@go-to-k/cdkd 0.301.3 → 0.301.4

package/dist/{program-CYtSW-WU.js → program-DYfZCsxM.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as repairMalformedResourcesForReadOnly, $c as escapeRegExp, $i as hasReadableOrphans, $n as unsupportedFinalSnapshotError, $o as liveMatchesUnresolvedTokenFrame, $r as IntrinsicFunctionResolver, $s as applyCrossPrefixScan, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphansForOrphan, Ac as parseBootstrapMarker, Ai as getAccountInfo, Al as AssemblyReader, An as collectPublishedOutputNames, Ar as withPrintingSecrets, At as NESTED_PENDING_PARENT_REASON, B as readProtection, Ba as refuseMalformedResourcePropertiesForDestroy, Bc as dockerSpawnEnvWithSensitive, Bl as displayAssemblyPath, Bn as secretNamePrintingBags, Bo as canonicalCoordinates, Br as deleteLeftInPlace, Bs as wholeStringLeavesOf, Bt as collectNestedChildUnaddressed, Ca as previewableOrphanRecords, Cc as rewriteTemplateAssetReferences, Ci as classifyRecordedSecretRegion, Cl as uploadCfnTemplate, Cn as secretSafeKeyDisplay, Cr as isCustomResource, Cs as isUncertifiedBaselineMaskPosition, Ct as dropFailedCommands, D as findServiceTokenRefusals, Da as refuseMalformedOrphanRecordsForDestroy, Dc as ensureAssetStorage, Di as coerceParameterTypedValue, Dl as PARTITION_TABLE, Dn as isWholeDynamicReferenceValue, Dr as readsNoEchoDeleteValues, Ds as recordNestedStackParameterExpressions, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphanRecords, Ec as assertAssetBucketRegion, Ei as regionLessSecretName, El as expectedOwnerParam, En as exportNameSecretExposure, Er as TemplateNoEchoReresolver, Es as inheritNestedStackParameterAssociations, Et as journaledOrphanLines, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForDeploy, Fc as buildDockerImage, Fi as keepsSecretReferenceToken, Fl as hasPlainPrototype, Fn as completedReplayEntries, Fr as slowCcOperationTimeoutMs, Fs as recordMaskOnlyValue, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcesForDestroy, Gc as isMalformedEnvKey, Gi as JSON_LISTING_HOLE_VALUE, Gn as ATOMIC_FINAL_SNAPSHOT_TYPES, Go as maskedLeafCoordinatesOf, Gs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ha as refuseMalformedResourcePropertiesForExport, Hc as formatDockerLoginError, Hi as parameterInputsFor, Hl as resolveAssemblyPath, Hn as stateSecretNameNeedles, Ho as maskAtCoordinates, Hs as STATE_SOURCED_CROSS_GENERATION_RULES, Ht as withNestedStackContext, I as recordedProtectionNote, Ia as refuseMalformedResourceEntriesForDestroy, Ic as resolveDockerContextDirectory, Ii as AWS_NO_VALUE, Il as nullPrototypeRecord, In as journaledOrphanPrintingBag, Is as recordMaskOnlyValuesIn, It as recordDisplacedSkips, Ja as repairMalformedOrphanRecordsForReadOnly, Jc as redactedCause, Ji as UNREADABLE_ORPHANS_CONTAINER_ROW, Jn as ccRoutedFinalSnapshotError, Jo as noEchoOutputsComparison, Js as isLockInfoExpired, Jt as withStackRecords, Ka as refuseMalformedResourcesForExport, Kc as partitionSensitiveEnv, Ki as STATE_REGION_DIVERGED, Kl as resolveBucketRegion, Kn as PRE_DELETE_SNAPSHOT_TYPES, Ko as noEchoCoordinatesOf, Ks as isSingleDynamicReferenceToken, Kt as destroyStackRecordsView, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourceEntriesForImport, Lc as describeDockerCapturedOutput, Li as cfnRefValueFromPhysicalId, Ll as ownValue, Ln as maskEventTextWithBoundBags, Lr as RollbackInlinePolicyWriters, Ls as recordNoEchoAttributeValues, M as noEchoComparisonForTemplate, Ma as refuseMalformedOutputsForDestroy, Mc as validateAssetBucketName, Mi as carriesDynamicReference, Ml as processStackMessages, Mn as bindingSkippedOutputs, Mo as templateResourceTypes, Mr as applyCustomResourceResponseExpiration, Ms as splitGetAttStringForm, Mt as displacedPhysicalIdShown, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceAttributesForOrphan, Nc as validateContainerRepoName, Ni as carriesFetchableDynamicReference, Nl as defineOwnKey, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as describeTypeWithThrottleRetry, Nr as customResourceResponseExpirationWarning, Ns as carriesSecretMask, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphans, Oc as getBootstrapMarkerKey, Oi as isUnboundTemplateParameter, Ol as canonicalizeRegion, On as noEchoParameterValueSeed, Or as isCustomResourceType$1, Ot as makeForeignHolderScan, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntries, Pc as buildDenyExternalAccessPolicy, Pi as isNamelessDynamicReferenceError, Pl as hasOwnKey, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as withRetry, Pr as CloudControlProvider, Ps as provenPublicValue, Qa as repairMalformedResourcePropertiesForReadOnly, Qc as warnFinchArgvExposure, Qi as displayLogicalId, Qn as refusesFinalSnapshot, Qo as valueAtCoordinate, Qr as INTRINSIC_KEYS, Qs as CrossPrefixScanCache, Qt as demoteSupersededOrphans, R as isProtectionValueActive, Ra as refuseMalformedResourceEntriesForImportSave, Rc as describeDockerExecFailure, Ri as isStalePlaceholderArnAttribute, Rl as absoluteAssemblyPathEscape, Rn as orphanRecordsPrintingBag, Ro as DagBuilder, Rr as UNSPECIFIED_SKIP_REASON, Rs as recordNoEchoParameterFreshValue, Rt as revertedNestedRowIds, Sa as malformedStateRefusalMessage, Sc as loadPublishableAssetManifest, Sl as findLargeInlineResources, Sn as secretBearingStateKeyWarning, Sr as ccBrokenReason, Ss as dynamicReferenceTokens, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Tc as BOOTSTRAP_MARKER_PREFIX, Ti as producerRegionsFromState, Tl as decodeListingKey, Tn as exportNameNoEchoParameters, Ts as identityKeyFor, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForOrphan, Uc as getDockerCmd, Ul as injectAwsRegion, Un as storedSecretNameNeedles, Uo as maskReadbackAtCoordinates, Ur as isWaitAbandonedError, Us as STATE_SOURCED_READBACK_RULES, Ut as replayFailedOperations, Va as refuseMalformedResourcePropertiesForDrift, Vc as finchSecretArgvRefusal, Vi as withSharedDrainBudget, Vl as renderAssemblyPathEscape, Vn as secretNamedRecordNeedles, Vo as isMarkedCoordinate, Vr as deleteSkipReason, Vs as STATE_SOURCED_BASELINE_RULES, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcesForDeploy, Wc as isDockerClientEnvKey, Wi as declaresNoEcho, Wl as injectedAwsRegionValue, Wn as extractDeploymentEventError, Wo as maskWholeValue, Ws as TEMPLATE_SOURCED_RULES, Wt as replayRollback, Xa as repairMalformedOutputsForReadOnly, Xc as runDockerForeground, Xi as accountArgs, Xn as effectiveDeletionPolicy, Xo as readbackPathFor, Xs as rebuildClientForBucketRegion, Ya as repairMalformedOrphansForReadOnly, Yc as redactedDockerCause, Yi as UNREADABLE_RESOURCES_MAP_ROW, Yn as createPreDeleteFinalSnapshot, Ys as S3StateBackend, Yt as removeProtectionTypeList, Za as repairMalformedResourceEntriesForReadOnly, Zc as runDockerStreaming, Zi as deployRefusesOrphanRowsReason, Zn as isFinalSnapshotError, Zo as readsNoEchoSource, Zr as DiffCalculator, Zs as CrossPrefixReadError, Zt as recordAfterRollbackUpdate, _ as keptWholeReasonText, _a as malformedRenderedContainersWarning, _c as isSensitiveAttributeName, _i as recordedReferenceRegions, _l as warnDeprecatedNoPrefixCliFlag, _n as orphanNeedsIdentity, _s as redactSecretsForState, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedExportNamesWarning, ac as describeRegionValueKind, ai as assertSendableRoleArn, al as synthesisStatusMessage, an as replacementNeverSwapped, ar as ledgerForStack, as as printingCorpusOf, at as createReadOnlyAttributeHealerFactory, ba as malformedResourcesWarning, bc as buildAssetRedirectMap, bl as CFN_TEMPLATE_URL_LIMIT, bn as exportAliasCollisionScrubWarning, br as CC_BROKEN_REASON, bt as pendingRequestCount, c as isAbsoluteAssetPath, ca as malformedLocalResourceEntriesWarning, cc as hasReasonlessBaselineRefusal, ci as sendableAssumeRoleCommand, cl as loadCdkJson, cn as findNestedStackTypeChanges, co as NO_CC_HANDLERS_REASON, cs as shareLogOnlyValues, ct as gray, d as templateIdentity, da as malformedOrphanRecordsWarning, dc as importableOutputs, di as callerEnvCredentials, dl as resolveCaptureObservedState, do as shownType, ds as errorCauseChain, dt as yellow, ea as hasReadableOutputs, ec as crossPrefixDeniedWarning, ei as poisonRenderedSpellingsCollidingIn, el as stripControlChars, en as isReplacementOrphan, eo as unpreviewableOrphanRecords, er as maskingRetryLogger, es as carryLogOnlyValues, f as conditionFingerprint, fa as malformedOrphanRowsKeptWarning, fc as isReadableBag, fi as envCredentialsAreAssumedRole, fl as resolveSkipPrefix, fo as MULTI_REGION_RECREATE_BLOCKED_TYPES, fs as maskSecretsInError, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedOutputsWarning, gc as AssetPublisher, gi as recordedOutputReferenceRegions, gl as stateBucketExistenceConfirmed, gn as updatePartialReason, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedOutputsRefusalMessage, hc as shouldRetainResource, hl as resolveUseCdkBootstrapAssets, hn as updatePartialMessage, ho as renderStatefulReason, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedDriftResourcePropertiesWarning, ic as acceptedCreateOnlyDropsOf, ii as assertFlagRoleArn, il as Synthesizer, in as recordUnderIdIsNotOwn, io as findActionableSilentDrops, is as logOnlyValueCount, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedOutputs, jc as readBootstrapMarkerBody, ji as isImpossibleEmptyStoredAttribute, jl as StageLoadError, jn as isExportAliasCollision, jo as prefetchCreateOnlyPropertyPaths, jr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, js as recordPhysicalNameCopy, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphansForDestroy, kc as isCrossRegionRedirect, ki as parameterTypeMayLoseSecretIdentity, kl as derivePartitionAndUrlSuffix, kn as collectDeclaredOutputNames, ks as physicalNameCopiesOf, kt as sameJournaledOrphans, l as listNestedTemplateRows, la as malformedLocalResourcesWarning, lc as hasUnverifiableParameterRefusal, li as AWS_CREDENTIAL_ENV_KEYS, ll as resolveApp, lo as hasNoCloudControlHandlers, ls as unionOfSecretBags, lt as green, m as parentSuppliedValues, ma as malformedOrphansWarning, mc as orphansCarriedFrom, mi as keepHeldTokenProvenance, ml as resolveStateBucketWithDefaultAndSource, mo as isStatefulRecreateTargetSync, ms as markSameGenerationBag, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as isReadableOrphanRecord, nc as isNotImplemented, ni as refuseUnreadableCdkCrossAccountRefs, nl as AssetManifestLoader, nn as planRollback, no as unreadableResourceEntries, nr as findDestructiveChanges, ns as hasMaskableValues, o as childTemplateLoader, oa as malformedExportSourceWarning, oc as exportNamesCarriedFrom, oi as explicitRoleArnOrThrow, ol as getDefaultStateBucketName, on as resolveReplacementOldType, oo as unwrittenCreateOnlyReplacement, os as recordLogOnlyParameterValue, ot as bold, p as conditionInputsFrom, pa as malformedOrphansRefusalMessage, pc as orphansAfterRollback, pl as resolveStateBucketWithDefault, po as isStatefulRecreateTargetForReplace, ps as maskSecretsInText, pt as namesAnyDeclaredParameter, qa as refuseMalformedState, qc as redactDockerArgvValues, qi as STATE_RESOURCES_MALFORMED, qn as buildFinalSnapshotIdentifier, qo as noEchoLeavesOf, qs as LockManager, r as computeImplicitDeleteEdges, ra as isReadableResourceEntry, rc as splitImportedOps, ri as applyRoleArnIfSet, rl as getDockerImageBySourceHash, rn as recheckFailedPlan, ro as withheldAccountClause, rr as formatDestructiveChange, rs as literalSplitDelimitersOf, s as findNestedTemplateTreeDefect, sa as malformedLocalOutputsWarning, sc as hasReadableExportSet, si as isIamRoleArn, sl as getLegacyStateBucketName, sn as seedsDeleteFirstGuard, sr as withCreateTokenLedger, ss as recordLogOnlyValue, st as cyan, t as DeployEngine, ta as hasReadableResources, tc as isAccessDenied, ti as producerLookupOver, tl as stripForDisplay, tn as planFailedOps, to as unreadableOrphanRecords, tr as constructPathOf, ts as createUnionSecretMasker, u as renderNestedTemplateTreeDefect, ua as malformedOrphanRecordsRefusalMessage, uc as importableOutputKeys, ui as applyCallerIdentityCredentials, ul as resolveAutoAssetStorage, un as inheritProducerRegions, uo as findReplacedReadersOfRecreateTargets, us as createSecretMasker, ut as red, v as mergeNoChangeOutputs, va as malformedResourceEntriesWarning, vc as stringifyValue, vl as ssmResolvedValueType, vn as WITHHELD_NAME_DISPLAY, vs as scrubResourceRecord, vt as DeploymentEventsReader, w as keptForReadoption, wa as refuseDivergentRecordRegionForDestroy, wc as AssetModeResolver, wi as classifyReplaySecretRegion, wl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, wn as carriedExportAliasExposure, wr as wouldReturnToSdkProvider, ws as pathCrossesDottedKey, wt as dropFailedHint, xa as malformedScrubResourceEntriesRefusalMessage, xc as createAssetRedirectResolver, xl as MIGRATE_TMP_PREFIX, xn as secretBearing, xr as ProviderRegistry, xs as DYNAMIC_REFERENCE_TOKEN_SCAN, xt as resolvePendingCloudControlRequests, y as makeCanonicalizePropertiesFn, ya as malformedResourcePropertiesWarning, yc as WorkGraph, yl as CFN_TEMPLATE_BODY_LIMIT, yn as displayTextOrWithheld, ys as withPhysicalNameCopies, yt as DeploymentEventsStore, z as perType, za as refuseMalformedResourceEntriesForOrphan, zc as describeDockerFailure, zi as refStateLookupFromResource, zl as describeFileReadFailure, zn as secretNamePrintingBag, zo as TemplateParser, zr as deleteIndeterminateGuards, zs as recordProvenPublicExpression, zt as withNestedRevertRun } from "./deploy-engine-CZaafy9R.js";
-import { t as getCdkdVersion } from "./version-Cx2pAgJv.js";
+import { $a as repairMalformedResourceEntriesForReadOnly, $c as runDockerForeground, $i as deployRefusesOrphanRowsReason, $n as isFinalSnapshotError, $o as readsNoEchoSource, $r as DiffCalculator, $s as rebuildClientForBucketRegion, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphans, Ac as ensureAssetStorage, Ai as isUnboundTemplateParameter, Al as PARTITION_TABLE, An as collectPublishedOutputNames, Ar as isCustomResourceType$1, As as recordNestedStackParameterExpressions, At as NESTED_PENDING_PARENT_REASON, Ba as refuseMalformedResourceEntriesForImportSave, Bc as describeDockerCapturedOutput, Bi as isStalePlaceholderArnAttribute, Bl as ownValue, Bn as secretNamePrintingBag, Bo as DagBuilder, Br as UNSPECIFIED_SKIP_REASON, Bs as recordNoEchoAttributeValues, Bt as collectNestedChildUnaddressed, C as computeImplicitDeleteEdges, Ca as malformedScrubResourceEntriesRefusalMessage, Cc as buildAssetRedirectMap, Cl as CFN_TEMPLATE_URL_LIMIT, Cn as secretSafeKeyDisplay, Cr as ProviderRegistry, Ct as dropFailedCommands, D as findServiceTokenRefusals, Dc as AssetModeResolver, Di as producerRegionsFromState, Dl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as isWholeDynamicReferenceValue, Ds as pathCrossesDottedKey, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseDivergentRecordRegionForDestroy, Ec as rewriteTemplateAssetReferences, Ei as classifyReplaySecretRegion, El as uploadCfnTemplate, En as exportNameSecretExposure, Er as wouldReturnToSdkProvider, Es as isUncertifiedBaselineMaskPosition, Et as journaledOrphanLines, F as perType, Fa as refuseMalformedResourceAttributesForOrphan, Fc as validateAssetBucketName, Fi as carriesFetchableDynamicReference, Fl as processStackMessages, Fn as completedReplayEntries, Fo as describeTypeWithThrottleRetry, Fr as customResourceResponseExpirationWarning, Fs as splitGetAttStringForm, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcePropertiesForOrphan, Gc as formatDockerLoginError, Gl as resolveAssemblyPath, Gn as storedSecretNameNeedles, Go as maskReadbackAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_CROSS_GENERATION_RULES, Ha as refuseMalformedResourcePropertiesForDestroy, Hc as describeDockerFailure, Hl as describeFileReadFailure, Ho as canonicalCoordinates, Hr as deleteLeftInPlace, Hs as recordProvenPublicExpression, Ht as withNestedStackContext, I as readProtection, Ia as refuseMalformedResourceEntries, Ic as validateContainerRepoName, Ii as isNamelessDynamicReferenceError, Il as defineOwnKey, In as journaledOrphanPrintingBag, Io as withRetry, Ir as CloudControlProvider, Is as carriesSecretMask, It as recordDisplacedSkips, Ja as refuseMalformedResourcesForExport, Jc as isMalformedEnvKey, Ji as STATE_REGION_DIVERGED, Jn as PRE_DELETE_SNAPSHOT_TYPES, Jo as noEchoCoordinatesOf, Js as WHOLE_DYNAMIC_REFERENCE_PATTERN, Jt as withStackRecords, Ka as refuseMalformedResourcesForDeploy, Kc as getDockerCmd, Ki as declaresNoEcho, Kl as injectAwsRegion, Kn as extractDeploymentEventError, Ko as maskWholeValue, Ks as STATE_SOURCED_READBACK_RULES, Kt as destroyStackRecordsView, La as refuseMalformedResourceEntriesForDeploy, Lc as buildDenyExternalAccessPolicy, Li as keepsSecretReferenceToken, Ll as hasOwnKey, Ln as maskEventTextWithBoundBags, Lr as slowCcOperationTimeoutMs, Ls as provenPublicValue, M as recordedProtectionNote, Ma as refuseMalformedOrphansForOrphan, Mc as isCrossRegionRedirect, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mn as bindingSkippedOutputs, Mr as withPrintingSecrets, Ms as physicalNameCopiesOf, Mt as displacedPhysicalIdShown, N as PROTECTION_PROPERTY_BY_TYPE, Na as refuseMalformedOutputs, Nc as parseBootstrapMarker, Ni as isImpossibleEmptyStoredAttribute, Nl as AssemblyReader, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as prefetchCreateOnlyPropertyPaths, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphanRecords, Oc as BOOTSTRAP_MARKER_PREFIX, Oi as regionLessSecretName, Ol as decodeListingKey, On as noEchoParameterValueSeed, Or as TemplateNoEchoReresolver, Os as identityKeyFor, Ot as makeForeignHolderScan, P as isProtectionValueActive, Pa as refuseMalformedOutputsForDestroy, Pc as readBootstrapMarkerBody, Pi as carriesDynamicReference, Pl as StageLoadError, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as templateResourceTypes, Pr as applyCustomResourceResponseExpiration, Ps as recordPhysicalNameCopy, Qa as repairMalformedOutputsForReadOnly, Qc as redactedDockerCause, Qi as accountArgs, Qn as effectiveDeletionPolicy, Qo as readbackPathFor, Qs as S3StateBackend, Qt as demoteSupersededOrphans, Ra as refuseMalformedResourceEntriesForDestroy, Rc as buildDockerImage, Ri as AWS_NO_VALUE, Rl as hasPlainPrototype, Rn as namingSecretsWithRecordedNoEcho, Rs as recordMaskOnlyValue, Rt as revertedNestedRowIds, S as IMPLICIT_DELETE_DEPENDENCIES, Sa as malformedResourcesWarning, Sc as WorkGraph, Sl as CFN_TEMPLATE_BODY_LIMIT, Sn as secretBearingStateKeyWarning, Sr as CC_BROKEN_REASON, Ss as withPhysicalNameCopies, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as previewableOrphanRecords, Tc as loadPublishableAssetManifest, Ti as classifyRecordedSecretRegion, Tl as findLargeInlineResources, Tn as exportNameNoEchoParameters, Tr as isCustomResource, Ts as dynamicReferenceTokens, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForDrift, Uc as dockerSpawnEnvWithSensitive, Ui as withSharedDrainBudget, Ul as displayAssemblyPath, Un as secretNamedRecordNeedles, Uo as isMarkedCoordinate, Ur as deleteSkipReason, Us as wholeStringLeavesOf, Ut as replayFailedOperations, Va as refuseMalformedResourceEntriesForOrphan, Vc as describeDockerExecFailure, Vi as refStateLookupFromResource, Vl as absoluteAssemblyPathEscape, Vn as secretNamePrintingBags, Vo as TemplateParser, Vr as deleteIndeterminateGuards, Vs as recordNoEchoParameterFreshValue, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcePropertiesForExport, Wc as finchSecretArgvRefusal, Wi as parameterInputsFor, Wl as renderAssemblyPathEscape, Wn as stateSecretNameNeedles, Wo as maskAtCoordinates, Ws as STATE_SOURCED_BASELINE_RULES, Wt as replayRollback, Xa as repairMalformedOrphanRecordsForReadOnly, Xc as redactDockerArgvValues, Xi as UNREADABLE_ORPHANS_CONTAINER_ROW, Xn as ccRoutedFinalSnapshotError, Xo as noEchoOutputsComparison, Xs as LockManager, Ya as refuseMalformedState, Yc as partitionSensitiveEnv, Yi as STATE_RESOURCES_MALFORMED, Yl as resolveBucketRegion, Yn as buildFinalSnapshotIdentifier, Yo as noEchoLeavesOf, Ys as isSingleDynamicReferenceToken, Yt as removeProtectionTypeList, Za as repairMalformedOrphansForReadOnly, Zc as redactedCause, Zi as UNREADABLE_RESOURCES_MAP_ROW, Zn as createPreDeleteFinalSnapshot, Zs as isLockInfoExpired, Zt as recordAfterRollbackUpdate, _ as makeCanonicalizePropertiesFn, _a as malformedOutputsRefusalMessage, _c as orphansCarriedFrom, _l as resolveStateBucketWithDefaultAndSource, _n as orphanNeedsIdentity, _o as renderStatefulReason, _s as markSameGenerationBag, _t as planOrphanAdoption, a as findNestedTemplateTreeDefect, aa as isReadableResourceEntry, ac as isNotImplemented, ai as applyRoleArnIfSet, al as AssetManifestLoader, an as replacementNeverSwapped, ao as withheldAccountClause, ar as formatDestructiveChange, as as hasMaskableValues, at as red, ba as malformedResourceEntriesWarning, bc as isSensitiveAttributeName, bl as warnDeprecatedNoPrefixCliFlag, bn as exportAliasCollisionScrubWarning, bs as redactSecretsForState, bt as pendingRequestCount, c as renderNestedTemplateTreeDefect, ca as malformedExportSourceWarning, cc as describeRegionValueKind, ci as explicitRoleArnOrThrow, cl as synthesisStatusMessage, cn as findNestedStackTypeChanges, co as unwrittenCreateOnlyReplacement, cs as printingCorpusOf, ct as namesAnyDeclaredParameter, d as conditionInputsFrom, da as malformedLocalResourcesWarning, dc as hasReasonlessBaselineRefusal, di as AWS_CREDENTIAL_ENV_KEYS, dl as loadCdkJson, do as hasNoCloudControlHandlers, ds as shareLogOnlyValues, dt as noEchoAttributeNamesOf, ea as displayLogicalId, ec as CrossPrefixReadError, ei as INTRINSIC_KEYS, el as runDockerStreaming, en as isReplacementOrphan, eo as repairMalformedResourcePropertiesForReadOnly, er as refusesFinalSnapshot, es as recordedNoEchoValuesOf, et as formatResourceLine, f as parentSuppliedValues, fa as malformedOrphanRecordsRefusalMessage, fc as hasUnverifiableParameterRefusal, fi as applyCallerIdentityCredentials, fl as resolveApp, fo as findReplacedReadersOfRecreateTargets, fs as unionOfSecretBags, ft as noEchoComparisonForTemplate, g as mergeNoChangeOutputs, ga as malformedOrphansWarning, gc as orphansAfterRollback, gi as keepHeldTokenProvenance, gl as resolveStateBucketWithDefault, gn as updatePartialReason, go as isStatefulRecreateTargetSync, gs as maskSecretsInText, gt as makeSiblingClaimReader, h as keptWholeReasonText, ha as malformedOrphansRefusalMessage, hc as isReadableBag, hl as resolveSkipPrefix, hn as updatePartialMessage, ho as isStatefulRecreateTargetForReplace, hs as maskSecretsInError, ht as createReadOnlyAttributeHealerFactory, i as childTemplateLoader, ia as isReadableOrphanRecord, ic as isAccessDenied, ii as refuseUnreadableCdkCrossAccountRefs, il as stripForDisplay, in as recordUnderIdIsNotOwn, io as unreadableResourceEntries, ir as findDestructiveChanges, is as createUnionSecretMasker, it as green, j as recordedProtectionEvidence, ja as refuseMalformedOrphansForDestroy, jc as getBootstrapMarkerKey, ji as parameterTypeMayLoseSecretIdentity, jl as canonicalizeRegion, jn as isExportAliasCollision, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphanRecordsForDestroy, kc as assertAssetBucketRegion, ki as coerceParameterTypedValue, kl as expectedOwnerParam, kn as collectDeclaredOutputNames, kr as readsNoEchoDeleteValues, ks as inheritNestedStackParameterAssociations, kt as sameJournaledOrphans, l as templateIdentity, la as malformedLocalOutputsWarning, lc as exportNamesCarriedFrom, li as isIamRoleArn, ll as getDefaultStateBucketName, lr as withCreateTokenLedger, ls as recordLogOnlyParameterValue, lt as reachableDivergentParameters, m as isSecretBearingReferenceString, ma as malformedOrphanRowsKeptWarning, mc as importableOutputs, mi as envCredentialsAreAssumedRole, ml as resolveCaptureObservedState, mo as MULTI_REGION_RECREATE_BLOCKED_TYPES, ms as errorCauseChain, mt as noEchoParameterNamesOf, n as crossStackOutputProvenanceSource, na as hasReadableOutputs, nc as applyCrossPrefixScan, ni as poisonRenderedSpellingsCollidingIn, nl as escapeRegExp, nn as planRollback, no as unpreviewableOrphanRecords, nr as maskingRetryLogger, ns as liveMatchesUnresolvedTokenFrame, nt as cyan, o as isAbsoluteAssetPath, oa as malformedDriftResourcePropertiesWarning, oc as splitImportedOps, oi as assertFlagRoleArn, ol as getDockerImageBySourceHash, on as resolveReplacementOldType, oo as findActionableSilentDrops, os as literalSplitDelimitersOf, ot as yellow, p as readRecordedConditionVerdicts, pa as malformedOrphanRecordsWarning, pc as importableOutputKeys, pi as callerEnvCredentials, pl as resolveAutoAssetStorage, po as shownType, ps as createSecretMasker, pt as noEchoExactEchoLeavesOf, qa as refuseMalformedResourcesForDestroy, qc as isDockerClientEnvKey, qi as JSON_LISTING_HOLE_VALUE, ql as injectedAwsRegionValue, qn as ATOMIC_FINAL_SNAPSHOT_TYPES, qo as maskedLeafCoordinatesOf, qs as TEMPLATE_SOURCED_RULES, r as inheritedProvenanceForChildDiff, ra as hasReadableResources, rc as crossPrefixDeniedWarning, ri as producerLookupOver, rl as stripControlChars, rn as recheckFailedPlan, ro as unreadableOrphanRecords, rr as constructPathOf, rs as carryLogOnlyValues, rt as gray, s as listNestedTemplateRows, sa as malformedExportNamesWarning, sc as acceptedCreateOnlyDropsOf, si as assertSendableRoleArn, sl as Synthesizer, sn as seedsDeleteFirstGuard, sr as ledgerForStack, ss as logOnlyValueCount, st as computeParameterTaint, t as DeployEngine, ta as hasReadableOrphans, tc as CrossPrefixScanCache, ti as IntrinsicFunctionResolver, tl as warnFinchArgvExposure, tn as planFailedOps, to as repairMalformedResourcesForReadOnly, tr as unsupportedFinalSnapshotError, ts as valueAtCoordinate, tt as bold, u as conditionFingerprint, ua as malformedLocalResourceEntriesWarning, uc as hasReadableExportSet, ui as sendableAssumeRoleCommand, ul as getLegacyStateBucketName, un as inheritProducerRegions, uo as NO_CC_HANDLERS_REASON, us as recordLogOnlyValue, ut as resourcesNamingDeclaredParameter, va as malformedOutputsWarning, vc as shouldRetainResource, vi as recordedOutputReferenceRegions, vl as resolveUseCdkBootstrapAssets, vn as WITHHELD_NAME_DISPLAY, vt as DeploymentEventsReader, w as keptForReadoption, wa as malformedStateRefusalMessage, wc as createAssetRedirectResolver, wl as MIGRATE_TMP_PREFIX, wn as carriedExportAliasExposure, wr as ccBrokenReason, ws as DYNAMIC_REFERENCE_TOKEN_SCAN, wt as dropFailedHint, xa as malformedResourcePropertiesWarning, xc as stringifyValue, xl as ssmResolvedValueType, xn as secretBearing, xs as scrubResourceRecord, xt as resolvePendingCloudControlRequests, ya as malformedRenderedContainersWarning, yc as AssetPublisher, yi as recordedReferenceRegions, yl as stateBucketExistenceConfirmed, yn as displayTextOrWithheld, yt as DeploymentEventsStore, za as refuseMalformedResourceEntriesForImport, zc as resolveDockerContextDirectory, zi as cfnRefValueFromPhysicalId, zl as nullPrototypeRecord, zn as orphanRecordsPrintingBag, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValuesIn, zt as withNestedRevertRun } from "./deploy-engine-BIPU9Xdh.js";
+import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-59TTNMFB.js");
+	providerClasses ??= import("./provider-classes-BSUoljqw.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4949,7 +4949,8 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
 	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedSecretTokens, inheritedDerivedNames, attributeHealer: unboundAttributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
 	let healResources = currentState.resources ?? {};
-	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources);
+	let healNamingSecrets;
+	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources, (map) => healNamingSecrets?.(map));
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
 	const secretStandInTokens = standInTokensOf(inheritedSecretTokens);
@@ -5079,9 +5080,36 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
 		recordLogOnlyParameterValue(splitPieces, mergedParameters[name], splitDelimiters);
 	}
-	const noEchoJudge = new Map(diffSecrets);
-	carryLogOnlyValues(diffSecrets, noEchoJudge);
-	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge, /* @__PURE__ */ new Map(), currentState.outputs);
+	const noEchoJudgeValues = new Map(diffSecrets);
+	carryLogOnlyValues(diffSecrets, noEchoJudgeValues);
+	const namingNoEchoParameters = noEchoParametersOf(effectiveTemplate);
+	const namingConditions = conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name)));
+	const namingTemplateResources = effectiveTemplate.Resources ?? {};
+	const recordedNamingValues = (resources, logicalId) => {
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		const templateResource = Object.hasOwn(namingTemplateResources, logicalId) ? namingTemplateResources[logicalId] : void 0;
+		const bag = recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, namingNoEchoParameters, namingConditions);
+		return hasMaskableValues(bag) ? bag : void 0;
+	};
+	const noEchoJudge = (resources) => namingSecretsWithRecordedNoEcho(noEchoJudgeValues, (logicalId) => recordedNamingValues(resources, logicalId));
+	const liveNamingJudge = (resources) => {
+		const memo = /* @__PURE__ */ new Map();
+		return (logicalId) => {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			let hit = memo.get(logicalId);
+			if (hit === void 0 || hit.record !== record) {
+				hit = {
+					record,
+					bag: recordedNamingValues(resources, logicalId)
+				};
+				memo.set(logicalId, hit);
+			}
+			const stored = hit.bag;
+			return stored === void 0 ? diffSecrets : unionOfSecretBags([diffSecrets, stored]);
+		};
+	};
+	healNamingSecrets = noEchoJudge;
+	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge(currentState.resources ?? {}), /* @__PURE__ */ new Map(), currentState.outputs);
 	const outputsPassSecrets = /* @__PURE__ */ new Map();
 	const printing = createDiffPrintingMasker([
 		diffSecrets,
@@ -5098,7 +5126,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordedSecretValues: bag,
 		...printingSecrets && { printingSecrets },
 		...crossStackReads && { crossStackReads },
-		secretNameNeedles: stateSecretNameNeedles(currentState.resources, diffSecrets),
+		secretNameNeedles: stateSecretNameNeedles(currentState.resources, liveNamingJudge(currentState.resources)),
 		secretNameSink: derivedNames,
 		...inheritedForResolver && { inheritedSecrets: inheritedForResolver },
 		...secretStandInTokens && { secretStandInTokens },
@@ -5151,7 +5179,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
-			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge, stateNames, currentState.outputs);
+			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources), stateNames, currentState.outputs);
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
@@ -5178,7 +5206,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				return {
 					value: await intrinsicResolver.resolve(structuredClone(node), {
 						recordedSecretValues: secrets,
-						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, diffSecrets),
+						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, liveNamingJudge(resourcesForInputs)),
 						secretNameSink: derivedNames,
 						template: effectiveTemplate,
 						resources: resourcesForInputs,
@@ -5312,7 +5340,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate,
 		printingSecrets,
 		derivedNames: diffPrintingSecrets([derivedNames, inheritedDerivedNames]),
-		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge),
+		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources)),
+		namingSecretsFor: noEchoJudge,
 		resolvedParameters: mergedParameters,
 		conditions,
 		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
@@ -5540,17 +5569,20 @@ function recordedTemplateResources(template, state) {
 	for (const [logicalId, resource] of Object.entries(resources)) if (Object.prototype.hasOwnProperty.call(stateResources, logicalId)) recorded[logicalId] = resource;
 	return recorded;
 }
-function healerUnderRecordPrintingBag(healer, resources) {
+function healerUnderRecordPrintingBag(healer, resources, namingSecrets) {
 	let judged;
 	const bagFor = (logicalId, resource) => {
 		const map = resources();
-		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
-			...map,
-			[logicalId]: resource
-		});
+		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) {
+			const withSelf = {
+				...map,
+				[logicalId]: resource
+			};
+			return secretNamePrintingBags(withSelf, namingSecrets?.(withSelf))(logicalId);
+		}
 		if (judged?.map !== map) judged = {
 			map,
-			bagOf: secretNamePrintingBags(map, void 0)
+			bagOf: secretNamePrintingBags(map, namingSecrets?.(map))
 		};
 		return judged.bagOf(logicalId);
 	};
@@ -5588,7 +5620,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, namingSecretsFor, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -5640,7 +5672,7 @@ async function buildDiffTree(args) {
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
 		const childSecretTokens = /* @__PURE__ */ new Map();
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}, namingSecretsFor), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
 			inherited: inheritedSecretTokens,
 			child: childSecretTokens
 		});
@@ -12178,7 +12210,16 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		const graph = dagBuilder.buildGraph(template);
 		const executionLevels = dagBuilder.getExecutionLevels(graph);
 		logger.debug(`Dependency graph: ${executionLevels.length} level(s)`);
-		const printingBagOf = secretNamePrintingBags(state.resources, noEchoValues);
+		const reresolver = ctx.noEchoReresolver;
+		const judgedBagOf = secretNamePrintingBags(state.resources, reresolver === void 0 ? noEchoValues : namingSecretsWithRecordedNoEcho(noEchoValues, (logicalId) => {
+			try {
+				return reresolver.recordedNoEchoValuesFor(logicalId, Object.hasOwn(state.resources, logicalId) ? state.resources[logicalId] : void 0);
+			} catch (error) {
+				logger.debug(safeMsg`Could not read ${logicalId}'s stored NoEcho values for its printing bag (${error instanceof Error ? error.name : typeof error}).`);
+				return;
+			}
+		}));
+		const printingBagOf = (logicalId) => withStackName(stackName, () => judgedBagOf(logicalId));
 		for (let levelIndex = executionLevels.length - 1; levelIndex >= 0; levelIndex--) {
 			if (lock.interrupted) {
 				logger.debug("Interrupted (draining) — not scheduling further deletion levels");
@@ -22163,8 +22204,13 @@ function hasSdkMetadata(error) {
 //#region src/local/local-role-arn.ts
 async function applyRoleArnForLocal(opts) {
 	await applyRoleArnIfSet(opts);
-	if (getAssumedRoleCredentials() === void 0) return;
-	recordAssumedRole(getPreAssumeEnvCredentials());
+	const role = getAssumedRoleCredentials();
+	if (role === void 0) return;
+	recordAssumedRole(getPreAssumeEnvCredentials(), {
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		sessionToken: role.sessionToken
+	});
 }
 
 //#endregion
@@ -26066,12 +26112,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -26079,6 +26120,11 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -27205,17 +27251,15 @@ async function localRunTaskCommand(target, options) {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 	}
 }
+function readFromCfnStack(source) {
+	return source.fromState !== true && source.fromCfnStack !== void 0 && source.fromCfnStack !== false;
+}
 async function resolvePlaceholderAccount(arn, source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27223,6 +27267,11 @@ async function resolvePlaceholderAccount(arn, source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new CdkdError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`, "LOCAL_RUN_TASK_PLACEHOLDER_NO_ACCOUNT");
@@ -27282,7 +27331,8 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 			accountId = await resolveStackAccountId$1({
 				region,
 				profile: options.profile,
-				fromState: options.fromState
+				fromState: options.fromState,
+				fromCfnStack: options.fromCfnStack
 			});
 		} catch (err) {
 			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
@@ -27336,15 +27386,10 @@ function pickCandidateStack(parsed, target, stacks) {
 	if (matched.length === 1) return matched[0];
 }
 async function resolveStackAccountId$1(source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27352,6 +27397,11 @@ async function resolveStackAccountId$1(source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -28382,7 +28432,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 	let accountId;
 	try {
-		accountId = await resolveStackAccountId(region, options.profile, options.fromState);
+		accountId = await resolveStackAccountId(region, options.profile, options.fromState, options.fromCfnStack);
 	} catch (err) {
 		logger.warn(safeMsg`${stateProvider.label}: STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. ` + "A same-stack ECR image URI referencing ${AWS::AccountId} may not resolve.");
 	}
@@ -28403,15 +28453,10 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		loaded: loaded ?? void 0
 	};
 }
-async function resolveStackAccountId(region, profile, fromState) {
+async function resolveStackAccountId(region, profile, fromState, fromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (!fromState && fromCfnStack !== void 0 && fromCfnStack !== false) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -28419,6 +28464,11 @@ async function resolveStackAccountId(region, profile, fromState) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -29141,12 +29191,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -29154,6 +29199,11 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -29451,4 +29501,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CYtSW-WU.js.map
+//# sourceMappingURL=program-DYfZCsxM.js.map