBuildError$1(message));
 	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull...`);
 	const sts = new STSClient({
-		...clientDefaultsFor(credentialConfig),
+		...clientDefaultsFor(credentialConfig, true),
 		...callerRegion && { region: callerRegion }
 	});
 	try {
@@ -25103,7 +24987,7 @@ async function localStartApiCommand(target, options) {
 	}
 	warnIfDeprecatedRegion(options);
 	if (options.layerRoleArn !== void 0) explicitRoleArnOrThrow("--layer-role-arn", options.layerRoleArn);
-	await applyRoleArnIfSet({
+	await applyRoleArnForLocal({
 		roleArn: options.roleArn,
 		region: options.region
 	});
@@ -25184,7 +25068,7 @@ async function localStartApiCommand(target, options) {
 			const direct = buildCorsConfigByApiId(stack.template);
 			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
 		}
-		const stateByStack = options.fromState || isCfnFlagPresent$1(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
+		const stateByStack = options.fromState || isCfnFlagPresent(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials, {
 			onDirCreated: (hostPath) => {
@@ -26228,12 +26112,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -26241,6 +26120,11 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -27256,7 +27140,7 @@ async function localRunTaskCommand(target, options) {
 	try {
 		if (typeof options.assumeTaskRole === "string") assertFlagRoleArn("--assume-task-role", options.assumeTaskRole);
 		if (options.ecrRoleArn !== void 0) assertFlagRoleArn("--ecr-role-arn", options.ecrRoleArn);
-		await applyRoleArnIfSet({
+		await applyRoleArnForLocal({
 			roleArn: options.roleArn,
 			region: options.region
 		});
@@ -27367,17 +27251,15 @@ async function localRunTaskCommand(target, options) {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 	}
 }
+function readFromCfnStack(source) {
+	return source.fromState !== true && source.fromCfnStack !== void 0 && source.fromCfnStack !== false;
+}
 async function resolvePlaceholderAccount(arn, source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27385,6 +27267,11 @@ async function resolvePlaceholderAccount(arn, source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new CdkdError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`, "LOCAL_RUN_TASK_PLACEHOLDER_NO_ACCOUNT");
@@ -27444,7 +27331,8 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 			accountId = await resolveStackAccountId$1({
 				region,
 				profile: options.profile,
-				fromState: options.fromState
+				fromState: options.fromState,
+				fromCfnStack: options.fromCfnStack
 			});
 		} catch (err) {
 			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
@@ -27498,15 +27386,10 @@ function pickCandidateStack(parsed, target, stacks) {
 	if (matched.length === 1) return matched[0];
 }
 async function resolveStackAccountId$1(source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27514,6 +27397,11 @@ async function resolveStackAccountId$1(source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -27635,11 +27523,6 @@ function createLocalStartServiceCommand() {
 		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
 	}));
 	addStartServiceSpecificOptions(cmd);
-	warnEngineRoleExposure(cmd, "start-service", [
-		ENGINE_ECS_SECRETS_CHANNEL,
-		ENGINE_ACCOUNT_ID_CHANNEL,
-		ENGINE_DYNAMIC_REFERENCE_CHANNEL
-	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
@@ -27955,7 +27838,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 	try {
 		if (typeof options.assumeRole === "string") explicitRoleArnOrThrow("--assume-role", options.assumeRole, (message) => new CdkdError(message, "LOCAL_INVOKE_AGENTCORE_ASSUME_ROLE_INVALID"));
 		if (options.ecrRoleArn !== void 0) assertFlagRoleArn("--ecr-role-arn", options.ecrRoleArn, (message) => new CdkdError(message, "LOCAL_INVOKE_AGENTCORE_ECR_ROLE_ARN_INVALID"));
-		await applyRoleArnIfSet({
+		await applyRoleArnForLocal({
 			roleArn: options.roleArn,
 			region: options.region
 		});
@@ -28549,7 +28432,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 	let accountId;
 	try {
-		accountId = await resolveStackAccountId(region, options.profile, options.fromState);
+		accountId = await resolveStackAccountId(region, options.profile, options.fromState, options.fromCfnStack);
 	} catch (err) {
 		logger.warn(safeMsg`${stateProvider.label}: STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. ` + "A same-stack ECR image URI referencing ${AWS::AccountId} may not resolve.");
 	}
@@ -28570,15 +28453,10 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		loaded: loaded ?? void 0
 	};
 }
-async function resolveStackAccountId(region, profile, fromState) {
+async function resolveStackAccountId(region, profile, fromState, fromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (!fromState && fromCfnStack !== void 0 && fromCfnStack !== false) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -28586,6 +28464,11 @@ async function resolveStackAccountId(region, profile, fromState) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -28844,11 +28727,6 @@ function createLocalStartAgentCoreCommand$1() {
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
-	warnEngineRoleExposure(cmd, "start-agentcore", [
-		engineCredentialTripleChannel("the agent container"),
-		ENGINE_ACCOUNT_ID_CHANNEL,
-		ENGINE_DYNAMIC_REFERENCE_CHANNEL
-	]);
 	return adoptDeprecatedRegionFlag(cmd);
 }
 
@@ -28859,18 +28737,11 @@ function createLocalStartAlbCommand() {
 		await runEcsServiceEmulator(targets, options, albStrategy(options), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
 	}));
 	addAlbSpecificOptions(cmd);
-	warnEngineRoleExposure(cmd, "start-alb", [
-		engineCredentialTripleChannel("the ALB's Lambda target-group containers"),
-		ENGINE_ECS_SECRETS_CHANNEL,
-		ENGINE_ACCOUNT_ID_CHANNEL,
-		ENGINE_DYNAMIC_REFERENCE_CHANNEL
-	]);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
 //#endregion
 //#region src/cli/commands/local-start-cloudfront.ts
-const STATE_SOURCE_ENGINE_READS = "a deployed S3 origin's objects and distribution config and the KeyValueStore entries, and the ${AWS::AccountId} in the Function URL / Lambda@Edge environment resolves to the role's account";
 function createLocalStartCloudFrontCommand$1() {
 	const cmd = createLocalStartCloudFrontCommand({
 		embedConfig: getEmbedConfig(),
@@ -28881,7 +28752,6 @@ function createLocalStartCloudFrontCommand$1() {
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
-	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers"), ENGINE_DYNAMIC_REFERENCE_CHANNEL], engineFromCfnStackChannel(STATE_SOURCE_ENGINE_READS), engineFromStateChannel(STATE_SOURCE_ENGINE_READS));
 	return adoptDeprecatedRegionFlag(cmd);
 }
 
@@ -28917,7 +28787,8 @@ const CDKD_EMBED_CONFIG = {
 		error: (message, ...args) => forwardToCdkdLogger("error", message, args),
 		setLevel: (level) => getLogger().setLevel(level),
 		getLevel: () => getLogger().getLevel()
-	}
+	},
+	workloadIdentity: "caller"
 };
 async function localInvokeCommand(target, options) {
 	const logger = getLogger();
@@ -28983,7 +28854,7 @@ async function localInvokeCommand(target, options) {
 		if (typeof options.assumeRole === "string") explicitRoleArnOrThrow("--assume-role", options.assumeRole);
 		if (options.layerRoleArn !== void 0) explicitRoleArnOrThrow("--layer-role-arn", options.layerRoleArn);
 		if (options.ecrRoleArn !== void 0) assertFlagRoleArn("--ecr-role-arn", options.ecrRoleArn);
-		await applyRoleArnIfSet({
+		await applyRoleArnForLocal({
 			roleArn: options.roleArn,
 			region: options.region
 		});
@@ -29320,12 +29191,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -29333,6 +29199,11 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -29630,4 +29501,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DEPit8lD.js.map
+//# sourceMappingURL=program-DYfZCsxM.js.map