@go-to-k/cdkd 0.301.3 → 0.301.5

package/dist/{program-CYtSW-WU.js → program-DmPDfDhE.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as repairMalformedResourcesForReadOnly, $c as escapeRegExp, $i as hasReadableOrphans, $n as unsupportedFinalSnapshotError, $o as liveMatchesUnresolvedTokenFrame, $r as IntrinsicFunctionResolver, $s as applyCrossPrefixScan, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphansForOrphan, Ac as parseBootstrapMarker, Ai as getAccountInfo, Al as AssemblyReader, An as collectPublishedOutputNames, Ar as withPrintingSecrets, At as NESTED_PENDING_PARENT_REASON, B as readProtection, Ba as refuseMalformedResourcePropertiesForDestroy, Bc as dockerSpawnEnvWithSensitive, Bl as displayAssemblyPath, Bn as secretNamePrintingBags, Bo as canonicalCoordinates, Br as deleteLeftInPlace, Bs as wholeStringLeavesOf, Bt as collectNestedChildUnaddressed, Ca as previewableOrphanRecords, Cc as rewriteTemplateAssetReferences, Ci as classifyRecordedSecretRegion, Cl as uploadCfnTemplate, Cn as secretSafeKeyDisplay, Cr as isCustomResource, Cs as isUncertifiedBaselineMaskPosition, Ct as dropFailedCommands, D as findServiceTokenRefusals, Da as refuseMalformedOrphanRecordsForDestroy, Dc as ensureAssetStorage, Di as coerceParameterTypedValue, Dl as PARTITION_TABLE, Dn as isWholeDynamicReferenceValue, Dr as readsNoEchoDeleteValues, Ds as recordNestedStackParameterExpressions, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphanRecords, Ec as assertAssetBucketRegion, Ei as regionLessSecretName, El as expectedOwnerParam, En as exportNameSecretExposure, Er as TemplateNoEchoReresolver, Es as inheritNestedStackParameterAssociations, Et as journaledOrphanLines, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForDeploy, Fc as buildDockerImage, Fi as keepsSecretReferenceToken, Fl as hasPlainPrototype, Fn as completedReplayEntries, Fr as slowCcOperationTimeoutMs, Fs as recordMaskOnlyValue, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcesForDestroy, Gc as isMalformedEnvKey, Gi as JSON_LISTING_HOLE_VALUE, Gn as ATOMIC_FINAL_SNAPSHOT_TYPES, Go as maskedLeafCoordinatesOf, Gs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ha as refuseMalformedResourcePropertiesForExport, Hc as formatDockerLoginError, Hi as parameterInputsFor, Hl as resolveAssemblyPath, Hn as stateSecretNameNeedles, Ho as maskAtCoordinates, Hs as STATE_SOURCED_CROSS_GENERATION_RULES, Ht as withNestedStackContext, I as recordedProtectionNote, Ia as refuseMalformedResourceEntriesForDestroy, Ic as resolveDockerContextDirectory, Ii as AWS_NO_VALUE, Il as nullPrototypeRecord, In as journaledOrphanPrintingBag, Is as recordMaskOnlyValuesIn, It as recordDisplacedSkips, Ja as repairMalformedOrphanRecordsForReadOnly, Jc as redactedCause, Ji as UNREADABLE_ORPHANS_CONTAINER_ROW, Jn as ccRoutedFinalSnapshotError, Jo as noEchoOutputsComparison, Js as isLockInfoExpired, Jt as withStackRecords, Ka as refuseMalformedResourcesForExport, Kc as partitionSensitiveEnv, Ki as STATE_REGION_DIVERGED, Kl as resolveBucketRegion, Kn as PRE_DELETE_SNAPSHOT_TYPES, Ko as noEchoCoordinatesOf, Ks as isSingleDynamicReferenceToken, Kt as destroyStackRecordsView, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourceEntriesForImport, Lc as describeDockerCapturedOutput, Li as cfnRefValueFromPhysicalId, Ll as ownValue, Ln as maskEventTextWithBoundBags, Lr as RollbackInlinePolicyWriters, Ls as recordNoEchoAttributeValues, M as noEchoComparisonForTemplate, Ma as refuseMalformedOutputsForDestroy, Mc as validateAssetBucketName, Mi as carriesDynamicReference, Ml as processStackMessages, Mn as bindingSkippedOutputs, Mo as templateResourceTypes, Mr as applyCustomResourceResponseExpiration, Ms as splitGetAttStringForm, Mt as displacedPhysicalIdShown, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceAttributesForOrphan, Nc as validateContainerRepoName, Ni as carriesFetchableDynamicReference, Nl as defineOwnKey, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as describeTypeWithThrottleRetry, Nr as customResourceResponseExpirationWarning, Ns as carriesSecretMask, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphans, Oc as getBootstrapMarkerKey, Oi as isUnboundTemplateParameter, Ol as canonicalizeRegion, On as noEchoParameterValueSeed, Or as isCustomResourceType$1, Ot as makeForeignHolderScan, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntries, Pc as buildDenyExternalAccessPolicy, Pi as isNamelessDynamicReferenceError, Pl as hasOwnKey, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as withRetry, Pr as CloudControlProvider, Ps as provenPublicValue, Qa as repairMalformedResourcePropertiesForReadOnly, Qc as warnFinchArgvExposure, Qi as displayLogicalId, Qn as refusesFinalSnapshot, Qo as valueAtCoordinate, Qr as INTRINSIC_KEYS, Qs as CrossPrefixScanCache, Qt as demoteSupersededOrphans, R as isProtectionValueActive, Ra as refuseMalformedResourceEntriesForImportSave, Rc as describeDockerExecFailure, Ri as isStalePlaceholderArnAttribute, Rl as absoluteAssemblyPathEscape, Rn as orphanRecordsPrintingBag, Ro as DagBuilder, Rr as UNSPECIFIED_SKIP_REASON, Rs as recordNoEchoParameterFreshValue, Rt as revertedNestedRowIds, Sa as malformedStateRefusalMessage, Sc as loadPublishableAssetManifest, Sl as findLargeInlineResources, Sn as secretBearingStateKeyWarning, Sr as ccBrokenReason, Ss as dynamicReferenceTokens, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Tc as BOOTSTRAP_MARKER_PREFIX, Ti as producerRegionsFromState, Tl as decodeListingKey, Tn as exportNameNoEchoParameters, Ts as identityKeyFor, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForOrphan, Uc as getDockerCmd, Ul as injectAwsRegion, Un as storedSecretNameNeedles, Uo as maskReadbackAtCoordinates, Ur as isWaitAbandonedError, Us as STATE_SOURCED_READBACK_RULES, Ut as replayFailedOperations, Va as refuseMalformedResourcePropertiesForDrift, Vc as finchSecretArgvRefusal, Vi as withSharedDrainBudget, Vl as renderAssemblyPathEscape, Vn as secretNamedRecordNeedles, Vo as isMarkedCoordinate, Vr as deleteSkipReason, Vs as STATE_SOURCED_BASELINE_RULES, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcesForDeploy, Wc as isDockerClientEnvKey, Wi as declaresNoEcho, Wl as injectedAwsRegionValue, Wn as extractDeploymentEventError, Wo as maskWholeValue, Ws as TEMPLATE_SOURCED_RULES, Wt as replayRollback, Xa as repairMalformedOutputsForReadOnly, Xc as runDockerForeground, Xi as accountArgs, Xn as effectiveDeletionPolicy, Xo as readbackPathFor, Xs as rebuildClientForBucketRegion, Ya as repairMalformedOrphansForReadOnly, Yc as redactedDockerCause, Yi as UNREADABLE_RESOURCES_MAP_ROW, Yn as createPreDeleteFinalSnapshot, Ys as S3StateBackend, Yt as removeProtectionTypeList, Za as repairMalformedResourceEntriesForReadOnly, Zc as runDockerStreaming, Zi as deployRefusesOrphanRowsReason, Zn as isFinalSnapshotError, Zo as readsNoEchoSource, Zr as DiffCalculator, Zs as CrossPrefixReadError, Zt as recordAfterRollbackUpdate, _ as keptWholeReasonText, _a as malformedRenderedContainersWarning, _c as isSensitiveAttributeName, _i as recordedReferenceRegions, _l as warnDeprecatedNoPrefixCliFlag, _n as orphanNeedsIdentity, _s as redactSecretsForState, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedExportNamesWarning, ac as describeRegionValueKind, ai as assertSendableRoleArn, al as synthesisStatusMessage, an as replacementNeverSwapped, ar as ledgerForStack, as as printingCorpusOf, at as createReadOnlyAttributeHealerFactory, ba as malformedResourcesWarning, bc as buildAssetRedirectMap, bl as CFN_TEMPLATE_URL_LIMIT, bn as exportAliasCollisionScrubWarning, br as CC_BROKEN_REASON, bt as pendingRequestCount, c as isAbsoluteAssetPath, ca as malformedLocalResourceEntriesWarning, cc as hasReasonlessBaselineRefusal, ci as sendableAssumeRoleCommand, cl as loadCdkJson, cn as findNestedStackTypeChanges, co as NO_CC_HANDLERS_REASON, cs as shareLogOnlyValues, ct as gray, d as templateIdentity, da as malformedOrphanRecordsWarning, dc as importableOutputs, di as callerEnvCredentials, dl as resolveCaptureObservedState, do as shownType, ds as errorCauseChain, dt as yellow, ea as hasReadableOutputs, ec as crossPrefixDeniedWarning, ei as poisonRenderedSpellingsCollidingIn, el as stripControlChars, en as isReplacementOrphan, eo as unpreviewableOrphanRecords, er as maskingRetryLogger, es as carryLogOnlyValues, f as conditionFingerprint, fa as malformedOrphanRowsKeptWarning, fc as isReadableBag, fi as envCredentialsAreAssumedRole, fl as resolveSkipPrefix, fo as MULTI_REGION_RECREATE_BLOCKED_TYPES, fs as maskSecretsInError, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedOutputsWarning, gc as AssetPublisher, gi as recordedOutputReferenceRegions, gl as stateBucketExistenceConfirmed, gn as updatePartialReason, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedOutputsRefusalMessage, hc as shouldRetainResource, hl as resolveUseCdkBootstrapAssets, hn as updatePartialMessage, ho as renderStatefulReason, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedDriftResourcePropertiesWarning, ic as acceptedCreateOnlyDropsOf, ii as assertFlagRoleArn, il as Synthesizer, in as recordUnderIdIsNotOwn, io as findActionableSilentDrops, is as logOnlyValueCount, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedOutputs, jc as readBootstrapMarkerBody, ji as isImpossibleEmptyStoredAttribute, jl as StageLoadError, jn as isExportAliasCollision, jo as prefetchCreateOnlyPropertyPaths, jr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, js as recordPhysicalNameCopy, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphansForDestroy, kc as isCrossRegionRedirect, ki as parameterTypeMayLoseSecretIdentity, kl as derivePartitionAndUrlSuffix, kn as collectDeclaredOutputNames, ks as physicalNameCopiesOf, kt as sameJournaledOrphans, l as listNestedTemplateRows, la as malformedLocalResourcesWarning, lc as hasUnverifiableParameterRefusal, li as AWS_CREDENTIAL_ENV_KEYS, ll as resolveApp, lo as hasNoCloudControlHandlers, ls as unionOfSecretBags, lt as green, m as parentSuppliedValues, ma as malformedOrphansWarning, mc as orphansCarriedFrom, mi as keepHeldTokenProvenance, ml as resolveStateBucketWithDefaultAndSource, mo as isStatefulRecreateTargetSync, ms as markSameGenerationBag, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as isReadableOrphanRecord, nc as isNotImplemented, ni as refuseUnreadableCdkCrossAccountRefs, nl as AssetManifestLoader, nn as planRollback, no as unreadableResourceEntries, nr as findDestructiveChanges, ns as hasMaskableValues, o as childTemplateLoader, oa as malformedExportSourceWarning, oc as exportNamesCarriedFrom, oi as explicitRoleArnOrThrow, ol as getDefaultStateBucketName, on as resolveReplacementOldType, oo as unwrittenCreateOnlyReplacement, os as recordLogOnlyParameterValue, ot as bold, p as conditionInputsFrom, pa as malformedOrphansRefusalMessage, pc as orphansAfterRollback, pl as resolveStateBucketWithDefault, po as isStatefulRecreateTargetForReplace, ps as maskSecretsInText, pt as namesAnyDeclaredParameter, qa as refuseMalformedState, qc as redactDockerArgvValues, qi as STATE_RESOURCES_MALFORMED, qn as buildFinalSnapshotIdentifier, qo as noEchoLeavesOf, qs as LockManager, r as computeImplicitDeleteEdges, ra as isReadableResourceEntry, rc as splitImportedOps, ri as applyRoleArnIfSet, rl as getDockerImageBySourceHash, rn as recheckFailedPlan, ro as withheldAccountClause, rr as formatDestructiveChange, rs as literalSplitDelimitersOf, s as findNestedTemplateTreeDefect, sa as malformedLocalOutputsWarning, sc as hasReadableExportSet, si as isIamRoleArn, sl as getLegacyStateBucketName, sn as seedsDeleteFirstGuard, sr as withCreateTokenLedger, ss as recordLogOnlyValue, st as cyan, t as DeployEngine, ta as hasReadableResources, tc as isAccessDenied, ti as producerLookupOver, tl as stripForDisplay, tn as planFailedOps, to as unreadableOrphanRecords, tr as constructPathOf, ts as createUnionSecretMasker, u as renderNestedTemplateTreeDefect, ua as malformedOrphanRecordsRefusalMessage, uc as importableOutputKeys, ui as applyCallerIdentityCredentials, ul as resolveAutoAssetStorage, un as inheritProducerRegions, uo as findReplacedReadersOfRecreateTargets, us as createSecretMasker, ut as red, v as mergeNoChangeOutputs, va as malformedResourceEntriesWarning, vc as stringifyValue, vl as ssmResolvedValueType, vn as WITHHELD_NAME_DISPLAY, vs as scrubResourceRecord, vt as DeploymentEventsReader, w as keptForReadoption, wa as refuseDivergentRecordRegionForDestroy, wc as AssetModeResolver, wi as classifyReplaySecretRegion, wl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, wn as carriedExportAliasExposure, wr as wouldReturnToSdkProvider, ws as pathCrossesDottedKey, wt as dropFailedHint, xa as malformedScrubResourceEntriesRefusalMessage, xc as createAssetRedirectResolver, xl as MIGRATE_TMP_PREFIX, xn as secretBearing, xr as ProviderRegistry, xs as DYNAMIC_REFERENCE_TOKEN_SCAN, xt as resolvePendingCloudControlRequests, y as makeCanonicalizePropertiesFn, ya as malformedResourcePropertiesWarning, yc as WorkGraph, yl as CFN_TEMPLATE_BODY_LIMIT, yn as displayTextOrWithheld, ys as withPhysicalNameCopies, yt as DeploymentEventsStore, z as perType, za as refuseMalformedResourceEntriesForOrphan, zc as describeDockerFailure, zi as refStateLookupFromResource, zl as describeFileReadFailure, zn as secretNamePrintingBag, zo as TemplateParser, zr as deleteIndeterminateGuards, zs as recordProvenPublicExpression, zt as withNestedRevertRun } from "./deploy-engine-CZaafy9R.js";
-import { t as getCdkdVersion } from "./version-Cx2pAgJv.js";
+import { $ as resolvePendingCloudControlRequests, $a as repairMalformedOutputsForReadOnly, $c as redactedDockerCause, $i as accountArgs, $n as buildFinalSnapshotIdentifier, $o as readbackPathFor, $r as DiffCalculator, $s as S3StateBackend, $t as namesAnyDeclaredParameter, A as findServiceTokenRefusals, Aa as refuseMalformedOrphanRecordsForDestroy, Ac as assertAssetBucketRegion, Ai as coerceParameterTypedValue, Al as expectedOwnerParam, An as gray, Ar as isCustomResourceType$1, As as inheritNestedStackParameterAssociations, At as removeProtectionTypeList, B as parentSuppliedValues, Ba as refuseMalformedResourceEntriesForImport, Bc as resolveDockerContextDirectory, Bi as cfnRefValueFromPhysicalId, Bl as nullPrototypeRecord, Bn as journaledOrphanPrintingBag, Br as UNSPECIFIED_SKIP_REASON, Bs as recordMaskOnlyValuesIn, Bt as resolveReplacementOldType, Ca as malformedResourcesWarning, Cc as WorkGraph, Ci as applyCallerIdentityCredentials, Cl as CFN_TEMPLATE_BODY_LIMIT, Cr as ProviderRegistry, Cs as withPhysicalNameCopies, Ct as formatResourceLine, D as crossStackOutputProvenanceSource, Da as refuseDivergentRecordRegionForDestroy, Dc as rewriteTemplateAssetReferences, Di as classifyReplaySecretRegion, Dl as uploadCfnTemplate, Ds as isUncertifiedBaselineMaskPosition, E as computeImplicitDeleteEdges, Ea as previewableOrphanRecords, Ec as loadPublishableAssetManifest, Ei as classifyRecordedSecretRegion, El as findLargeInlineResources, En as withStackRecords, Er as wouldReturnToSdkProvider, Es as dynamicReferenceTokens, F as listNestedTemplateRows, Fa as refuseMalformedOutputsForDestroy, Fc as readBootstrapMarkerBody, Fi as carriesDynamicReference, Fl as StageLoadError, Fn as noEchoComparisonForTemplate, Fo as templateResourceTypes, Fr as customResourceResponseExpirationWarning, Fs as recordPhysicalNameCopy, Ft as planFailedOps, G as keptWholeReasonText, Ga as refuseMalformedResourcePropertiesForExport, Gc as finchSecretArgvRefusal, Gi as parameterInputsFor, Gl as renderAssemblyPathEscape, Gn as secretNamePrintingBags, Go as maskAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_BASELINE_RULES, Gt as inheritProducerRegions, H as withResourceDeadline, Ha as refuseMalformedResourceEntriesForOrphan, Hc as describeDockerExecFailure, Hi as refStateLookupFromResource, Hl as absoluteAssemblyPathEscape, Hn as namingSecretsWithRecordedNoEcho, Ho as TemplateParser, Hr as deleteLeftInPlace, Hs as recordNoEchoParameterFreshValue, Ht as orphanNeedsIdentity, I as renderNestedTemplateTreeDefect, Ia as refuseMalformedResourceAttributesForOrphan, Ic as validateAssetBucketName, Ii as carriesFetchableDynamicReference, Il as processStackMessages, In as noEchoExactEchoLeavesOf, Io as describeTypeWithThrottleRetry, Ir as CloudControlProvider, Is as splitGetAttStringForm, It as planRollback, J as makeSiblingClaimReader, Ja as refuseMalformedResourcesForDestroy, Jc as isDockerClientEnvKey, Ji as JSON_LISTING_HOLE_VALUE, Jl as injectedAwsRegionValue, Jn as stateSecretNameNeedles, Jo as maskedLeafCoordinatesOf, Js as TEMPLATE_SOURCED_RULES, K as mergeNoChangeOutputs, Ka as refuseMalformedResourcePropertiesForOrphan, Kc as formatDockerLoginError, Kl as resolveAssemblyPath, Ko as maskReadbackAtCoordinates, Ks as STATE_SOURCED_CROSS_GENERATION_RULES, L as templateIdentity, La as refuseMalformedResourceEntries, Lc as validateContainerRepoName, Li as isNamelessDynamicReferenceError, Ll as defineOwnKey, Ln as noEchoParameterNamesOf, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Lt as recheckFailedPlan, M as childTemplateLoader, Ma as refuseMalformedOrphansForDestroy, Mc as getBootstrapMarkerKey, Mi as parameterTypeMayLoseSecretIdentity, Ml as canonicalizeRegion, Mn as red, Mr as withPrintingSecrets, Mt as demoteSupersededOrphans, N as findNestedTemplateTreeDefect, Na as refuseMalformedOrphansForOrphan, Nc as isCrossRegionRedirect, Ni as getAccountInfo, Nl as derivePartitionAndUrlSuffix, Nn as yellow, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ns as physicalNameCopiesOf, Nt as isJournaledOrphan, O as inheritedProvenanceForChildDiff, Oc as AssetModeResolver, Oi as producerRegionsFromState, Ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, On as bold, Or as TemplateNoEchoReresolver, Os as pathCrossesDottedKey, Ot as replayFailedOperations, P as isAbsoluteAssetPath, Pa as refuseMalformedOutputs, Pc as parseBootstrapMarker, Pi as isImpossibleEmptyStoredAttribute, Pl as AssemblyReader, Pn as noEchoAttributeNamesOf, Po as prefetchCreateOnlyPropertyPaths, Pr as applyCustomResourceResponseExpiration, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as repairMalformedOrphansForReadOnly, Qc as redactedCause, Qi as UNREADABLE_RESOURCES_MAP_ROW, Qn as PRE_DELETE_SNAPSHOT_TYPES, Qs as isLockInfoExpired, Qt as computeParameterTaint, R as conditionFingerprint, Ra as refuseMalformedResourceEntriesForDeploy, Rc as buildDenyExternalAccessPolicy, Ri as keepsSecretReferenceToken, Rl as hasOwnKey, Rn as createReadOnlyAttributeHealerFactory, Rs as provenPublicValue, Rt as recordUnderIdIsNotOwn, Sa as malformedResourcePropertiesWarning, Sc as stringifyValue, Si as AWS_CREDENTIAL_ENV_KEYS, Sl as ssmResolvedValueType, Sn as formatDestructiveChange, Sr as CC_BROKEN_REASON, Ss as scrubResourceRecord, St as sameJournaledOrphans, T as IMPLICIT_DELETE_DEPENDENCIES, Ta as malformedStateRefusalMessage, Tc as createAssetRedirectResolver, Ti as envCredentialsAreAssumedRole, Tl as MIGRATE_TMP_PREFIX, Tr as isCustomResource, Ts as DYNAMIC_REFERENCE_TOKEN_SCAN, U as diffSecurity, Ua as refuseMalformedResourcePropertiesForDestroy, Uc as describeDockerFailure, Ul as describeFileReadFailure, Un as orphanRecordsPrintingBag, Uo as canonicalCoordinates, Ur as deleteSkipReason, Us as recordProvenPublicExpression, Ut as findNestedStackTypeChanges, V as readRecordedConditionVerdicts, Va as refuseMalformedResourceEntriesForImportSave, Vc as describeDockerCapturedOutput, Vi as isStalePlaceholderArnAttribute, Vl as ownValue, Vn as maskEventTextWithBoundBags, Vo as DagBuilder, Vr as deleteIndeterminateGuards, Vs as recordNoEchoAttributeValues, Vt as seedsDeleteFirstGuard, W as isSecretBearingReferenceString, Wa as refuseMalformedResourcePropertiesForDrift, Wc as dockerSpawnEnvWithSensitive, Wi as withSharedDrainBudget, Wl as displayAssemblyPath, Wn as secretNamePrintingBag, Wo as isMarkedCoordinate, Ws as wholeStringLeavesOf, X as DeploymentEventsReader, Xa as refuseMalformedState, Xc as partitionSensitiveEnv, Xi as STATE_RESOURCES_MALFORMED, Xl as resolveBucketRegion, Xn as extractDeploymentEventError, Xo as noEchoLeavesOf, Xs as isSingleDynamicReferenceToken, Xt as updatePartialMessage, Y as planOrphanAdoption, Ya as refuseMalformedResourcesForExport, Yc as isMalformedEnvKey, Yi as STATE_REGION_DIVERGED, Yn as storedSecretNameNeedles, Yo as noEchoCoordinatesOf, Ys as WHOLE_DYNAMIC_REFERENCE_PATTERN, Z as DeploymentEventsStore, Za as repairMalformedOrphanRecordsForReadOnly, Zc as redactDockerArgvValues, Zi as UNREADABLE_ORPHANS_CONTAINER_ROW, Zn as ATOMIC_FINAL_SNAPSHOT_TYPES, Zo as noEchoOutputsComparison, Zs as LockManager, Zt as updatePartialReason, _a as malformedOrphansWarning, _c as orphansAfterRollback, _i as assertFlagRoleArn, _l as resolveStateBucketWithDefault, _n as DEFAULT_RESOURCE_TIMEOUT_MS, _o as isStatefulRecreateTargetSync, _s as maskSecretsInText, _t as dropFailedHint, a as isProtectionValueActive, aa as isReadableOrphanRecord, ac as isAccessDenied, al as stripForDisplay, an as secretBearing, ao as unreadableResourceEntries, ar as unsupportedFinalSnapshotError, as as createUnionSecretMasker, at as dropSettledNestedJournals, ba as malformedRenderedContainersWarning, bc as AssetPublisher, bi as isIamRoleArn, bl as stateBucketExistenceConfirmed, bn as constructPathOf, bt as loadJournaledOrphans, ca as malformedExportNamesWarning, cc as acceptedCreateOnlyDropsOf, cl as Synthesizer, cn as carriedExportAliasExposure, cs as logOnlyValueCount, ct as recordDisplacedSkips, da as malformedLocalResourceEntriesWarning, dc as hasReadableExportSet, di as refuseUnreadableCdkCrossAccountRefs, dl as getLegacyStateBucketName, dn as isWholeDynamicReferenceValue, do as NO_CC_HANDLERS_REASON, ds as recordLogOnlyValue, dt as withNestedRevertRun, ea as deployRefusesOrphanRowsReason, ec as rebuildClientForBucketRegion, ei as INTRINSIC_KEYS, el as runDockerForeground, en as reachableDivergentParameters, eo as repairMalformedResourceEntriesForReadOnly, er as ccRoutedFinalSnapshotError, es as readsNoEchoSource, et as keptForReadoption, fa as malformedLocalResourcesWarning, fc as hasReasonlessBaselineRefusal, fi as keepHeldTokenProvenance, fl as loadCdkJson, fn as noEchoParameterValueSeed, fo as hasNoCloudControlHandlers, fs as shareLogOnlyValues, ft as collectNestedChildUnaddressed, ga as malformedOrphansRefusalMessage, gc as isReadableBag, gi as applyRoleArnIfSet, gl as resolveSkipPrefix, gn as bindingSkippedOutputs, go as isStatefulRecreateTargetForReplace, gs as maskSecretsInError, gt as dropFailedCommands, ha as malformedOrphanRowsKeptWarning, hc as importableOutputs, hi as recordedReferenceRegions, hl as resolveCaptureObservedState, hn as isExportAliasCollision, ho as MULTI_REGION_RECREATE_BLOCKED_TYPES, hs as errorCauseChain, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableResources, ic as crossPrefixDeniedWarning, il as stripControlChars, in as exportAliasCollisionScrubWarning, io as unreadableOrphanRecords, ir as refusesFinalSnapshot, is as carryLogOnlyValues, it as displacedPhysicalIdShown, j as serviceTokenBlockingReason, ja as refuseMalformedOrphans, jc as ensureAssetStorage, ji as isUnboundTemplateParameter, jl as PARTITION_TABLE, jn as green, js as recordNestedStackParameterExpressions, jt as recordAfterRollbackUpdate, k as deferredServiceTokenWarning, ka as refuseMalformedOrphanRecords, kc as BOOTSTRAP_MARKER_PREFIX, ki as regionLessSecretName, kl as decodeListingKey, kn as cyan, kr as readsNoEchoDeleteValues, ks as identityKeyFor, kt as replayRollback, la as malformedExportSourceWarning, lc as describeRegionValueKind, li as resolveDynamicReferences, ll as synthesisStatusMessage, ln as exportNameNoEchoParameters, lo as unwrittenCreateOnlyReplacement, lr as withCreateTokenLedger, ls as printingCorpusOf, ma as malformedOrphanRecordsWarning, mc as importableOutputKeys, mi as recordedOutputReferenceRegions, ml as resolveAutoAssetStorage, mn as collectPublishedOutputNames, mo as shownType, ms as createSecretMasker, mt as withNestedStackContext, n as recordedProtectionEvidence, na as hasReadableOrphans, nc as CrossPrefixScanCache, ni as poisonRenderedSpellingsCollidingIn, nl as warnFinchArgvExposure, nn as WITHHELD_NAME_DISPLAY, no as repairMalformedResourcesForReadOnly, nr as effectiveDeletionPolicy, ns as valueAtCoordinate, nt as NESTED_PENDING_PARENT_REASON, o as perType, oa as isReadableResourceEntry, oc as isNotImplemented, ol as AssetManifestLoader, on as secretBearingStateKeyWarning, oo as withheldAccountClause, os as hasMaskableValues, pa as malformedOrphanRecordsRefusalMessage, pc as hasUnverifiableParameterRefusal, pl as resolveApp, pn as collectDeclaredOutputNames, po as findReplacedReadersOfRecreateTargets, ps as unionOfSecretBags, pt as getCurrentNestedStackContext, q as makeCanonicalizePropertiesFn, qa as refuseMalformedResourcesForDeploy, qc as getDockerCmd, qi as declaresNoEcho, ql as injectAwsRegion, qn as secretNamedRecordNeedles, qo as maskWholeValue, qs as STATE_SOURCED_READBACK_RULES, r as recordedProtectionNote, ra as hasReadableOutputs, rc as applyCrossPrefixScan, rl as escapeRegExp, rn as displayTextOrWithheld, ro as unpreviewableOrphanRecords, rr as isFinalSnapshotError, rs as liveMatchesUnresolvedTokenFrame, rt as displacedOpClause, s as readProtection, sa as malformedDriftResourcePropertiesWarning, sc as splitImportedOps, sl as getDockerImageBySourceHash, sn as secretSafeKeyDisplay, so as findActionableSilentDrops, sr as ledgerForStack, ss as literalSplitDelimitersOf, st as nestedChildStackName$1, t as DeployEngine, ta as displayLogicalId, tc as CrossPrefixReadError, ti as IntrinsicFunctionResolver, tl as runDockerStreaming, tn as resourcesNamingDeclaredParameter, to as repairMalformedResourcePropertiesForReadOnly, tr as createPreDeleteFinalSnapshot, ts as recordedNoEchoValuesOf, tt as recordRetainedForReadoption, ua as malformedLocalOutputsWarning, uc as exportNamesCarriedFrom, ui as producerLookupOver, ul as getDefaultStateBucketName, un as exportNameSecretExposure, us as recordLogOnlyParameterValue, ut as revertedNestedRowIds, va as malformedOutputsRefusalMessage, vc as orphansCarriedFrom, vi as assertSendableRoleArn, vl as resolveStateBucketWithDefaultAndSource, vn as DEFAULT_RESOURCE_WARN_AFTER_MS, vo as renderStatefulReason, vs as markSameGenerationBag, vt as isHandledOrphan, wa as malformedScrubResourceEntriesRefusalMessage, wc as buildAssetRedirectMap, wi as callerEnvCredentials, wl as CFN_TEMPLATE_URL_LIMIT, wn as destroyStackRecordsView, wr as ccBrokenReason, xa as malformedResourceEntriesWarning, xc as isSensitiveAttributeName, xi as sendableAssumeRoleCommand, xl as warnDeprecatedNoPrefixCliFlag, xn as findDestructiveChanges, xs as redactSecretsForState, xt as makeForeignHolderScan, ya as malformedOutputsWarning, yc as shouldRetainResource, yi as explicitRoleArnOrThrow, yl as resolveUseCdkBootstrapAssets, yn as maskingRetryLogger, yt as journaledOrphanLines, z as conditionInputsFrom, za as refuseMalformedResourceEntriesForDestroy, zc as buildDockerImage, zi as AWS_NO_VALUE, zl as hasPlainPrototype, zn as completedReplayEntries, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValue, zt as replacementNeverSwapped } from "./deploy-engine-HAvm8vSI.js";
+import { t as getCdkdVersion } from "./version-2jeKJQlt.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-59TTNMFB.js");
+	providerClasses ??= import("./provider-classes-DPwEHVDJ.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4949,7 +4949,8 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
 	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedSecretTokens, inheritedDerivedNames, attributeHealer: unboundAttributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
 	let healResources = currentState.resources ?? {};
-	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources);
+	let healNamingSecrets;
+	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources, (map) => healNamingSecrets?.(map));
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
 	const secretStandInTokens = standInTokensOf(inheritedSecretTokens);
@@ -5079,9 +5080,36 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
 		recordLogOnlyParameterValue(splitPieces, mergedParameters[name], splitDelimiters);
 	}
-	const noEchoJudge = new Map(diffSecrets);
-	carryLogOnlyValues(diffSecrets, noEchoJudge);
-	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge, /* @__PURE__ */ new Map(), currentState.outputs);
+	const noEchoJudgeValues = new Map(diffSecrets);
+	carryLogOnlyValues(diffSecrets, noEchoJudgeValues);
+	const namingNoEchoParameters = noEchoParametersOf(effectiveTemplate);
+	const namingConditions = conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name)));
+	const namingTemplateResources = effectiveTemplate.Resources ?? {};
+	const recordedNamingValues = (resources, logicalId) => {
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		const templateResource = Object.hasOwn(namingTemplateResources, logicalId) ? namingTemplateResources[logicalId] : void 0;
+		const bag = recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, namingNoEchoParameters, namingConditions);
+		return hasMaskableValues(bag) ? bag : void 0;
+	};
+	const noEchoJudge = (resources) => namingSecretsWithRecordedNoEcho(noEchoJudgeValues, (logicalId) => recordedNamingValues(resources, logicalId));
+	const liveNamingJudge = (resources) => {
+		const memo = /* @__PURE__ */ new Map();
+		return (logicalId) => {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			let hit = memo.get(logicalId);
+			if (hit === void 0 || hit.record !== record) {
+				hit = {
+					record,
+					bag: recordedNamingValues(resources, logicalId)
+				};
+				memo.set(logicalId, hit);
+			}
+			const stored = hit.bag;
+			return stored === void 0 ? diffSecrets : unionOfSecretBags([diffSecrets, stored]);
+		};
+	};
+	healNamingSecrets = noEchoJudge;
+	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge(currentState.resources ?? {}), /* @__PURE__ */ new Map(), currentState.outputs);
 	const outputsPassSecrets = /* @__PURE__ */ new Map();
 	const printing = createDiffPrintingMasker([
 		diffSecrets,
@@ -5098,7 +5126,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordedSecretValues: bag,
 		...printingSecrets && { printingSecrets },
 		...crossStackReads && { crossStackReads },
-		secretNameNeedles: stateSecretNameNeedles(currentState.resources, diffSecrets),
+		secretNameNeedles: stateSecretNameNeedles(currentState.resources, liveNamingJudge(currentState.resources)),
 		secretNameSink: derivedNames,
 		...inheritedForResolver && { inheritedSecrets: inheritedForResolver },
 		...secretStandInTokens && { secretStandInTokens },
@@ -5151,7 +5179,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
-			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge, stateNames, currentState.outputs);
+			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources), stateNames, currentState.outputs);
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
@@ -5178,7 +5206,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				return {
 					value: await intrinsicResolver.resolve(structuredClone(node), {
 						recordedSecretValues: secrets,
-						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, diffSecrets),
+						secretNameNeedles: stateSecretNameNeedles(resourcesForInputs, liveNamingJudge(resourcesForInputs)),
 						secretNameSink: derivedNames,
 						template: effectiveTemplate,
 						resources: resourcesForInputs,
@@ -5312,7 +5340,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate,
 		printingSecrets,
 		derivedNames: diffPrintingSecrets([derivedNames, inheritedDerivedNames]),
-		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge),
+		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge(stateForDiff.resources)),
+		namingSecretsFor: noEchoJudge,
 		resolvedParameters: mergedParameters,
 		conditions,
 		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
@@ -5540,17 +5569,20 @@ function recordedTemplateResources(template, state) {
 	for (const [logicalId, resource] of Object.entries(resources)) if (Object.prototype.hasOwnProperty.call(stateResources, logicalId)) recorded[logicalId] = resource;
 	return recorded;
 }
-function healerUnderRecordPrintingBag(healer, resources) {
+function healerUnderRecordPrintingBag(healer, resources, namingSecrets) {
 	let judged;
 	const bagFor = (logicalId, resource) => {
 		const map = resources();
-		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
-			...map,
-			[logicalId]: resource
-		});
+		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) {
+			const withSelf = {
+				...map,
+				[logicalId]: resource
+			};
+			return secretNamePrintingBags(withSelf, namingSecrets?.(withSelf))(logicalId);
+		}
 		if (judged?.map !== map) judged = {
 			map,
-			bagOf: secretNamePrintingBags(map, void 0)
+			bagOf: secretNamePrintingBags(map, namingSecrets?.(map))
 		};
 		return judged.bagOf(logicalId);
 	};
@@ -5588,7 +5620,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, securityDiff, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, namingSecretsFor, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -5640,7 +5672,7 @@ async function buildDiffTree(args) {
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
 		const childSecretTokens = /* @__PURE__ */ new Map();
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}, namingSecretsFor), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
 			inherited: inheritedSecretTokens,
 			child: childSecretTokens
 		});
@@ -7198,7 +7230,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 		if (verdict.kind === "named-region") {
 			const resolver = "recorded" in verdict ? ctx.resolvers.forRecordedRegion(verdict.region) : ctx.resolvers.forRegion(verdict.region);
 			try {
-				out += await resolver.resolveDynamicReferences(token, {
+				out += await resolveDynamicReferences(resolver, token, {
 					template: { Resources: {} },
 					resources: {},
 					recordedSecretValues: ctx.recordedSecretValues
@@ -9831,7 +9863,7 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx, recordedRegions) {
 	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, consumerRegion, producerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolveDynamicReferences(resolvers.primary, leaf, ctx);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
@@ -9839,7 +9871,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
-		out += await resolver.resolveDynamicReferences(token, ctx);
+		out += await resolveDynamicReferences(resolver, token, ctx);
 		cursor = at + token.length;
 	}
 	return out + leaf.slice(cursor);
@@ -11673,7 +11705,7 @@ async function resolveSecretDerivedPrincipals(values, region, producerRegions, r
 }
 async function resolveEntry(entry, primary, verdictOf, context) {
 	const tokens = dynamicReferenceTokens(entry).map((t) => [t, verdictOf(t)]);
-	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await primary.resolveDynamicReferences(entry, context);
+	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await resolveDynamicReferences(primary, entry, context);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of tokens) {
@@ -11681,7 +11713,7 @@ async function resolveEntry(entry, primary, verdictOf, context) {
 		if (at < 0) throw new Error("A scanned dynamic reference is not in the entry it was scanned from");
 		out += entry.slice(cursor, at);
 		const resolver = verdict.kind === "recorded-region" ? primary.resolverForRecordedRegion(verdict.region) : primary;
-		out += await resolver.resolveDynamicReferences(token, context);
+		out += await resolveDynamicReferences(resolver, token, context);
 		cursor = at + token.length;
 	}
 	return out + entry.slice(cursor);
@@ -12178,7 +12210,16 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		const graph = dagBuilder.buildGraph(template);
 		const executionLevels = dagBuilder.getExecutionLevels(graph);
 		logger.debug(`Dependency graph: ${executionLevels.length} level(s)`);
-		const printingBagOf = secretNamePrintingBags(state.resources, noEchoValues);
+		const reresolver = ctx.noEchoReresolver;
+		const judgedBagOf = secretNamePrintingBags(state.resources, reresolver === void 0 ? noEchoValues : namingSecretsWithRecordedNoEcho(noEchoValues, (logicalId) => {
+			try {
+				return reresolver.recordedNoEchoValuesFor(logicalId, Object.hasOwn(state.resources, logicalId) ? state.resources[logicalId] : void 0);
+			} catch (error) {
+				logger.debug(safeMsg`Could not read ${logicalId}'s stored NoEcho values for its printing bag (${error instanceof Error ? error.name : typeof error}).`);
+				return;
+			}
+		}));
+		const printingBagOf = (logicalId) => withStackName(stackName, () => judgedBagOf(logicalId));
 		for (let levelIndex = executionLevels.length - 1; levelIndex >= 0; levelIndex--) {
 			if (lock.interrupted) {
 				logger.debug("Interrupted (draining) — not scheduling further deletion levels");
@@ -13189,7 +13230,7 @@ var PublicSsmProver = class {
 			skipDynamicReferences: true
 		};
 		try {
-			await this.resolver.resolveDynamicReferences(token, context);
+			await resolveDynamicReferences(this.resolver, token, context);
 		} catch (err) {
 			const name = err instanceof Error ? err.name : typeof err;
 			this.logger.debug(safeMsg`Could not prove an ssm dynamic reference public (${name}); a leaf embedding it ` + `keeps its {{resolve:...}} expression in observedProperties.`);
@@ -13368,7 +13409,7 @@ var AttributeFetcher = class {
 		} catch (err) {
 			return {
 				ok: false,
-				reason: `no provider available for ${orphan.resourceType}: ${err instanceof Error ? err.message : String(err)}`
+				reason: `no provider available for ${orphan.resourceType}: ${describeAwsFailure(err).detail}`
 			};
 		}
 		if (!provider.getAttribute) return this.cacheFallback(orphanLogicalId, attribute, `provider for ${orphan.resourceType} does not implement getAttribute`);
@@ -14736,7 +14777,7 @@ const securityGroupRuleLookupRetryDelays = {};
 const MAX_SG_RULE_THROTTLE_RETRIES = 4;
 function isAuthorizationShapedError(err) {
 	const errName = err instanceof Error ? err.name : "";
-	const message = err instanceof Error ? err.message : String(err);
+	const message = describeAwsFailure(err).detail;
 	return /AccessDenied|UnauthorizedOperation|AuthFailure|not authorized to perform/i.test(`${errName} ${message}`);
 }
 async function describeAllSecurityGroupRules(groupId, ec2Client) {
@@ -14764,7 +14805,7 @@ async function describeAllSecurityGroupRules(groupId, ec2Client) {
 				...securityGroupRuleLookupRetryDelays.sleep ? { sleep: securityGroupRuleLookupRetryDelays.sleep } : {}
 			});
 		} catch (err) {
-			const detail = err instanceof Error ? err.message : String(err);
+			const detail = describeAwsFailure(err).detail;
 			return {
 				ok: false,
 				kind: isAuthorizationShapedError(err) ? "auth" : isThrottlingError(err) ? "throttled" : "failed",
@@ -15157,7 +15198,7 @@ async function exportCommand(stackArg, options) {
 					await handler(entry);
 					logger.info(`  ${preDeletedLine(entry.physicalId)}`);
 				} catch (err) {
-					const msg = err instanceof Error ? err.message : String(err);
+					const msg = describeAwsFailure(err).detail;
 					const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying AWS API — iam:Delete{Role,User,Group}Policy for an inline policy).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n` + preDeleteManualCommands(recreateBeforePhase2).map((line) => `       ${line}\n`).join("") + `     (one per entry in the pre-delete list logged above).
   3. Run the phase-2 UPDATE manually with the full synth template:
@@ -15176,7 +15217,7 @@ async function exportCommand(stackArg, options) {
 				if (recreateBeforePhase2.length > 0) parts.push(`${recreateBeforePhase2.length} IMPORT-unsupported resource(s) re-CREATEd`);
 				logger.info(`✓ Phase 2: ${parts.join("; ")}.`);
 			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
+				const msg = describeAwsFailure(err).detail;
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
 				const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
@@ -15192,7 +15233,7 @@ async function exportCommand(stackArg, options) {
 			});
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(resolvedStackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
 			});
 		}
 	} finally {
@@ -15263,7 +15304,7 @@ async function assertCfnStackAbsent(cfnClient, stackName) {
 		if (!stack) return;
 		throw new Error(`CloudFormation stack ${quotedOrNotShown(stackName)} already exists (status: ${stack.StackStatus ?? "unknown"}). cdkd export only creates new stacks via IMPORT — delete or rename the existing stack first, or pass --cfn-stack-name to choose a different name.`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		if (/does not exist/i.test(msg)) return;
 		throw err;
 	}
@@ -15815,7 +15856,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "could not resolve resource identifier: " + (err instanceof Error ? err.message : String(err)),
+				reason: "could not resolve resource identifier: " + describeAwsFailure(err).detail,
 				...err instanceof RepairableRefusal ? { repair: err.repair } : {}
 			});
 			continue;
@@ -16004,7 +16045,7 @@ async function resolveResourceIdentifier(resourceType, logicalId, physicalId, pr
 	try {
 		result = splitter(physicalId, properties);
 	} catch (err) {
-		throw new Error(`composite-id splitter for ${resourceType} failed: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`composite-id splitter for ${resourceType} failed: ` + describeAwsFailure(err).detail);
 	}
 	for (const f of entry.fields) if (!(f in result.resourceIdentifier)) throw new Error(`composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(result.resourceIdentifier).join(", ")})`);
 	return result;
@@ -16043,7 +16084,7 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 			}
 		}
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		getLogger().debug(`DescribeType failed for ${quotedOrNotShown(resourceType)}: ${safeDetail(msg)} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
@@ -16455,7 +16496,7 @@ async function runTemplateUploadCleanup(cleanup, bucket) {
 	try {
 		await cleanup();
 	} catch (cleanupErr) {
-		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		const msg = describeAwsFailure(cleanupErr).detail;
 		logger.warn(`Failed to delete temporary template upload from ${quotedOrNotShown(bucket)}. Clean up manually under prefix 'cdkd-migrate-tmp/'. Cause: ${safeDetail(msg)}`);
 	}
 }
@@ -16488,7 +16529,7 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create IMPORT changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -16829,7 +16870,7 @@ async function runPerStackImportLoop(args) {
 	try {
 		resolved = await resolveAll();
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
+		const message = describeAwsFailure(err).detail;
 		const plannable = message.startsWith("buildResolvedParametersPerStack:") || err instanceof SsmChildParameterRefusalError;
 		if (!options.dryRun || !plannable) throw err;
 		logger.warn(safeMsg`${message} --dry-run plans without the nested stacks' Parameter values; a real run ` + `refuses here.`);
@@ -16964,7 +17005,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						return await step();
 					} catch (err) {
-						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
 					}
 				};
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
@@ -16978,7 +17019,7 @@ async function runPerStackImportLoop(args) {
 				try {
 					await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1ATemplate, phase1AResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 				} catch (err) {
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = await afterImport("Reading its CloudFormation stack", "imported", async () => {
 					const arn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
@@ -17031,7 +17072,7 @@ async function runPerStackImportLoop(args) {
 						await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1BTemplate, phase1BResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
 						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ") : "(none)";
-						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 1B: parent ${quotedOrNotShown(plan.cfnName)} adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
@@ -17046,7 +17087,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await handler(entry);
 					} catch (err) {
-						const msg = err instanceof Error ? err.message : String(err);
+						const msg = describeAwsFailure(err).detail;
 						const importedSummary = importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ");
 						throw new Error(`Phase 1 (IMPORT) succeeded for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}); pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nStacks IMPORTed so far (each CFn-managed): ${importedSummary}. cdkd state for every stack in the tree is preserved. This stack's IMPORT-unsupported resources may still exist in AWS unmanaged. To recover: fix the failure cause, delete the remaining pre-delete resources of this stack by hand:\n` + preDeleteManualCommands(plan.recreateBeforePhase2).map((line) => `  ${line}\n`).join("") + `then run the phase-2 UPDATE for ${quotedOrNotShown(plan.cfnName)} by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
@@ -17062,7 +17103,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await executeUpdateChangeSet(deps.cfnClient, plan.cfnName, phase2Template, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
-						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(err instanceof Error ? err.message : String(err))}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(describeAwsFailure(err).detail)}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 2: stack ${quotedOrNotShown(plan.cfnName)} updated (${plan.phase2Creates.length} non-importable CREATE, ${plan.recreateBeforePhase2.length} re-CREATE).`);
 				}
@@ -17075,7 +17116,7 @@ async function runPerStackImportLoop(args) {
 				stateDeletionFailures.push({
 					stackName: node.stackName,
 					region: node.region,
-					reason: err instanceof Error ? err.message : String(err)
+					reason: describeAwsFailure(err).detail
 				});
 				const orphan = orphanCommandFor(node.stackName, node.region, args.lockRecovery);
 				logger.warn(`Failed to delete cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up its state record.${orphan.note}\nClean up with: ${orphan.command}`);
@@ -17155,7 +17196,7 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create UPDATE changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -21442,7 +21483,7 @@ function parseResourceOverrides(flags, mappingFile, mappingInline) {
 		try {
 			raw = readFileSync(mappingFile, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + (err instanceof Error ? err.message : String(err)));
+			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + describeAwsFailure(err).detail);
 		}
 		const parsed = parseMappingJson(raw, `--resource-mapping file '${mappingFile}'`);
 		for (const [key, value] of Object.entries(parsed)) map.set(key, value);
@@ -21463,7 +21504,7 @@ function parseMappingJson(raw, source) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse ${source} as JSON: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`Failed to parse ${source} as JSON: ` + describeAwsFailure(err).detail);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${source} must be a JSON object {logicalId: physicalId}`);
 	const out = {};
@@ -21482,7 +21523,7 @@ function writeRecordedMapping(filePath, rows) {
 		writeFileSync(filePath, body, "utf-8");
 		logger.info(`Wrote resolved mapping to ${filePath} (${Object.keys(map).length} entry(ies))`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		logger.error(`Failed to write --record-resource-mapping file '${filePath}': ${msg}. Continuing — the import already resolved every physical id in memory.`);
 	}
 }
@@ -22113,12 +22154,12 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 	try {
 		raw = readFileSync(templatePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 }
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
@@ -22163,8 +22204,13 @@ function hasSdkMetadata(error) {
 //#region src/local/local-role-arn.ts
 async function applyRoleArnForLocal(opts) {
 	await applyRoleArnIfSet(opts);
-	if (getAssumedRoleCredentials() === void 0) return;
-	recordAssumedRole(getPreAssumeEnvCredentials());
+	const role = getAssumedRoleCredentials();
+	if (role === void 0) return;
+	recordAssumedRole(getPreAssumeEnvCredentials(), {
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		sessionToken: role.sessionToken
+	});
 }
 
 //#endregion
@@ -25105,7 +25151,7 @@ async function localStartApiCommand(target, options) {
 			logger.info(`Pre-warming ${groupSpecs.size} container(s) for ${group.displayName}...`);
 			const handles = await Promise.allSettled([...groupSpecs.keys()].map((id) => groupPool.acquire(id)));
 			for (const result of handles) if (result.status === "fulfilled") groupPool.release(result.value);
-			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${describeAwsFailure(result.reason).detail}`);
 		}
 		const defaultRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? void 0);
 		const started = await startApiServer({
@@ -25255,34 +25301,34 @@ async function localStartApiCommand(target, options) {
 		if (watcher) try {
 			await watcher.close();
 		} catch (err) {
-			logger.warn(`watcher.close() failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`watcher.close() failed: ${describeAwsFailure(err).detail}`);
 		}
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.attached.close();
 			} catch (err) {
-				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.close();
 			} catch (err) {
-				logger.warn(`server.close() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`server.close() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.server.close();
 			} catch (err) {
-				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`pool.dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`pool.dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		if (retiredPoolDisposals.size > 0) {
@@ -25293,7 +25339,7 @@ async function localStartApiCommand(target, options) {
 			try {
 				await ws.server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		for (const dir of inlineTmpDirs) try {
@@ -25302,7 +25348,7 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		for (const dir of layerTmpDirs) try {
 			rmSync(dir, {
@@ -25310,12 +25356,12 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (profileCredsFile) try {
 			await profileCredsFile.dispose();
 		} catch (err) {
-			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 		}
 	});
 	const shutdown = async (signal, exitCode) => {
@@ -25819,13 +25865,13 @@ function readEnvOverridesFile$3(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`);
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeAwsFailure(err).detail}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -25987,7 +26033,7 @@ async function reloadAllServers(args) {
 		const previousState = booted.server.setServerState(newState);
 		booted.group = group;
 		const disposal = previousState.pool.dispose().catch((err) => {
-			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 		});
 		retiredPoolDisposals?.add(disposal);
 		disposal.then(() => retiredPoolDisposals?.delete(disposal));
@@ -26066,12 +26112,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -26079,6 +26120,11 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -27205,17 +27251,15 @@ async function localRunTaskCommand(target, options) {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 	}
 }
+function readFromCfnStack(source) {
+	return source.fromState !== true && source.fromCfnStack !== void 0 && source.fromCfnStack !== false;
+}
 async function resolvePlaceholderAccount(arn, source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27223,6 +27267,11 @@ async function resolvePlaceholderAccount(arn, source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new CdkdError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`, "LOCAL_RUN_TASK_PLACEHOLDER_NO_ACCOUNT");
@@ -27282,7 +27331,8 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 			accountId = await resolveStackAccountId$1({
 				region,
 				profile: options.profile,
-				fromState: options.fromState
+				fromState: options.fromState,
+				fromCfnStack: options.fromCfnStack
 			});
 		} catch (err) {
 			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
@@ -27336,15 +27386,10 @@ function pickCandidateStack(parsed, target, stacks) {
 	if (matched.length === 1) return matched[0];
 }
 async function resolveStackAccountId$1(source) {
-	const { region, profile, fromState } = source;
+	const { region, profile } = source;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (readFromCfnStack(source)) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -27352,6 +27397,11 @@ async function resolveStackAccountId$1(source) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -28382,7 +28432,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 	let accountId;
 	try {
-		accountId = await resolveStackAccountId(region, options.profile, options.fromState);
+		accountId = await resolveStackAccountId(region, options.profile, options.fromState, options.fromCfnStack);
 	} catch (err) {
 		logger.warn(safeMsg`${stateProvider.label}: STS GetCallerIdentity failed: ${describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity")}. ` + "A same-stack ECR image URI referencing ${AWS::AccountId} may not resolve.");
 	}
@@ -28403,15 +28453,10 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		loaded: loaded ?? void 0
 	};
 }
-async function resolveStackAccountId(region, profile, fromState) {
+async function resolveStackAccountId(region, profile, fromState, fromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	let sts;
-	if (fromState) sts = new STSClient({
-		...awsClientDefaults({ profile }),
-		...region && { region },
-		...profile && { profile }
-	});
-	else sts = new STSClient({
+	if (!fromState && fromCfnStack !== void 0 && fromCfnStack !== false) sts = new STSClient({
 		...awsClientDefaults({
 			profile,
 			ignoreAssumedRole: true
@@ -28419,6 +28464,11 @@ async function resolveStackAccountId(region, profile, fromState) {
 		...region && { region },
 		...profile && { profile }
 	});
+	else sts = new STSClient({
+		...awsClientDefaults({ profile }),
+		...region && { region },
+		...profile && { profile }
+	});
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
 	} finally {
@@ -29141,12 +29191,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		let sts;
-		if (options.fromState) sts = new STSClient({
-			...awsClientDefaults({ profile: options.profile }),
-			...region && { region },
-			...options.profile && { profile: options.profile }
-		});
-		else sts = new STSClient({
+		if (!options.fromState) sts = new STSClient({
 			...awsClientDefaults({
 				profile: options.profile,
 				ignoreAssumedRole: true
@@ -29154,6 +29199,11 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 			...region && { region },
 			...options.profile && { profile: options.profile }
 		});
+		else sts = new STSClient({
+			...awsClientDefaults({ profile: options.profile }),
+			...region && { region },
+			...options.profile && { profile: options.profile }
+		});
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		} finally {
@@ -29451,4 +29501,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CYtSW-WU.js.map
+//# sourceMappingURL=program-DmPDfDhE.js.map