@go-to-k/cdkd 0.302.2 → 0.302.4

package/dist/{program-DDJHp1K3.js → program-CAibYjpk.js}

@@ -1,10 +1,10 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
 import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
-import { $t as ambientCredentialConfig, An as withErrorHandling, Bn as plainOrDescribed, Bt as formatLockOperation, Cn as StackTerminationProtectionError, D as VALUE_NOT_SHOWN, E as assertRegionMatch, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as setPasteableRunFlags, Gt as DEFAULT_STATE_PREFIX, Hn as shellBoundedDisplay, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kn as setPasteableVerbFlags, Kt as injectiveKey, Ln as isInertUnquoted, Lt as buildLockContentionMessage, Nn as SHELL_ACTIVE_WHY, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as pasteableCommand, Rt as forceQuitRecoveryClause, Sn as StackHasActiveImportsError, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, Un as shellQuote, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as NestedStackChildDirectDestroyError, _r as isThrottlingError, ar as stripForDisplay, bn as ResourceTimeoutError, cn as DeployCancelledError, dn as IntrinsicResolutionRefusalError, en as clientDefaultsFor, fn as LocalInvokeBuildError$1, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, jn as TIMEOUT_FLAG_RESOURCE_TYPE, kn as normalizeAwsError, lr as isAmbiguousOutcomeError, mr as retryClassificationText, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, pn as LocalStartServiceError, pr as isTransientServerError, rr as escapeRegExp, rt as interruptWatchListenerCount, s as readRecordedPrincipals, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as DynamicReferenceRegionAmbiguousError, vn as PartialFailureError, vr as markNonRetryable, wn as StateError, xn as ResourceUpdateNotSupportedError, yn as ProvisioningError, zt as formatLockExpiry } from "./iam-policy-targets-OtGPguLH.js";
+import { $t as producerRecordKey, Bt as buildForceUnlockCommand, Cn as ProvisioningError, D as VALUE_NOT_SHOWN, Dn as StackTerminationProtectionError, E as assertRegionMatch, En as StackHasActiveImportsError, Fn as TIMEOUT_FLAG_RESOURCE_TYPE, Gn as quotedOrDescribed, Gt as formatLockOwner, Hn as pasteableCommand, Ht as forceQuitRecoveryClause, Jn as withheldTargetClause, Jt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Kn as shellBoundedDisplay, Ln as SHELL_ACTIVE_WHY, Nn as normalizeAwsError, On as StateError, P as remedyLogicalId, Pn as withErrorHandling, Qt as producerCoordinateKey, Sn as PartialFailureError, Sr as markNonRetryable, T as RESOURCE_NOT_FOUND, Tn as ResourceUpdateNotSupportedError, Ut as formatLockExpiry, Vn as isInertUnquoted, Vt as buildLockContentionMessage, Wn as plainOrDescribed, Wt as formatLockOperation, Xn as setPasteableVerbFlags, Xt as injectiveKey, Y as runDeleteAttempt, Yn as setPasteableRunFlags, Yt as DEFAULT_STATE_PREFIX, _n as LocalStartServiceError, _r as isTransientServerError, an as credentialFingerprint, at as beginCommandInterruptScope, bn as MalformedProducerRecordRefusalError, br as isMarkedNonRetryable, cn as CdkdError, cr as stripControlChars, ct as isInterruptedWaitError, en as setPasteableAwsProfile, fn as DeployCancelledError, gn as LocalInvokeBuildError$1, gr as isRetryableTransientError, gt as logicalIdShown, hn as IntrinsicResolutionRefusalError, in as clientDefaultsFor, kn as SynthesisError, lr as stripForDisplay, mn as DynamicReferenceRegionAmbiguousError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as ambientClientDefaults, on as AccountIdUnavailableError, ot as endCommandInterruptScope, pr as isAmbiguousOutcomeError, qn as shellQuote, rn as ambientCredentialConfig, s as readRecordedPrincipals, sr as escapeRegExp, st as interruptWatchListenerCount, t as IAM_PRINCIPAL_NAME, tn as withPasteableAwsProfile, tt as isAwsCliLiteral, un as CrossAccountSecretRefusalError, vr as retryClassificationText, vt as resourceTypeShown, wn as ResourceTimeoutError, xn as NestedStackChildDirectDestroyError, xr as isThrottlingError, zn as commandHole, zt as UNREPRODUCIBLE_LOCK_CLAUSE } from "./iam-policy-targets-DBAi38y_.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as pendingRequestCount, $a as refuseMalformedOutputs, $c as absoluteAssemblyPathEscape, $i as isImpossibleEmptyStoredAttribute, $n as noEchoExactEchoLeavesOf, $o as prefetchCreateOnlyPropertyPaths, $r as applyCustomResourceResponseExpiration, $s as buildDockerImage, $t as nameGenerationCarriedFrom, A as inheritedProvenanceForChildDiff, Aa as malformedLocalResourceEntriesWarning, Ac as resolveUseCdkBootstrapAssets, Ai as refuseUnreadableCdkCrossAccountRefs, Ao as NO_CC_HANDLERS_REASON, As as orphansAfterRollback, At as replayRollback, B as conditionFingerprint, Ba as malformedResourceEntriesWarning, Bc as decodeListingKey, Bi as sendableAssumeRoleCommand, Bn as yellow, Bs as loadPublishableAssetManifest, Bt as replacementNeverSwapped, Ca as hasReadableResources, Cc as loadCdkJson, Cn as bindingSkippedOutputs, Co as unreadableOrphanRecords, Cr as ledgerForStack, Cs as exportNamesCarriedFrom, Ct as sameJournaledOrphans, D as IMPLICIT_DELETE_DEPENDENCIES, Da as malformedExportNamesWarning, Dc as resolveSkipPrefix, Dn as constructPathOf, Dr as DeploymentEventsReader, Ds as importableOutputKeys, Ea as malformedDriftResourcePropertiesWarning, Ec as resolveCaptureObservedState, En as maskingRetryLogger, Eo as findActionableSilentDrops, Es as hasUnverifiableParameterRefusal, F as findNestedTemplateTreeDefect, Fa as malformedOrphansRefusalMessage, Fc as CFN_TEMPLATE_URL_LIMIT, Fi as applyRoleArnIfSet, Fn as bold, Fo as isStatefulRecreateTargetForReplace, Fs as isSensitiveAttributeName, Ft as isReplacementOrphan, G as withResourceDeadline, Ga as previewableOrphanRecords, Gc as AssemblyReader, Gi as classifyRecordedSecretRegion, Gn as removeSuperseded, Gr as wouldReturnToSdkProvider, Gs as ensureAssetStorage, H as parentSuppliedValues, Ha as malformedResourcesWarning, Hc as PARTITION_TABLE, Hi as applyCallerIdentityCredentials, Hn as deleteSupersededEntry, Hr as ProviderRegistry, Hs as AssetModeResolver, Ht as seedsDeleteFirstGuard, I as isAbsoluteAssetPath, Ia as malformedOrphansWarning, Ic as MIGRATE_TMP_PREFIX, Ii as assertFlagRoleArn, In as cyan, Io as isStatefulRecreateTargetSync, Is as stringifyValue, It as planFailedOps, J as keptWholeReasonText, Ja as refuseMalformedOrphanRecords, Jc as defineOwnKey, Ji as regionLessSecretName, Jn as supersededHolderOf, Jr as readsNoEchoDeleteValues, Js as parseBootstrapMarker, K as diffSecurity, Ka as refuseDivergentRecordRegionForDestroy, Kc as StageLoadError, Ki as classifyReplaySecretRegion, Kn as supersededAfterRollback, Ks as getBootstrapMarkerKey, Kt as inheritProducerRegions, L as listNestedTemplateRows, La as malformedOutputsRefusalMessage, Lc as findLargeInlineResources, Li as assertSendableRoleArn, Ln as gray, Lo as renderStatefulReason, Ls as WorkGraph, Lt as planRollback, M as findServiceTokenRefusals, Ma as malformedOrphanRecordsRefusalMessage, Mc as warnDeprecatedNoPrefixCliFlag, Mo as findReplacedReadersOfRecreateTargets, Ms as shouldRetainResource, Mt as recordAfterRollbackUpdate, N as serviceTokenBlockingReason, Na as malformedOrphanRecordsWarning, Nc as ssmResolvedValueType, Ni as recordedOutputReferenceRegions, Nn as withStackRecords, No as shownType, Ns as stackInstanceIdCarriedFrom, Nt as demoteSupersededOrphans, O as computeImplicitDeleteEdges, Oa as malformedExportSourceWarning, Oc as resolveStateBucketWithDefault, Oi as resolveDynamicReferences, On as findDestructiveChanges, Oo as unwrittenCreateOnlyReplacement, Or as DeploymentEventsStore, Os as importableOutputs, P as childTemplateLoader, Pa as malformedOrphanRowsKeptWarning, Pc as CFN_TEMPLATE_BODY_LIMIT, Pi as recordedReferenceRegions, Po as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ps as AssetPublisher, Pt as isJournaledOrphan, Q as planOrphanAdoption, Qa as refuseMalformedOrphansForOrphan, Qc as ownValue, Qi as getAccountInfo, Qn as noEchoComparisonForTemplate, Qr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Qs as buildDenyExternalAccessPolicy, Qt as updatePartialReason, R as renderNestedTemplateTreeDefect, Ra as malformedOutputsWarning, Rc as uploadCfnTemplate, Ri as explicitRoleArnOrThrow, Rn as green, Rs as buildAssetRedirectMap, Rt as recheckFailedPlan, Sa as hasReadableOutputs, Sc as getLegacyStateBucketName, Sn as isExportAliasCollision, So as unpreviewableOrphanRecords, Ss as describeRegionValueKind, St as makeForeignHolderScan, Ta as isReadableResourceEntry, Tc as resolveAutoAssetStorage, Tn as DEFAULT_RESOURCE_WARN_AFTER_MS, To as withheldAccountClause, Tr as withCreateTokenLedger, Ts as hasReasonlessBaselineRefusal, U as readRecordedConditionVerdicts, Ua as malformedScrubResourceEntriesRefusalMessage, Uc as canonicalizeRegion, Ui as callerEnvCredentials, Un as holdsSupersededResources, Ur as ccBrokenReason, Us as BOOTSTRAP_MARKER_PREFIX, Ut as orphanNeedsIdentity, V as conditionInputsFrom, Va as malformedResourcePropertiesWarning, Vc as expectedOwnerParam, Vi as AWS_CREDENTIAL_ENV_KEYS, Vn as addSuperseded, Vr as CC_BROKEN_REASON, Vs as rewriteTemplateAssetReferences, Vt as resolveReplacementOldType, Wa as malformedStateRefusalMessage, Wc as derivePartitionAndUrlSuffix, Wi as envCredentialsAreAssumedRole, Wn as isSupersededResourceRecord, Wr as isCustomResource, Ws as assertAssetBucketRegion, Wt as findNestedStackTypeChanges, X as makeCanonicalizePropertiesFn, Xa as refuseMalformedOrphans, Xc as hasPlainPrototype, Xi as isUnboundTemplateParameter, Xn as withoutSuperseded, Xs as validateAssetBucketName, Y as mergeNoChangeOutputs, Ya as refuseMalformedOrphanRecordsForDestroy, Yc as hasOwnKey, Yi as coerceParameterTypedValue, Yn as supersededResourcesOf, Yr as isCustomResourceType$1, Ys as readBootstrapMarkerBody, Z as makeSiblingClaimReader, Za as refuseMalformedOrphansForDestroy, Zc as nullPrototypeRecord, Zi as parameterTypeMayLoseSecretIdentity, Zn as noEchoAttributeNamesOf, Zr as withPrintingSecrets, Zs as validateContainerRepoName, Zt as updatePartialMessage, _a as UNREADABLE_RESOURCES_MAP_ROW, _c as AssetManifestLoader, _n as exportNameSecretExposure, _o as repairMalformedOrphansForReadOnly, _r as createPreDeleteFinalSnapshot, _s as isNotImplemented, _t as dropFailedCommands, a as isProtectionValueActive, aa as cfnRefValueFromPhysicalId, ac as finchSecretArgvRefusal, ai as UNSPECIFIED_SKIP_REASON, al as injectedAwsRegionValue, an as computeParameterTaint, ao as refuseMalformedResourceEntriesForImport, ar as namingSecretsWithRecordedNoEcho, at as displacedPhysicalIdShown, ba as displayLogicalId, bc as synthesisStatusMessage, bi as IntrinsicFunctionResolver, bn as collectDeclaredOutputNames, bo as repairMalformedResourcePropertiesForReadOnly, br as refusesFinalSnapshot, bs as splitImportedOps, bt as journaledOrphanLines, cc as isDockerClientEnvKey, ci as deleteSkipReason, cn as resourcesNamingDeclaredParameter, co as refuseMalformedResourcePropertiesForDestroy, cr as secretNamePrintingBags, cs as LockManager, ct as nestedChildStackName$1, dc as redactDockerArgvValues, dn as exportAliasCollisionScrubWarning, do as refuseMalformedResourcePropertiesForOrphan, dr as stateSecretNameNeedles, ds as rebuildClientForBucketRegion, dt as revertedNestedRowIds, ea as carriesDynamicReference, ec as resolveDockerContextDirectory, ei as customResourceResponseExpirationWarning, el as describeFileReadFailure, en as nameGenerationHighWaterOf, eo as refuseMalformedOutputsForDestroy, er as noEchoParameterNamesOf, es as templateResourceTypes, et as resolvePendingCloudControlRequests, fa as declaresNoEcho, fc as redactedCause, fn as secretBearing, fo as refuseMalformedResourcesForDeploy, fr as storedSecretNameNeedles, fs as CrossPrefixReadError, ft as withNestedRevertRun, ga as UNREADABLE_ORPHANS_CONTAINER_ROW, gc as warnFinchArgvExposure, gn as exportNameNoEchoParameters, go as repairMalformedOrphanRecordsForReadOnly, gr as ccRoutedFinalSnapshotError, gs as isAccessDenied, gt as deleteJournaledOrphans, ha as STATE_RESOURCES_MALFORMED, hc as runDockerStreaming, hn as carriedExportAliasExposure, ho as refuseMalformedState, hr as buildFinalSnapshotIdentifier, hs as crossPrefixDeniedWarning, ht as withNestedStackContext, i as PROTECTION_PROPERTY_BY_TYPE, ia as AWS_NO_VALUE, ic as dockerSpawnEnvWithSensitive, ii as RollbackInlinePolicyWriters, il as injectAwsRegion, in as retiredNameGenerationsLeaving, io as refuseMalformedResourceEntriesForDestroy, ir as maskEventTextWithBoundBags, it as displacedOpClause, j as deferredServiceTokenWarning, ja as malformedLocalResourcesWarning, jc as stateBucketExistenceConfirmed, ji as keepHeldTokenProvenance, jn as destroyStackRecordsView, jo as hasNoCloudControlHandlers, js as orphansCarriedFrom, jt as removeProtectionTypeList, k as crossStackOutputProvenanceSource, ka as malformedLocalOutputsWarning, kc as resolveStateBucketWithDefaultAndSource, ki as producerLookupOver, kn as formatDestructiveChange, kr as extractDeploymentEventError, ks as isReadableBag, kt as replayFailedOperations, la as withSharedDrainBudget, lc as isMalformedEnvKey, ln as WITHHELD_NAME_DISPLAY, lo as refuseMalformedResourcePropertiesForDrift, ls as isLockInfoExpired, lt as recordDisplacedSkips, ma as STATE_REGION_DIVERGED, mc as runDockerForeground, mn as secretSafeKeyDisplay, mo as refuseMalformedResourcesForExport, mr as PRE_DELETE_SNAPSHOT_TYPES, ms as applyCrossPrefixScan, mt as getCurrentNestedStackContext, n as recordedProtectionEvidence, na as isNamelessDynamicReferenceError, nc as describeDockerExecFailure, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, nn as retiredAfterRollback, no as refuseMalformedResourceEntries, nr as completedReplayEntries, ns as withRetry, nt as recordRetainedForReadoption, o as perType, oa as isStalePlaceholderArnAttribute, oc as formatDockerLoginError, oi as deleteIndeterminateGuards, on as namesAnyDeclaredParameter, oo as refuseMalformedResourceEntriesForImportSave, or as orphanRecordsPrintingBag, os as DagBuilder, ot as dropSettledNestedJournals, pa as JSON_LISTING_HOLE_VALUE, pc as redactedDockerCause, pn as secretBearingStateKeyWarning, po as refuseMalformedResourcesForDestroy, pr as ATOMIC_FINAL_SNAPSHOT_TYPES, ps as CrossPrefixScanCache, pt as collectNestedChildUnaddressed, q as isSecretBearingReferenceString, qc as processStackMessages, qi as producerRegionsFromState, qn as supersededHeldByOtherTypeWarning, qr as TemplateNoEchoReresolver, qs as isCrossRegionRedirect, r as recordedProtectionNote, ra as keepsSecretReferenceToken, rc as describeDockerFailure, rl as resolveAssemblyPath, rn as retiredNameGenerationsAfter, ro as refuseMalformedResourceEntriesForDeploy, rr as journaledOrphanPrintingBag, rt as NESTED_PENDING_PARENT_REASON, s as readProtection, sa as refStateLookupFromResource, sc as getDockerCmd, si as deleteLeftInPlace, sl as resolveBucketRegion, sn as reachableDivergentParameters, so as refuseMalformedResourceEntriesForOrphan, sr as secretNamePrintingBag, ss as TemplateParser, t as DeployEngine, ta as carriesFetchableDynamicReference, tc as describeDockerCapturedOutput, ti as CloudControlProvider, tl as displayAssemblyPath, tn as nameScopeOf, to as refuseMalformedResourceAttributesForOrphan, tr as createReadOnlyAttributeHealerFactory, ts as describeTypeWithThrottleRetry, tt as keptForRetainedRecord, ua as parameterInputsFor, uc as partitionSensitiveEnv, ui as isWaitAbandonedError, un as displayTextOrWithheld, uo as refuseMalformedResourcePropertiesForExport, ur as secretNamedRecordNeedles, us as S3StateBackend, va as accountArgs, vc as getDockerImageBySourceHash, vi as DiffCalculator, vn as isWholeDynamicReferenceValue, vo as repairMalformedOutputsForReadOnly, vr as effectiveDeletionPolicy, vs as stackInstanceIdOf, vt as dropFailedHint, wa as isReadableOrphanRecord, wc as resolveApp, wn as DEFAULT_RESOURCE_TIMEOUT_MS, wo as unreadableResourceEntries, ws as hasReadableExportSet, wt as formatResourceLine, xa as hasReadableOrphans, xc as getDefaultStateBucketName, xi as poisonRenderedSpellingsCollidingIn, xn as collectPublishedOutputNames, xo as repairMalformedResourcesForReadOnly, xr as unsupportedFinalSnapshotError, xs as acceptedCreateOnlyDropsOf, xt as loadJournaledOrphans, ya as deployRefusesOrphanRowsReason, yc as Synthesizer, yi as INTRINSIC_KEYS, yn as noEchoParameterValueSeed, yo as repairMalformedResourceEntriesForReadOnly, yr as isFinalSnapshotError, ys as withStackInstanceIdWithheld, yt as isHandledOrphan, z as templateIdentity, za as malformedRenderedContainersWarning, zc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zi as isIamRoleArn, zn as red, zs as createAssetRedirectResolver, zt as recordUnderIdIsNotOwn } from "./deploy-engine-B_xWnZ4Q.js";
+import { $ as pendingRequestCount, $a as refuseMalformedOutputs, $c as absoluteAssemblyPathEscape, $i as isImpossibleEmptyStoredAttribute, $n as noEchoExactEchoLeavesOf, $o as prefetchCreateOnlyPropertyPaths, $r as applyCustomResourceResponseExpiration, $s as buildDockerImage, $t as nameGenerationCarriedFrom, A as inheritedProvenanceForChildDiff, Aa as malformedLocalResourceEntriesWarning, Ac as resolveUseCdkBootstrapAssets, Ai as refuseUnreadableCdkCrossAccountRefs, Ao as NO_CC_HANDLERS_REASON, As as orphansAfterRollback, At as replayRollback, B as conditionFingerprint, Ba as malformedResourceEntriesWarning, Bc as decodeListingKey, Bi as sendableAssumeRoleCommand, Bn as yellow, Bs as loadPublishableAssetManifest, Bt as replacementNeverSwapped, Ca as hasReadableResources, Cc as loadCdkJson, Cn as bindingSkippedOutputs, Co as unreadableOrphanRecords, Cr as ledgerForStack, Cs as exportNamesCarriedFrom, Ct as sameJournaledOrphans, D as IMPLICIT_DELETE_DEPENDENCIES, Da as malformedExportNamesWarning, Dc as resolveSkipPrefix, Dn as constructPathOf, Dr as DeploymentEventsReader, Ds as importableOutputKeys, Ea as malformedDriftResourcePropertiesWarning, Ec as resolveCaptureObservedState, En as maskingRetryLogger, Eo as findActionableSilentDrops, Es as hasUnverifiableParameterRefusal, F as findNestedTemplateTreeDefect, Fa as malformedOrphansRefusalMessage, Fc as CFN_TEMPLATE_URL_LIMIT, Fi as applyRoleArnIfSet, Fn as bold, Fo as isStatefulRecreateTargetForReplace, Fs as isSensitiveAttributeName, Ft as isReplacementOrphan, G as withResourceDeadline, Ga as previewableOrphanRecords, Gc as AssemblyReader, Gi as classifyRecordedSecretRegion, Gn as removeSuperseded, Gr as wouldReturnToSdkProvider, Gs as ensureAssetStorage, H as parentSuppliedValues, Ha as malformedResourcesWarning, Hc as PARTITION_TABLE, Hi as applyCallerIdentityCredentials, Hn as deleteSupersededEntry, Hr as ProviderRegistry, Hs as AssetModeResolver, Ht as seedsDeleteFirstGuard, I as isAbsoluteAssetPath, Ia as malformedOrphansWarning, Ic as MIGRATE_TMP_PREFIX, Ii as assertFlagRoleArn, In as cyan, Io as isStatefulRecreateTargetSync, Is as stringifyValue, It as planFailedOps, J as keptWholeReasonText, Ja as refuseMalformedOrphanRecords, Jc as defineOwnKey, Ji as regionLessSecretName, Jn as supersededHolderOf, Jr as readsNoEchoDeleteValues, Js as parseBootstrapMarker, K as diffSecurity, Ka as refuseDivergentRecordRegionForDestroy, Kc as StageLoadError, Ki as classifyReplaySecretRegion, Kn as supersededAfterRollback, Ks as getBootstrapMarkerKey, Kt as inheritProducerRegions, L as listNestedTemplateRows, La as malformedOutputsRefusalMessage, Lc as findLargeInlineResources, Li as assertSendableRoleArn, Ln as gray, Lo as renderStatefulReason, Ls as WorkGraph, Lt as planRollback, M as findServiceTokenRefusals, Ma as malformedOrphanRecordsRefusalMessage, Mc as warnDeprecatedNoPrefixCliFlag, Mo as findReplacedReadersOfRecreateTargets, Ms as shouldRetainResource, Mt as recordAfterRollbackUpdate, N as serviceTokenBlockingReason, Na as malformedOrphanRecordsWarning, Nc as ssmResolvedValueType, Ni as recordedOutputReferenceRegions, Nn as withStackRecords, No as shownType, Ns as stackInstanceIdCarriedFrom, Nt as demoteSupersededOrphans, O as computeImplicitDeleteEdges, Oa as malformedExportSourceWarning, Oc as resolveStateBucketWithDefault, Oi as resolveDynamicReferences, On as findDestructiveChanges, Oo as unwrittenCreateOnlyReplacement, Or as DeploymentEventsStore, Os as importableOutputs, P as childTemplateLoader, Pa as malformedOrphanRowsKeptWarning, Pc as CFN_TEMPLATE_BODY_LIMIT, Pi as recordedReferenceRegions, Po as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ps as AssetPublisher, Pt as isJournaledOrphan, Q as planOrphanAdoption, Qa as refuseMalformedOrphansForOrphan, Qc as ownValue, Qi as getAccountInfo, Qn as noEchoComparisonForTemplate, Qr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Qs as buildDenyExternalAccessPolicy, Qt as updatePartialReason, R as renderNestedTemplateTreeDefect, Ra as malformedOutputsWarning, Rc as uploadCfnTemplate, Ri as explicitRoleArnOrThrow, Rn as green, Rs as buildAssetRedirectMap, Rt as recheckFailedPlan, Sa as hasReadableOutputs, Sc as getLegacyStateBucketName, Sn as isExportAliasCollision, So as unpreviewableOrphanRecords, Ss as describeRegionValueKind, St as makeForeignHolderScan, Ta as isReadableResourceEntry, Tc as resolveAutoAssetStorage, Tn as DEFAULT_RESOURCE_WARN_AFTER_MS, To as withheldAccountClause, Tr as withCreateTokenLedger, Ts as hasReasonlessBaselineRefusal, U as readRecordedConditionVerdicts, Ua as malformedScrubResourceEntriesRefusalMessage, Uc as canonicalizeRegion, Ui as callerEnvCredentials, Un as holdsSupersededResources, Ur as ccBrokenReason, Us as BOOTSTRAP_MARKER_PREFIX, Ut as orphanNeedsIdentity, V as conditionInputsFrom, Va as malformedResourcePropertiesWarning, Vc as expectedOwnerParam, Vi as AWS_CREDENTIAL_ENV_KEYS, Vn as addSuperseded, Vr as CC_BROKEN_REASON, Vs as rewriteTemplateAssetReferences, Vt as resolveReplacementOldType, Wa as malformedStateRefusalMessage, Wc as derivePartitionAndUrlSuffix, Wi as envCredentialsAreAssumedRole, Wn as isSupersededResourceRecord, Wr as isCustomResource, Ws as assertAssetBucketRegion, Wt as findNestedStackTypeChanges, X as makeCanonicalizePropertiesFn, Xa as refuseMalformedOrphans, Xc as hasPlainPrototype, Xi as isUnboundTemplateParameter, Xn as withoutSuperseded, Xs as validateAssetBucketName, Y as mergeNoChangeOutputs, Ya as refuseMalformedOrphanRecordsForDestroy, Yc as hasOwnKey, Yi as coerceParameterTypedValue, Yn as supersededResourcesOf, Yr as isCustomResourceType$1, Ys as readBootstrapMarkerBody, Z as makeSiblingClaimReader, Za as refuseMalformedOrphansForDestroy, Zc as nullPrototypeRecord, Zi as parameterTypeMayLoseSecretIdentity, Zn as noEchoAttributeNamesOf, Zr as withPrintingSecrets, Zs as validateContainerRepoName, Zt as updatePartialMessage, _a as UNREADABLE_RESOURCES_MAP_ROW, _c as AssetManifestLoader, _n as exportNameSecretExposure, _o as repairMalformedOrphansForReadOnly, _r as createPreDeleteFinalSnapshot, _s as isNotImplemented, _t as dropFailedCommands, a as isProtectionValueActive, aa as cfnRefValueFromPhysicalId, ac as finchSecretArgvRefusal, ai as UNSPECIFIED_SKIP_REASON, al as injectedAwsRegionValue, an as computeParameterTaint, ao as refuseMalformedResourceEntriesForImport, ar as namingSecretsWithRecordedNoEcho, at as displacedPhysicalIdShown, ba as displayLogicalId, bc as synthesisStatusMessage, bi as IntrinsicFunctionResolver, bn as collectDeclaredOutputNames, bo as repairMalformedResourcePropertiesForReadOnly, br as refusesFinalSnapshot, bs as splitImportedOps, bt as journaledOrphanLines, cc as isDockerClientEnvKey, ci as deleteSkipReason, cn as resourcesNamingDeclaredParameter, co as refuseMalformedResourcePropertiesForDestroy, cr as secretNamePrintingBags, cs as LockManager, ct as nestedChildStackName$1, dc as redactDockerArgvValues, dn as exportAliasCollisionScrubWarning, do as refuseMalformedResourcePropertiesForOrphan, dr as stateSecretNameNeedles, ds as rebuildClientForBucketRegion, dt as revertedNestedRowIds, ea as carriesDynamicReference, ec as resolveDockerContextDirectory, ei as customResourceResponseExpirationWarning, el as describeFileReadFailure, en as nameGenerationHighWaterOf, eo as refuseMalformedOutputsForDestroy, er as noEchoParameterNamesOf, es as templateResourceTypes, et as resolvePendingCloudControlRequests, fa as declaresNoEcho, fc as redactedCause, fn as secretBearing, fo as refuseMalformedResourcesForDeploy, fr as storedSecretNameNeedles, fs as CrossPrefixReadError, ft as withNestedRevertRun, ga as UNREADABLE_ORPHANS_CONTAINER_ROW, gc as warnFinchArgvExposure, gn as exportNameNoEchoParameters, go as repairMalformedOrphanRecordsForReadOnly, gr as ccRoutedFinalSnapshotError, gs as isAccessDenied, gt as deleteJournaledOrphans, ha as STATE_RESOURCES_MALFORMED, hc as runDockerStreaming, hn as carriedExportAliasExposure, ho as refuseMalformedState, hr as buildFinalSnapshotIdentifier, hs as crossPrefixDeniedWarning, ht as withNestedStackContext, i as PROTECTION_PROPERTY_BY_TYPE, ia as AWS_NO_VALUE, ic as dockerSpawnEnvWithSensitive, ii as RollbackInlinePolicyWriters, il as injectAwsRegion, in as retiredNameGenerationsLeaving, io as refuseMalformedResourceEntriesForDestroy, ir as maskEventTextWithBoundBags, it as displacedOpClause, j as deferredServiceTokenWarning, ja as malformedLocalResourcesWarning, jc as stateBucketExistenceConfirmed, ji as keepHeldTokenProvenance, jn as destroyStackRecordsView, jo as hasNoCloudControlHandlers, js as orphansCarriedFrom, jt as removeProtectionTypeList, k as crossStackOutputProvenanceSource, ka as malformedLocalOutputsWarning, kc as resolveStateBucketWithDefaultAndSource, ki as producerLookupOver, kn as formatDestructiveChange, kr as extractDeploymentEventError, ks as isReadableBag, kt as replayFailedOperations, la as withSharedDrainBudget, lc as isMalformedEnvKey, ln as WITHHELD_NAME_DISPLAY, lo as refuseMalformedResourcePropertiesForDrift, ls as isLockInfoExpired, lt as recordDisplacedSkips, ma as STATE_REGION_DIVERGED, mc as runDockerForeground, mn as secretSafeKeyDisplay, mo as refuseMalformedResourcesForExport, mr as PRE_DELETE_SNAPSHOT_TYPES, ms as applyCrossPrefixScan, mt as getCurrentNestedStackContext, n as recordedProtectionEvidence, na as isNamelessDynamicReferenceError, nc as describeDockerExecFailure, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, nn as retiredAfterRollback, no as refuseMalformedResourceEntries, nr as completedReplayEntries, ns as withRetry, nt as recordRetainedForReadoption, o as perType, oa as isStalePlaceholderArnAttribute, oc as formatDockerLoginError, oi as deleteIndeterminateGuards, on as namesAnyDeclaredParameter, oo as refuseMalformedResourceEntriesForImportSave, or as orphanRecordsPrintingBag, os as DagBuilder, ot as dropSettledNestedJournals, pa as JSON_LISTING_HOLE_VALUE, pc as redactedDockerCause, pn as secretBearingStateKeyWarning, po as refuseMalformedResourcesForDestroy, pr as ATOMIC_FINAL_SNAPSHOT_TYPES, ps as CrossPrefixScanCache, pt as collectNestedChildUnaddressed, q as isSecretBearingReferenceString, qc as processStackMessages, qi as producerRegionsFromState, qn as supersededHeldByOtherTypeWarning, qr as TemplateNoEchoReresolver, qs as isCrossRegionRedirect, r as recordedProtectionNote, ra as keepsSecretReferenceToken, rc as describeDockerFailure, rl as resolveAssemblyPath, rn as retiredNameGenerationsAfter, ro as refuseMalformedResourceEntriesForDeploy, rr as journaledOrphanPrintingBag, rt as NESTED_PENDING_PARENT_REASON, s as readProtection, sa as refStateLookupFromResource, sc as getDockerCmd, si as deleteLeftInPlace, sl as resolveBucketRegion, sn as reachableDivergentParameters, so as refuseMalformedResourceEntriesForOrphan, sr as secretNamePrintingBag, ss as TemplateParser, t as DeployEngine, ta as carriesFetchableDynamicReference, tc as describeDockerCapturedOutput, ti as CloudControlProvider, tl as displayAssemblyPath, tn as nameScopeOf, to as refuseMalformedResourceAttributesForOrphan, tr as createReadOnlyAttributeHealerFactory, ts as describeTypeWithThrottleRetry, tt as keptForRetainedRecord, ua as parameterInputsFor, uc as partitionSensitiveEnv, ui as isWaitAbandonedError, un as displayTextOrWithheld, uo as refuseMalformedResourcePropertiesForExport, ur as secretNamedRecordNeedles, us as S3StateBackend, va as accountArgs, vc as getDockerImageBySourceHash, vi as DiffCalculator, vn as isWholeDynamicReferenceValue, vo as repairMalformedOutputsForReadOnly, vr as effectiveDeletionPolicy, vs as stackInstanceIdOf, vt as dropFailedHint, wa as isReadableOrphanRecord, wc as resolveApp, wn as DEFAULT_RESOURCE_TIMEOUT_MS, wo as unreadableResourceEntries, ws as hasReadableExportSet, wt as formatResourceLine, xa as hasReadableOrphans, xc as getDefaultStateBucketName, xi as poisonRenderedSpellingsCollidingIn, xn as collectPublishedOutputNames, xo as repairMalformedResourcesForReadOnly, xr as unsupportedFinalSnapshotError, xs as acceptedCreateOnlyDropsOf, xt as loadJournaledOrphans, ya as deployRefusesOrphanRowsReason, yc as Synthesizer, yi as INTRINSIC_KEYS, yn as noEchoParameterValueSeed, yo as repairMalformedResourceEntriesForReadOnly, yr as isFinalSnapshotError, ys as withStackInstanceIdWithheld, yt as isHandledOrphan, z as templateIdentity, za as malformedRenderedContainersWarning, zc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zi as isIamRoleArn, zn as red, zs as createAssetRedirectResolver, zt as recordUnderIdIsNotOwn } from "./deploy-engine-CN2w5GAK.js";
 import { $ as recordLogOnlyParameterValue, Cn as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ct as DYNAMIC_REFERENCE_TOKEN_SCAN, Dt as pathCrossesDottedKey, Et as isUncertifiedBaselineMaskPosition, F as redactForState, G as carryLogOnlyValues, It as recordNestedStackParameterExpressions, Jt as physicalNameCopiesOf, Ot as identityKeyFor, Q as printingCorpusOf, S as liveMatchesUnresolvedTokenFrame, Tn as isSingleDynamicReferenceToken, Tt as dynamicReferenceTokens, X as literalSplitDelimitersOf, Xt as recordPhysicalNameCopy, Y as hasMaskableValues, Z as logOnlyValueCount, _n as recordMaskOnlyValuesIn, a as maskReadbackAtCoordinates, at as errorCauseChain, b as valueAtCoordinate, bn as recordProvenPublicExpression, bt as withPhysicalNameCopies, ct as maskSecretsInText, d as noEchoOutputsComparison, g as readsNoEchoSource, gn as recordMaskOnlyValue, h as readbackPathFor, i as maskAtCoordinates, it as createSecretMasker, kt as inheritNestedStackParameterAssociations, l as noEchoCoordinatesOf, nn as carriesSecretMask, nt as shareLogOnlyValues, o as maskWholeValue, pn as provenPublicValue, q as createUnionSecretMasker, r as isMarkedCoordinate, rt as unionOfSecretBags, s as maskedLeafCoordinatesOf, st as maskSecretsInError, t as canonicalCoordinates, tn as splitGetAttStringForm, tt as recordLogOnlyValue, u as noEchoLeavesOf, v as recordedNoEchoValuesOf, vn as recordNoEchoAttributeValues, vt as scrubResourceRecord, xn as wholeStringLeavesOf, yn as recordNoEchoParameterFreshValue } from "./secret-redaction-BHWS-PZK.js";
-import { t as getCdkdVersion } from "./version-CZS6bEuG.js";
+import { t as getCdkdVersion } from "./version-CNK8U3qj.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1099,14 +1099,149 @@ function pathGlobMatches(pattern, subject) {
 	return can[0];
 }
 
+//#endregion
+//#region src/cli/cdk-path.ts
+function readCdkPath(resource) {
+	const meta = resource.Metadata;
+	if (!meta) return "";
+	const v = meta["aws:cdk:path"];
+	return typeof v === "string" ? v : "";
+}
+function readCdkPathOrUndefined(resource) {
+	const path = readCdkPath(resource);
+	return path === "" ? void 0 : path;
+}
+function buildCdkPathIndex(template) {
+	const index = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(template.Resources)) {
+		if (resource.Type === "AWS::CDK::Metadata") continue;
+		const path = readCdkPath(resource);
+		if (path) index.set(path, logicalId);
+	}
+	return index;
+}
+function resolveCdkPathToLogicalIds(input, index) {
+	const seen = /* @__PURE__ */ new Map();
+	const prefix = `${input}/`;
+	for (const [path, logicalId] of index) if (path === input || path.startsWith(prefix)) {
+		if (!seen.has(logicalId)) seen.set(logicalId, path);
+	}
+	return [...seen.entries()].map(([logicalId, cdkPath]) => ({
+		logicalId,
+		cdkPath
+	}));
+}
+function stackForConstructPath(path, stacks) {
+	let best;
+	let bestRank = -1;
+	for (const s of stacks) {
+		const names = [[s.displayName, 1], [s.stackName, 0]];
+		for (const [name, preference] of names) {
+			if (typeof name !== "string" || name.length === 0) continue;
+			if (!path.startsWith(`${name}/`)) continue;
+			const rank = name.length * 2 + preference;
+			if (rank > bestRank) {
+				best = s;
+				bestRank = rank;
+			}
+		}
+	}
+	return best;
+}
+function stackForPathFormTarget(parsed, target, stacks) {
+	if (!parsed.isPath || parsed.pathOrId !== target) return void 0;
+	return stackForConstructPath(parsed.pathOrId, stacks);
+}
+
 //#endregion
 //#region src/cli/stack-matcher.ts
-function matchStacks(stacks, patterns) {
+function matchStacks(stacks, patterns, options = {}) {
 	if (patterns.length === 0) return [];
 	const selected = /* @__PURE__ */ new Set();
-	for (const pattern of patterns) for (const stack of stacksForPattern(stacks, pattern)) selected.add(stack.stackName);
+	for (const pattern of patterns) for (const stack of stacksForPattern(stacks, pattern)) selected.add(stack);
+	if (options.dedupe === "identity") return stacks.filter((s) => selected.has(s));
 	const seen = /* @__PURE__ */ new Set();
-	return stacks.filter((s) => selected.has(s.stackName) && !seen.has(s.stackName) && seen.add(s.stackName));
+	return stacks.filter((s) => selected.has(s) && !seen.has(s.stackName) && seen.add(s.stackName));
+}
+function stackNameRegionCollisions(stacks, regionOf, selected = new Set(stacks)) {
+	const byNameRegion = /* @__PURE__ */ new Map();
+	for (const stack of stacks) {
+		const key = injectiveKey(stack.stackName, regionOf(stack) ?? "");
+		const group = byNameRegion.get(key);
+		if (group) group.push(stack);
+		else byNameRegion.set(key, [stack]);
+	}
+	const sameAccountPossible = (a, b) => a.account === void 0 || b.account === void 0 || a.account === b.account;
+	const groups = [];
+	for (const group of byNameRegion.values()) {
+		const chosen = group.filter((s) => selected.has(s));
+		if (chosen.length === 0) continue;
+		const colliding = group.filter((s) => selected.has(s) || chosen.some((c) => sameAccountPossible(c, s)));
+		if (colliding.length > 1) groups.push(colliding);
+	}
+	return groups;
+}
+function stacksForDependency(depName, dependent, pool) {
+	if (depName === dependent.stackName) return [];
+	const candidates = pool.filter((s) => s.stackName === depName);
+	if (candidates.length <= 1) return candidates;
+	const sameStage = candidates.filter((s) => s.stagePath === dependent.stagePath);
+	const inStage = sameStage.length > 0 ? sameStage : candidates;
+	if (inStage.length === 1) return inStage;
+	const sameRegion = inStage.filter((s) => s.region === dependent.region);
+	return sameRegion.length > 0 ? sameRegion : inStage;
+}
+function renderStackNameRegionCollision(groups, regionOf) {
+	const ident = (v) => displayIdent(v, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	return `Selected stacks address the same CloudFormation stack: ${groups.map((group) => {
+		const region = regionOf(group[0]);
+		const where = region === void 0 ? "and neither sets env.region, so they deploy to the same region" : `in region ${ident(region)}`;
+		const accounts = [...new Set(group.flatMap((s) => s.account ? [s.account] : []))];
+		const accountNote = accounts.length > 1 ? ` (their accounts ${accounts.map(ident).join(", ")} differ, but one run deploys every selected stack under its own account)` : "";
+		return `${group.map(describeStack).join(", ")} share the physical stack name ${ident(group[0].stackName)} ${where}${accountNote}`;
+	}).join("; ")}. Give each a distinct stackName or env.region, or select only one of them by its CDK path.` + (groups.some((g) => g.some((s) => s.region === void 0 && regionOf(s) !== void 0)) ? " A stack without env.region takes the run's region: pin that Stage's region, or set AWS_REGION to another region for this run." : "");
+}
+function refuseStackNameRegionCollisions(stacks, regionOf, selected) {
+	const groups = stackNameRegionCollisions(stacks, regionOf, selected);
+	if (groups.length > 0) throw new CdkdError(renderStackNameRegionCollision(groups, (s) => regionOf(s)), "STACK_NAME_REGION_COLLISION");
+}
+function selectTargetStack(parsed, target, stacks) {
+	if (parsed.stackPattern === null) return stacks.length === 1 ? {
+		kind: "found",
+		stack: stacks[0]
+	} : { kind: "no-prefix" };
+	const byPrefix = stackForPathFormTarget(parsed, target, stacks);
+	if (byPrefix) {
+		if (stackForPathFormTarget(parsed, target, [...stacks].reverse()) === byPrefix) return {
+			kind: "found",
+			stack: byPrefix
+		};
+		return {
+			kind: "ambiguous",
+			pattern: byPrefix.stackName,
+			matched: stacks.filter((s) => s.stackName === byPrefix.stackName)
+		};
+	}
+	const matched = matchStacks([...stacks], [parsed.stackPattern], { dedupe: "identity" });
+	if (matched.length === 1) return {
+		kind: "found",
+		stack: matched[0]
+	};
+	if (matched.length === 0) return {
+		kind: "not-found",
+		pattern: parsed.stackPattern
+	};
+	return {
+		kind: "ambiguous",
+		pattern: parsed.stackPattern,
+		matched
+	};
+}
+function renderAmbiguousTargetStack(pattern, matched) {
+	const sharedName = matched.length > 1 && matched.every((s) => s.stackName === pattern);
+	const example = matched.find((s) => s.displayName && s.displayName !== s.stackName)?.displayName;
+	const hint = example !== void 0 && displayIdent(example, { maxCodePoints: 1152 }) === example ? ` (e.g. '${example}/<construct path>')` : "";
+	return `Stack pattern ${renderPatternList([pattern])} matched ${matched.length} stacks: ${matched.map(describeStack).join(", ")}` + (sharedName ? ", which share that physical stack name" : "") + (example !== void 0 ? `. Name one stack by its CDK path, shown in parentheses${hint}.` : ". Use a more specific pattern.");
 }
 function stacksForPattern(stacks, pattern) {
 	const byId = stacks.filter((s) => pathGlobMatches(pattern, s.displayName ?? s.stackName));
@@ -1284,7 +1419,7 @@ async function synthCommand(stackPatterns, options) {
 		...Object.keys(context).length > 0 && { context }
 	};
 	const { stacks: allStacks, assemblyDir } = await synthesizer.synthesize(synthOptions);
-	const selected = stackPatterns.length > 0 ? matchStacks(allStacks, stackPatterns) : allStacks;
+	const selected = stackPatterns.length > 0 ? matchStacks(allStacks, stackPatterns, { dedupe: "identity" }) : allStacks;
 	if (selected.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
 	const stacks = selected;
 	processStackMessages(stacks, logger, {
@@ -1297,15 +1432,17 @@ async function synthCommand(stackPatterns, options) {
 	} else logger.info(`Supply a stack id (${stacks.map(describeStack).join(", ")}) to display its template.`);
 	const found = stacks.length === allStacks.length ? `Found ${stacks.length} stack(s):` : `Found ${stacks.length} of ${allStacks.length} stack(s):`;
 	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} ${found}`);
+	const sharedNames = new Set(stacks.map((s) => s.stackName).filter((name, i, names) => names.indexOf(name) !== i));
 	for (const stack of stacks) {
+		const shared = sharedNames.has(stack.stackName);
 		const resourceCount = countDeployableResources(stack.template);
 		const outputCount = Object.keys(stack.template.Outputs ?? {}).length;
-		logger.info(`  • ${stack.stackName}`);
+		logger.info(`  • ${shared ? describeStack(stack) : stack.stackName}`);
 		logger.info(`    - Resources: ${resourceCount}`);
 		logger.info(`    - Outputs: ${outputCount}`);
 		logger.info(`    - Has assets: ${assemblyReader.hasAssets(stack) ? "Yes" : "No"}`);
 		if (options.verbose) {
-			const templatePath = resolveVerboseTemplatePath(options.output, stack.stackName);
+			const templatePath = resolveVerboseTemplatePath(options.output, shared ? `${stack.stackName}.${stack.region ?? "env-agnostic"}` : stack.stackName);
 			writeFileSync(templatePath, JSON.stringify(stack.template, null, 2));
 			logger.debug(`    - Template written to: ${displaySafe(templatePath)}`);
 		}
@@ -1327,20 +1464,16 @@ function createSynthCommand() {
 //#endregion
 //#region src/cli/commands/list.ts
 function sortByDependency(stacks) {
-	const byName = new Map(stacks.map((s) => [s.stackName, s]));
 	const visited = /* @__PURE__ */ new Set();
 	const result = [];
 	const visit = (stack, ancestors) => {
-		if (visited.has(stack.stackName)) return;
-		if (ancestors.has(stack.stackName)) return;
-		ancestors.add(stack.stackName);
-		for (const depName of stack.dependencyNames) {
-			const dep = byName.get(depName);
-			if (dep) visit(dep, ancestors);
-		}
-		ancestors.delete(stack.stackName);
-		if (!visited.has(stack.stackName)) {
-			visited.add(stack.stackName);
+		if (visited.has(stack)) return;
+		if (ancestors.has(stack)) return;
+		ancestors.add(stack);
+		for (const depName of stack.dependencyNames) for (const dep of stacksForDependency(depName, stack, stacks)) visit(dep, ancestors);
+		ancestors.delete(stack);
+		if (!visited.has(stack)) {
+			visited.add(stack);
 			result.push(stack);
 		}
 	};
@@ -1385,7 +1518,7 @@ async function listCommand(patterns, options) {
 	};
 	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
 	if (allStacks.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks));
-	const selected = patterns.length > 0 ? matchStacks(allStacks, patterns) : allStacks;
+	const selected = patterns.length > 0 ? matchStacks(allStacks, patterns, { dedupe: "identity" }) : allStacks;
 	if (selected.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks));
 	const sorted = sortByDependency(selected);
 	if (options.long) {
@@ -2485,40 +2618,65 @@ var ExportIndexStore = class {
 //#endregion
 //#region src/analyzer/cross-stack-deps.ts
 function inferCrossStackStackDeps(stacks, opts) {
+	const result = /* @__PURE__ */ new Map();
+	for (const [consumer, producers] of inferCrossStackDepsByStack(stacks, opts)) {
+		const names = result.get(consumer.stackName) ?? /* @__PURE__ */ new Set();
+		for (const producer of producers) if (producer.stackName !== consumer.stackName) names.add(producer.stackName);
+		result.set(consumer.stackName, names);
+	}
+	return result;
+}
+function inferCrossStackDepsByStack(stacks, opts) {
 	const kinds = opts?.kinds ?? ["ImportValue", "GetStackOutput"];
 	const wantImportValue = kinds.includes("ImportValue");
 	const wantGetStackOutput = kinds.includes("GetStackOutput");
-	const exportOwner = /* @__PURE__ */ new Map();
+	const exporters = /* @__PURE__ */ new Map();
 	for (const stack of stacks) {
 		const outputs = stack.template.Outputs;
 		if (!outputs) continue;
 		for (const output of Object.values(outputs)) {
 			const name = output?.Export?.Name;
 			if (typeof name === "string" && name !== "") {
-				if (!exportOwner.has(name)) exportOwner.set(name, stack.stackName);
+				const list = exporters.get(name) ?? [];
+				if (!list.includes(stack)) list.push(stack);
+				exporters.set(name, list);
 			}
 		}
 	}
-	const stackNames = new Set(stacks.map((s) => s.stackName));
+	const preferRegion = (candidates, region) => {
+		const same = candidates.filter((c) => c.region === region);
+		return same.length > 0 ? same : candidates;
+	};
 	const result = /* @__PURE__ */ new Map();
 	for (const stack of stacks) {
 		const producers = /* @__PURE__ */ new Set();
 		collectTemplateCrossStackRefs(stack.template, (kind, value, unconditional) => {
-			let producer;
+			let found = [];
 			if (kind === "ImportValue") {
 				if (!wantImportValue) return;
-				if (typeof value === "string") producer = exportOwner.get(value);
+				if (typeof value === "string") {
+					const owners = (exporters.get(value) ?? []).filter((s) => s !== stack);
+					found = preferRegion(owners, stack.region);
+				}
 			} else {
 				if (opts?.onRoleArnReference && unconditional && value && typeof value === "object" && !Array.isArray(value) && Object.hasOwn(value, "RoleArn")) opts.onRoleArnReference(stack.stackName, value);
 				if (!wantGetStackOutput) return;
 				if (value && typeof value === "object" && !Array.isArray(value)) {
-					const sn = value["StackName"];
-					if (typeof sn === "string") producer = sn;
+					const args = value;
+					const sn = args["StackName"];
+					if (typeof sn === "string") {
+						let named = stacks.filter((s) => s.stackName === sn && s !== stack);
+						const region = args["Region"];
+						if (typeof region === "string") named = named.filter((s) => s.region === region || s.region === void 0);
+						else named = preferRegion(named, stack.region);
+						const sameStage = named.filter((s) => s.stagePath === stack.stagePath);
+						found = sameStage.length > 0 ? sameStage : named;
+					}
 				}
 			}
-			if (producer && producer !== stack.stackName && stackNames.has(producer)) producers.add(producer);
+			for (const producer of found) producers.add(producer);
 		});
-		result.set(stack.stackName, producers);
+		result.set(stack, producers);
 	}
 	return result;
 }
@@ -2560,7 +2718,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CUKmyCQ8.js");
+	providerClasses ??= import("./provider-classes-B52ogqNj.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3184,7 +3342,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			if (topLevel.length === 0) throw new Error(renderAllNoTopLevelStacks(inStages));
 			allLeftOutStageStacks = inStages;
 			targetStacks = topLevel;
-		} else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+		} else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all (top-level stacks; '**' for every stack)`);
 		if (targetStacks.length === 0) {
@@ -3192,42 +3350,39 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			throw new Error(renderNoStackMatch(stackPatterns, allStacks) + (gone.stacks.length > 0 ? `\n${renderStacksNoLongerSelected(gone.patterns, gone.stacks)}` : ""));
 		}
 		const roleArnReferences = [];
-		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks, { onRoleArnReference: (consumer, args) => roleArnReferences.push({
+		const inferredCrossStackDeps = inferCrossStackDepsByStack(allStacks, { onRoleArnReference: (consumer, args) => roleArnReferences.push({
 			consumer,
 			args
 		}) });
 		const producerLookup = producerLookupOver(allStacks);
-		const effectiveStackDeps = (stackName, deps) => {
-			const union = new Set(deps);
-			for (const producer of inferredCrossStackDeps.get(stackName) ?? []) union.add(producer);
-			return union;
-		};
-		const inferredStrongCrossStackDeps = inferCrossStackStackDeps(allStacks, { kinds: ["ImportValue"] });
-		const effectiveStrongStackDeps = (stackName, deps) => {
-			const union = new Set(deps);
-			for (const producer of inferredStrongCrossStackDeps.get(stackName) ?? []) union.add(producer);
-			return union;
+		const dependencyStacks = (stack, inferred, pool) => {
+			const deps = /* @__PURE__ */ new Set();
+			for (const depName of stack.dependencyNames) for (const dep of stacksForDependency(depName, stack, pool)) deps.add(dep);
+			const inPool = new Set(pool);
+			for (const producer of inferred.get(stack) ?? []) if (producer !== stack && inPool.has(producer)) deps.add(producer);
+			return deps;
 		};
+		const inferredStrongCrossStackDeps = inferCrossStackDepsByStack(allStacks, { kinds: ["ImportValue"] });
 		if (!options.exclusively) {
-			const targetNames = new Set(targetStacks.map((s) => s.stackName));
-			const allStackMap = new Map(allStacks.map((s) => [s.stackName, s]));
-			const addDependencies = (stackName) => {
-				const stack = allStackMap.get(stackName);
-				if (!stack) return;
-				for (const depName of effectiveStrongStackDeps(stackName, stack.dependencyNames)) if (!targetNames.has(depName)) {
-					const depStack = allStackMap.get(depName);
-					if (depStack) {
-						targetNames.add(depName);
-						targetStacks.push(depStack);
-						logger.debug(`Auto-including dependency stack: ${depName} (required by ${stackName})`);
-						addDependencies(depName);
-					}
+			const included = new Set(targetStacks);
+			const addDependencies = (stack) => {
+				for (const depStack of dependencyStacks(stack, inferredStrongCrossStackDeps, allStacks)) {
+					if (included.has(depStack)) continue;
+					included.add(depStack);
+					targetStacks.push(depStack);
+					logger.debug(`Auto-including dependency stack: ${depStack.stackName} (required by ${stack.stackName})`);
+					addDependencies(depStack);
 				}
 			};
-			for (const stack of [...targetStacks]) addDependencies(stack.stackName);
+			for (const stack of [...targetStacks]) addDependencies(stack);
 		}
+		const selectedNames = new Set(targetStacks.map((s) => s.stackName));
+		const selectedSet = new Set(targetStacks);
+		const sameNamedAppStacks = allStacks.filter((s) => selectedSet.has(s) || selectedNames.has(s.stackName) && s.region !== void 0);
+		refuseStackNameRegionCollisions(sameNamedAppStacks, (s) => s.region, selectedSet);
+		const deployedStacks = new Set(targetStacks);
 		const deployedNames = new Set(targetStacks.map((s) => s.stackName));
-		const leftOut = allLeftOutStageStacks.filter((s) => !deployedNames.has(s.stackName));
+		const leftOut = allLeftOutStageStacks.filter((s) => !deployedStacks.has(s));
 		if (leftOut.length > 0) logger.warn(renderAllLeftOutStageStacks(leftOut));
 		if (!options.all && stackPatterns.length > 0) {
 			const gone = stacksNoLongerSelected(allStacks, stackPatterns, deployedNames);
@@ -3252,7 +3407,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			logger,
 			siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
 		});
-		const stackRegions = new Map(await Promise.all(targetStacks.map(async (s) => [s.stackName, await regionForStack(s.stackName, s.region)])));
+		const stackRegions = new Map(await Promise.all(targetStacks.map(async (s) => [s, await regionForStack(s.stackName, s.region)])));
+		refuseStackNameRegionCollisions(sameNamedAppStacks, (s) => stackRegions.get(s) ?? s.region, selectedSet);
 		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -3284,13 +3440,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		const dagBuilder = new DagBuilder({ relaxCdkVpcDefensiveDeps: !!options.aggressiveVpcParallel });
 		const diffCalculator = new DiffCalculator();
 		const workGraph = new WorkGraph();
-		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
+		const sharedNames = new Set(targetStacks.map((s) => s.stackName).filter((name, i, names) => names.indexOf(name) !== i));
+		const graphKey = (s) => sharedNames.has(s.stackName) ? `${s.stackName}@${stackRegions.get(s) ?? deployStackRegion(s, baseRegion)}` : s.stackName;
 		const stackRedirects = /* @__PURE__ */ new Map();
 		for (const stack of targetStacks) {
-			const stackNodeId = `stack:${stack.stackName}`;
+			const stackNodeId = `stack:${graphKey(stack)}`;
 			const stackDeps = /* @__PURE__ */ new Set();
 			if (stack.assetManifestPath) {
-				const assetRegion = stackRegions.get(stack.stackName) ?? deployStackRegion(stack, baseRegion);
+				const assetRegion = stackRegions.get(stack) ?? deployStackRegion(stack, baseRegion);
 				const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
 				if (manifest) {
 					const assetMode = await assetModeResolver.resolve(stack.region || rawNamedRegion || assetRegion);
@@ -3299,7 +3456,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					if (assetMode.mode === "cdkd-assets") {
 						redirect = buildAssetRedirectMap(manifest, assetMode.marker, accountId, assetRegion);
 						if (redirect.entries.length > 0) {
-							stackRedirects.set(stack.stackName, redirect);
+							stackRedirects.set(stack, redirect);
 							const rewritten = rewriteTemplateAssetReferences(stack.template, redirect);
 							logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage (${assetMode.marker.assetBucket} / ${assetMode.marker.containerRepo}) in template of stack ${stack.stackName}`);
 						} else redirect = void 0;
@@ -3309,7 +3466,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 							accountId,
 							region: assetRegion,
 							...options.profile && { profile: options.profile },
-							nodePrefix: `${stack.stackName}:`,
+							nodePrefix: `${graphKey(stack)}:`,
 							...redirect && { redirect },
 							...stack.assetOutdir !== void 0 && { assetOutdir: stack.assetOutdir }
 						});
@@ -3317,7 +3474,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					}
 				}
 			}
-			for (const depName of effectiveStackDeps(stack.stackName, stack.dependencyNames)) if (stackMap.has(depName)) stackDeps.add(`stack:${depName}`);
+			for (const depStack of dependencyStacks(stack, inferredCrossStackDeps, targetStacks)) stackDeps.add(`stack:${graphKey(depStack)}`);
 			workGraph.addNode({
 				id: stackNodeId,
 				type: "stack",
@@ -3337,7 +3494,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const runStackInner = async (stackInfo) => {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
-			const stackRegion = stackRegions.get(stackInfo.stackName) ?? deployStackRegion(stackInfo, baseRegion);
+			const stackRegion = stackRegions.get(stackInfo) ?? deployStackRegion(stackInfo, baseRegion);
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
@@ -3453,7 +3610,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						})) return;
 					}
 				}
-				const assetRedirect = stackRedirects.get(stackInfo.stackName);
+				const assetRedirect = stackRedirects.get(stackInfo);
 				const deployEngineOptions = {
 					concurrency: options.concurrency,
 					dryRun: options.dryRun,
@@ -6142,7 +6299,7 @@ async function diffCommand(stacks, options) {
 			if (topLevel.length === 0) throw new Error(renderAllNoTopLevelStacks(inStages));
 			if (inStages.length > 0) logger.info(renderAllLeftOutStageStacks(inStages));
 			targetStacks = topLevel;
-		} else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+		} else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all (top-level stacks; '**' for every stack)`);
 		if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
@@ -6238,8 +6395,10 @@ async function diffCommand(stacks, options) {
 		});
 		const trees = [];
 		const producerLookup = producerLookupOver(allStacks);
+		const sharedNames = new Set(targetStacks.map((s) => s.stackName).filter((name, i, names) => names.indexOf(name) !== i));
 		for (const stackInfo of targetStacks) {
-			logger.info(`\nCalculating diff for stack: ${stackInfo.stackName}`);
+			const shownName = sharedNames.has(stackInfo.stackName) ? describeStack(stackInfo) : stackInfo.stackName;
+			logger.info(`\nCalculating diff for stack: ${shownName}`);
 			const stackRegion = await regionForStack(stackInfo.stackName, stackInfo.region);
 			const assetRedirect = await resolveAssetRedirect(stackInfo.assetManifestPath, stackRegion);
 			if (assetRedirect) {
@@ -6248,7 +6407,7 @@ async function diffCommand(stacks, options) {
 			}
 			trees.push(await buildDiffTree({
 				stackName: stackInfo.stackName,
-				displayName: stackInfo.stackName,
+				displayName: shownName,
 				region: stackRegion,
 				template: stackInfo.template,
 				nestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
@@ -6723,7 +6882,7 @@ async function scrubCommand(stacks, options) {
 	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
 	let targetStacks;
 	if (options.all) targetStacks = allStacks;
-	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
 	else if (allStacks.length === 1) targetStacks = allStacks;
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 	if (targetStacks.length === 0) {
@@ -6805,10 +6964,10 @@ async function scrubCommand(stacks, options) {
 		logger,
 		siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
 	});
-	const stackRegions = new Map(await Promise.all(targetStacks.map(async (stack) => [stack.stackName, await regionForStack(stack.stackName, stack.region)])));
+	const stackRegions = new Map(await Promise.all(targetStacks.map(async (stack) => [stack, await regionForStack(stack.stackName, stack.region)])));
 	const work = targetStacks.map((stack) => ({
 		stackName: stack.stackName,
-		region: stackRegions.get(stack.stackName) ?? region,
+		region: stackRegions.get(stack) ?? region,
 		load: () => {
 			const defect = stack.nestedTemplates ? findNestedTemplateTreeDefect(stack.nestedTemplates) : void 0;
 			if (defect) throw new ScrubRefusalError(renderNestedTemplateTreeDefect(defect, stack.stackName, "scrub it or any stack nested under it; no state was written"), "SCRUB_NESTED_TEMPLATE_TREE_MALFORMED");
@@ -6910,8 +7069,9 @@ async function scrubCommand(stacks, options) {
 			const parentName = item.parentRow.stackName;
 			const row = `${displayStackName(parentName)} (row ${displayIdent(item.parentRow.logicalId)})`;
 			if (repaired.changed > 0) {
-				if (!rewrittenStacks.has(parentName)) totalStacksScrubbed++;
-				rewrittenStacks.add(parentName);
+				const parentKey = producerRecordKey(parentName, stackRegion);
+				if (!rewrittenStacks.has(parentKey)) totalStacksScrubbed++;
+				rewrittenStacks.add(parentKey);
 				logger.info(safeMsg`${options.dryRun ? "Would scrub" : "Scrubbed"} ${repaired.changed} nested-stack output attribute(s) in ${row}, from ${shownStack}'s outputs`);
 			}
 			if (repaired.unmatched.length > 0) {
@@ -6923,10 +7083,11 @@ async function scrubCommand(stacks, options) {
 			if (!failures.some((f) => f.stackName === label)) failures.push({ stackName: label });
 			logger.error(safeMsg`Scrub of ${displayStackName(item.parentRow.stackName)}'s nested-stack output attributes for ${shownStack} failed: ${describeFailure(err)}`);
 		}
-		if (scrubbed.historyPurged) historyPurgedStacks.add(stackName);
+		const recordKey = producerRecordKey(stackName, stackRegion);
+		if (scrubbed.historyPurged) historyPurgedStacks.add(recordKey);
 		if (scrubbed.recordsChanged > 0) {
-			if (!rewrittenStacks.has(stackName)) totalStacksScrubbed++;
-			rewrittenStacks.add(stackName);
+			if (!rewrittenStacks.has(recordKey)) totalStacksScrubbed++;
+			rewrittenStacks.add(recordKey);
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${shownStack}`);
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && scrubbed.unrepairedReadNames === 0 && (scrubbed.keptReadOutputKeys ?? 0) === 0 && (scrubbed.keptAliasOutputKeys ?? 0) === 0 && !scrubbed.droppedOutputReadersUnverified && indexAbsentWithSecret === 0 && indexConverged === 0) logger.info(scrubbed.nestedChildren.some((child) => Boolean(child.input)) ? `No plaintext secrets found in ${shownStack}'s own records${SCRUB_CLEAN_SCOPE_NOTE}; its nested-stack output attributes are checked after each nested stack` : `No plaintext secrets found in ${shownStack}${SCRUB_CLEAN_SCOPE_NOTE}`);
 		if (scrubbed.malformedResources || scrubbed.malformedResourceRows) malformedRecords.push(stackName);
@@ -9277,7 +9438,6 @@ function canonicalizeIpProtocols(baseline, aws, resourceType) {
 //#region src/analyzer/drift-cc-api-deny-list.ts
 const CC_API_FALLBACK_DENY_LIST = {
 	"AWS::ApiGateway::RestApi": "Body / BodyS3Location are write-only inputs not returned by CC API GetResource; cdkd state preserves them",
-	"AWS::Budgets::Budget": "CC API GetResource reorders notification subscribers and adds the defaulted ThresholdType, so an unchanged budget diffs as drift",
 	"AWS::CloudFormation::Stack": "cdkd deploys nested stacks itself: no CloudFormation stack exists, and the physicalId is a cdkd-local placeholder ARN",
 	"AWS::CloudWatch::AnomalyDetector": "the physicalId is a cdkd-derived metric descriptor, not the primaryIdentifier Cloud Control's GetResource requires",
 	"AWS::EMR::InstanceFleetConfig": "the physicalId is the bare fleet id, not the composite primaryIdentifier Cloud Control's GetResource requires",
@@ -12892,6 +13052,7 @@ async function destroyCommand(stackArgs, options) {
 				displayName: s.displayName,
 				...s.stagePath !== void 0 && { stagePath: s.stagePath },
 				...s.region && { region: s.region },
+				...s.account && { account: s.account },
 				...s.terminationProtection !== void 0 && { terminationProtection: s.terminationProtection },
 				template: s.template,
 				...s.nestedTemplates !== void 0 && { nestedTemplates: s.nestedTemplates }
@@ -12946,18 +13107,23 @@ async function destroyCommand(stackArgs, options) {
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stoppedEarly = false;
-		let stackNames;
+		const appStackSet = new Set(appStacks);
+		const toTarget = (s) => ({
+			stackName: s.stackName,
+			synth: appStackSet.has(s) ? s : void 0
+		});
+		let targets;
 		const namesAppStack = /* @__PURE__ */ new Set();
 		if (options.all) {
 			const { topLevel, inStages } = partitionTopLevel(candidateStacks);
 			if (inStages.length > 0) logger.warn(renderAllLeftOutStageStacks(inStages));
-			stackNames = topLevel.map((s) => s.stackName);
+			targets = topLevel.map(toTarget);
 		} else if (stackPatterns.length > 0) {
 			const selectFrom = appStacks.length > 0 ? appStacks : candidateStacks;
 			const inState = new Set(candidateStacks.map((s) => s.stackName));
-			stackNames = matchStacks(selectFrom, stackPatterns).map((s) => s.stackName).filter((n) => inState.has(n));
+			targets = matchStacks(selectFrom, stackPatterns, { dedupe: "identity" }).filter((s) => inState.has(s.stackName)).map(toTarget);
 			if (appStacks.length > 0) {
-				const gone = stacksNoLongerSelected(candidateStacks, stackPatterns, new Set(stackNames));
+				const gone = stacksNoLongerSelected(candidateStacks, stackPatterns, new Set(targets.map((t) => t.stackName)));
 				if (gone.stacks.length > 0) logger.warn(renderStacksNoLongerSelected(gone.patterns, gone.stacks));
 			}
 			const stateNames = new Set(allStateRefs.map((r) => r.stackName));
@@ -12968,13 +13134,13 @@ async function destroyCommand(stackArgs, options) {
 			const inStateOnly = unmatched.filter((p) => stateNames.has(p) && !namesAppStack.has(p));
 			const absent = unmatched.filter((p) => !inStateOnly.includes(p));
 			if (absent.length > 0) logger.warn(renderUnmatchedPatternsWarning(absent, "in state"));
-			if (stackNames.length > 0 && inStateOnly.length > 0) logger.warn(renderNotInAppWarning(inStateOnly));
-		} else if (candidateStacks.length === 1) stackNames = candidateStacks.map((s) => s.stackName);
+			if (targets.length > 0 && inStateOnly.length > 0) logger.warn(renderNotInAppWarning(inStateOnly));
+		} else if (candidateStacks.length === 1) targets = candidateStacks.map(toTarget);
 		else if (candidateStacks.length === 0) {
 			logger.info("No stacks found in state");
 			return;
 		} else throw new Error(`Multiple stacks found: ${candidateStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all (top-level stacks; '**' for every stack)`);
-		if (stackNames.length === 0) {
+		if (targets.length === 0) {
 			if (stackPatterns.length > 0) {
 				const allStateNamesSet = new Set(allStateRefs.map((r) => r.stackName));
 				const notInApp = [];
@@ -12996,12 +13162,22 @@ async function destroyCommand(stackArgs, options) {
 			logger.info("No matching stacks found in state");
 			return;
 		}
-		if (synthScanStacks.length > 0 && stackNames.length > 1) {
-			const inSet = new Set(stackNames);
-			const inferred = inferCrossStackStackDeps(synthScanStacks.filter((s) => inSet.has(s.stackName)));
-			stackNames = orderConsumersBeforeProducers(stackNames, inferred);
-		}
-		logger.info(`Found ${stackNames.length} stack(s) to destroy: ${stackNames.map((n) => displaySafe(n)).join(", ")}`);
+		const uniqueNames = [...new Set(targets.map((t) => t.stackName))];
+		if (synthScanStacks.length > 0 && uniqueNames.length > 1) {
+			const inSet = new Set(uniqueNames);
+			targets = orderConsumersBeforeProducers(uniqueNames, inferCrossStackStackDeps(synthScanStacks.filter((s) => inSet.has(s.stackName)))).flatMap((name) => targets.filter((t) => t.stackName === name));
+		}
+		const sharedAppNames = new Set(appStacks.map((s) => s.stackName).filter((name, i, names) => names.indexOf(name) !== i));
+		const strictRegion = /* @__PURE__ */ new Map();
+		for (const target of targets) {
+			if (!sharedAppNames.has(target.stackName) || target.synth === void 0) continue;
+			strictRegion.set(target, target.synth.region ?? await regionForStack(target.stackName));
+		}
+		const strictBySynth = new Map(targets.flatMap((t) => t.synth !== void 0 && strictRegion.has(t) ? [[t.synth, strictRegion.get(t)]] : []));
+		const strictNames = new Set([...strictBySynth.keys()].map((s) => s.stackName));
+		refuseStackNameRegionCollisions(appStacks.filter((s) => strictBySynth.has(s) || strictNames.has(s.stackName) && s.region !== void 0), (s) => strictBySynth.get(s) ?? s.region, new Set(strictBySynth.keys()));
+		const describeTarget = (t) => t.synth !== void 0 && strictRegion.has(t) ? `${describeStack(t.synth)} in ${displaySafe(strictRegion.get(t))}` : displaySafe(t.stackName);
+		logger.info(`Found ${targets.length} stack(s) to destroy: ${targets.map(describeTarget).join(", ")}`);
 		const accountId = "unknown";
 		const stateRefsByName = /* @__PURE__ */ new Map();
 		for (const ref of allStateRefs) {
@@ -13010,20 +13186,46 @@ async function destroyCommand(stackArgs, options) {
 			stateRefsByName.set(ref.stackName, arr);
 		}
 		const crossPrefixCheck = { cache: new CrossPrefixGuard(stateBackend) };
-		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		if (targets.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
 		const fallbackRegionByName = /* @__PURE__ */ new Map();
-		for (const name of stackNames) if ((stateRefsByName.get(name) ?? []).some((r) => !r.region)) fallbackRegionByName.set(name, await regionForStack(name));
-		for (const name of stackNames) {
-			const synth = appStacks.find((s) => s.stackName === name);
-			if (synth?.terminationProtection === true && !options.removeProtection) continue;
-			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, fallbackRegionByName.get(name) ?? region);
-			if (planned !== void 0) crossPrefixCheck.cache.full(name, planned, "prestart");
+		for (const name of uniqueNames) if ((stateRefsByName.get(name) ?? []).some((r) => !r.region)) fallbackRegionByName.set(name, await regionForStack(name));
+		const wrongAccount = /* @__PURE__ */ new Set();
+		let callerAccountUnreadable = false;
+		const accountPinned = [...strictRegion.keys()].filter((t) => t.synth?.account !== void 0);
+		if (accountPinned.length > 0) {
+			let callerAccount;
+			callerAccountUnreadable = true;
+			try {
+				const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+				callerAccount = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+				callerAccountUnreadable = callerAccount === void 0;
+			} catch (err) {
+				logger.debug(safeMsg`Could not read the caller account: ${describeAwsFailure(err).detail}`);
+			}
+			for (const t of accountPinned) if (t.synth.account !== callerAccount) wrongAccount.add(t);
 		}
-		for (const [stackIndex, stackName] of stackNames.entries()) {
-			logger.info(`\nPreparing to destroy stack: ${displaySafe(stackName)}`);
+		const plannedRegionFor = (target) => {
+			if (wrongAccount.has(target)) return void 0;
+			const refs = stateRefsByName.get(target.stackName) ?? [];
+			const strict = strictRegion.get(target);
+			if (strict !== void 0) return refs.some((r) => r.region === strict) ? strict : void 0;
+			return plannedDestroyRegion(refs, target.synth?.region, fallbackRegionByName.get(target.stackName) ?? region);
+		};
+		for (const target of targets) {
+			if (target.synth?.terminationProtection === true && !options.removeProtection) continue;
+			const planned = plannedRegionFor(target);
+			if (planned !== void 0) crossPrefixCheck.cache.full(target.stackName, planned, "prestart");
+		}
+		for (const [stackIndex, target] of targets.entries()) {
+			const stackName = target.stackName;
+			logger.info(`\nPreparing to destroy stack: ${describeTarget(target)}`);
+			if (wrongAccount.has(target)) {
+				logger.error(callerAccountUnreadable ? safeMsg`  ✗ Stack ${describeTarget(target)} is pinned to account ${target.synth.account}, and the account this run's credentials resolve to could not be read (STS GetCallerIdentity failed), so it was not destroyed: another stack of the app shares its name, and only that account's credentials address its record. Check the credentials (aws sts get-caller-identity) and re-run destroy.` : safeMsg`  ✗ Stack ${describeTarget(target)} is pinned to account ${target.synth.account}, which is not the account this run's credentials resolve to; not destroyed. Run destroy with that account's credentials.`);
+				totalErrors++;
+				continue;
+			}
 			const refs = stateRefsByName.get(stackName) ?? [];
-			const synthStack = appStacks.find((s) => s.stackName === stackName);
-			const synthRegion = synthStack?.region;
+			const synthStack = target.synth;
 			if (synthStack?.terminationProtection === true) {
 				if (options.removeProtection) logger.warn(`Stack ${displaySafe(stackName)} has terminationProtection: true — bypassing because --remove-protection set`);
 				else {
@@ -13036,11 +13238,15 @@ async function destroyCommand(stackArgs, options) {
 					continue;
 				}
 			}
-			const plannedRegion = plannedDestroyRegion(refs, synthRegion, fallbackRegionByName.get(stackName) ?? region);
+			const plannedRegion = plannedRegionFor(target);
+			const strict = strictRegion.get(target);
 			let stackTargetRegion;
 			if (refs.length === 0) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
 				continue;
+			} else if (strict !== void 0 && plannedRegion === void 0) {
+				logger.warn(safeMsg`No state found for stack ${describeTarget(target)}, skipping`);
+				continue;
 			} else if (plannedRegion !== void 0) stackTargetRegion = plannedRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
@@ -13167,7 +13373,7 @@ async function destroyCommand(stackArgs, options) {
 				interrupted: stackInterrupted || stackCancelled
 			}, logger);
 			if (runInterrupted()) {
-				if (stackIndex < stackNames.length - 1) stoppedEarly = true;
+				if (stackIndex < targets.length - 1) stoppedEarly = true;
 				break;
 			}
 		}
@@ -13402,60 +13608,6 @@ function mixedLeafSsmTokens(source) {
 	return tokens;
 }
 
-//#endregion
-//#region src/cli/cdk-path.ts
-function readCdkPath(resource) {
-	const meta = resource.Metadata;
-	if (!meta) return "";
-	const v = meta["aws:cdk:path"];
-	return typeof v === "string" ? v : "";
-}
-function readCdkPathOrUndefined(resource) {
-	const path = readCdkPath(resource);
-	return path === "" ? void 0 : path;
-}
-function buildCdkPathIndex(template) {
-	const index = /* @__PURE__ */ new Map();
-	for (const [logicalId, resource] of Object.entries(template.Resources)) {
-		if (resource.Type === "AWS::CDK::Metadata") continue;
-		const path = readCdkPath(resource);
-		if (path) index.set(path, logicalId);
-	}
-	return index;
-}
-function resolveCdkPathToLogicalIds(input, index) {
-	const seen = /* @__PURE__ */ new Map();
-	const prefix = `${input}/`;
-	for (const [path, logicalId] of index) if (path === input || path.startsWith(prefix)) {
-		if (!seen.has(logicalId)) seen.set(logicalId, path);
-	}
-	return [...seen.entries()].map(([logicalId, cdkPath]) => ({
-		logicalId,
-		cdkPath
-	}));
-}
-function stackForConstructPath(path, stacks) {
-	let best;
-	let bestRank = -1;
-	for (const s of stacks) {
-		const names = [[s.displayName, 1], [s.stackName, 0]];
-		for (const [name, preference] of names) {
-			if (typeof name !== "string" || name.length === 0) continue;
-			if (!path.startsWith(`${name}/`)) continue;
-			const rank = name.length * 2 + preference;
-			if (rank > bestRank) {
-				best = s;
-				bestRank = rank;
-			}
-		}
-	}
-	return best;
-}
-function stackForPathFormTarget(parsed, target, stacks) {
-	if (!parsed.isPath || parsed.pathOrId !== target) return void 0;
-	return stackForConstructPath(parsed.pathOrId, stacks);
-}
-
 //#endregion
 //#region src/analyzer/orphan-rewriter.ts
 const UNREADABLE_ORPHAN_RECORD_REASON = "the orphaned resource's state record is not a readable resource record (not an object, no resource type, or no physical id), so nothing in it can be substituted";
@@ -20724,7 +20876,7 @@ async function publishAssetsCommand(stacks, options) {
 	let targetStacks;
 	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
 	if (options.all) targetStacks = allStacks;
-	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
 	else if (allStacks.length === 1) targetStacks = allStacks;
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
@@ -22840,16 +22992,13 @@ function resolveLambdaTarget(target, stacks) {
 	return extractLambdaProperties(stack, logicalId, resource, resources);
 }
 function pickStack$1(parsed, stacks, target) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new LocalInvokeResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new LocalInvokeResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map(describeStack).join(", ")}.`);
+		case "not-found": throw new LocalInvokeResolutionError(`Stack '${selection.pattern}' not found. Available stacks: ${stacks.map(describeStack).join(", ")}.`);
+		case "ambiguous": throw new LocalInvokeResolutionError(renderAmbiguousTargetStack(selection.pattern, selection.matched));
 	}
-	const byPrefix = stackForPathFormTarget(parsed, target, stacks);
-	if (byPrefix) return byPrefix;
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new LocalInvokeResolutionError(`Stack '${parsed.stackPattern}' not found. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new LocalInvokeResolutionError(`Stack pattern '${parsed.stackPattern}' matched ${matched.length} stacks: ` + matched.map((s) => s.stackName).join(", ") + ". Use a more specific pattern.");
-	return matched[0];
 }
 function extractLambdaProperties(stack, logicalId, resource, resources) {
 	const props = resource.Properties ?? {};
@@ -23353,16 +23502,13 @@ function resolveEcsTaskTarget(target, stacks, context) {
 	return extractTaskDefinitionProperties(stack, logicalId, resource, context);
 }
 function pickStack(parsed, stacks, target) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new EcsTaskResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new EcsTaskResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map(describeStack).join(", ")}.`);
+		case "not-found": throw new EcsTaskResolutionError(`Stack '${selection.pattern}' not found. Available stacks: ${stacks.map(describeStack).join(", ")}.`);
+		case "ambiguous": throw new EcsTaskResolutionError(renderAmbiguousTargetStack(selection.pattern, selection.matched));
 	}
-	const byPrefix = stackForPathFormTarget(parsed, target, stacks);
-	if (byPrefix) return byPrefix;
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new EcsTaskResolutionError(`Stack '${parsed.stackPattern}' not found. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new EcsTaskResolutionError(`Stack pattern '${parsed.stackPattern}' matched ${matched.length} stacks: ` + matched.map((s) => s.stackName).join(", ") + ". Use a more specific pattern.");
-	return matched[0];
 }
 function extractTaskDefinitionProperties(stack, logicalId, resource, context) {
 	const props = resource.Properties ?? {};
@@ -25213,7 +25359,7 @@ async function localStartApiCommand(target, options) {
 	const layerTmpDirs = /* @__PURE__ */ new Set();
 	let profileCredsFile;
 	let credsHostPath;
-	const authorizerCache = createAuthorizerCache();
+	const authorizerCaches = /* @__PURE__ */ new Map();
 	const jwksCache = createJwksCache();
 	const jwksWarnedAt = /* @__PURE__ */ new Map();
 	let sigV4CredentialsLoader;
@@ -25246,23 +25392,11 @@ async function localStartApiCommand(target, options) {
 		if (wsDiscovery.errors.length > 0) for (const e of wsDiscovery.errors) logger.warn(`WebSocket discovery: ${e}`);
 		const webSocketApis = wsDiscovery.apis;
 		if (routes.length === 0 && webSocketApis.length === 0) throw new Error("No supported API routes were discovered. cdkd local start-api supports AWS::ApiGateway::* (REST v1), AWS::ApiGatewayV2::* (HTTP + WebSocket), and AWS::Lambda::Url (Function URL) with AWS_PROXY integrations only.");
-		const stageMap = /* @__PURE__ */ new Map();
-		for (const stack of targetStacks) {
-			const m = buildStageMap(stack.template, options.stage);
-			for (const [k, v] of m) stageMap.set(k, v);
-		}
-		if (options.stage) {
-			const missingApis = /* @__PURE__ */ new Set();
-			for (const r of routes) {
-				if (!r.apiLogicalId) continue;
-				if (!stageMap.has(r.apiLogicalId)) missingApis.add(r.apiLogicalId);
-			}
-			for (const apiId of missingApis) logger.warn(`--stage '${options.stage}' did not match any Stage on API '${apiId}'; routes on that API will get stageVariables: null.`);
-		}
-		attachStageContext(routes, stageMap);
+		const missingApis = attachStageContextPerStack(targetStacks, routes, options.stage);
+		for (const apiId of missingApis) logger.warn(`--stage '${options.stage}' did not match any Stage on API '${apiId}'; routes on that API will get stageVariables: null.`);
 		let routesWithAuth = attachAuthorizers(targetStacks, routes);
 		if (apiFilter !== void 0) {
-			if (!apiFilter.includes(":") && !apiFilter.includes("/") && targetStacks.length > 1) throw new Error(`Multiple stacks in app, target '${apiFilter}' is missing a stack prefix. Use 'StackName:${apiFilter}' or 'StackName/${apiFilter}' (Construct path form). Available stacks: ${targetStacks.map((s) => s.stackName).join(", ")}.`);
+			if (!apiFilter.includes(":") && !apiFilter.includes("/") && targetStacks.length > 1) throw new Error(`Multiple stacks in app, target '${apiFilter}' is missing a stack prefix. Use 'StackName:${apiFilter}' or 'StackName/${apiFilter}' (Construct path form). Available stacks: ${targetStacks.map(describeStack).join(", ")}.`);
 			const filtered = filterRoutesByApiIdentifier(routesWithAuth, apiFilter);
 			if (filtered.length === 0) {
 				const available = availableApiIdentifiers(routesWithAuth).join(", ") || "(none)";
@@ -25270,13 +25404,11 @@ async function localStartApiCommand(target, options) {
 			}
 			routesWithAuth = filtered;
 		}
-		const corsConfigByApiId = /* @__PURE__ */ new Map();
-		for (const stack of targetStacks) {
-			const fromCloudFront = buildCorsConfigFromCloudFrontChain(stack.template);
-			for (const [k, v] of fromCloudFront) corsConfigByApiId.set(k, v);
-			const direct = buildCorsConfigByApiId(stack.template);
-			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
-		}
+		assertServedLogicalIdsUnambiguous(targetStacks, routes, routesWithAuth, webSocketApis, {
+			...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+			...overrides !== void 0 && { overrides }
+		});
+		const corsConfigByStack = buildCorsConfigByStack(targetStacks);
 		const stateByStack = options.fromState || isCfnFlagPresent(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials, {
@@ -25287,36 +25419,30 @@ async function localStartApiCommand(target, options) {
 				credsHostPath = void 0;
 			}
 		});
-		const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
-		const specs = /* @__PURE__ */ new Map();
-		for (let i = 0; i < lambdaIds.length; i++) {
-			const logicalId = lambdaIds[i];
-			const spec = await buildContainerSpec({
-				logicalId,
-				stacks: targetStacks,
-				overrides,
-				assumeRole: options.assumeRole,
-				containerHost: options.containerHost,
-				...debugPortBase !== void 0 && { debugPort: debugPortBase + i },
-				stsRegion: canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]),
-				inlineTmpDirs,
-				layerTmpDirs,
-				stateByStack,
-				skipPull: options.pull === false,
-				...options.layerRoleArn !== void 0 && { layerRoleArn: options.layerRoleArn },
-				...profileCredentials && { profileCredentials },
-				...profileCredsFile && { profileCredsFile },
-				...dynamicReferenceSpecOptions(options)
-			});
-			specs.set(logicalId, spec);
-		}
+		const specs = await buildServedLambdaSpecs(targetStacks, routes, routesWithAuth, webSocketApis, ({ logicalId, stacks, index }) => buildContainerSpec({
+			logicalId,
+			stacks,
+			overrides,
+			assumeRole: options.assumeRole,
+			containerHost: options.containerHost,
+			...debugPortBase !== void 0 && { debugPort: debugPortBase + index },
+			stsRegion: canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]),
+			inlineTmpDirs,
+			layerTmpDirs,
+			stateByStack,
+			skipPull: options.pull === false,
+			...options.layerRoleArn !== void 0 && { layerRoleArn: options.layerRoleArn },
+			...profileCredentials && { profileCredentials },
+			...profileCredsFile && { profileCredsFile },
+			...dynamicReferenceSpecOptions(options)
+		}));
 		const distinctImages = /* @__PURE__ */ new Set();
 		for (const spec of specs.values()) if (spec.kind === "zip") distinctImages.add(resolveRuntimeImage(spec.lambda.runtime));
 		for (const image of distinctImages) await pullImage(image, options.pull === false);
 		return {
 			routes: routesWithAuth,
 			specs,
-			corsConfigByApiId,
+			corsConfigByStack,
 			webSocketApis,
 			stacks: targetStacks
 		};
@@ -25335,7 +25461,7 @@ async function localStartApiCommand(target, options) {
 	};
 	const initialMaterial = await synthesizeAndBuild();
 	await prewarmJwks(initialMaterial.routes, jwksCache);
-	warnVpcConfigLambdas(initialMaterial.routes, initialMaterial.stacks ?? []);
+	warnVpcConfigLambdas(initialMaterial.routes, initialMaterial.stacks);
 	sigV4CredentialsLoader = defaultCredentialsLoader();
 	warnIamRoutes(initialMaterial.routes);
 	let maxTimeoutSec = 0;
@@ -25349,12 +25475,12 @@ async function localStartApiCommand(target, options) {
 	const servers = [];
 	let nextPort = basePort;
 	for (const group of initialGroups) {
-		const groupSpecs = filterSpecsForGroup(group, initialMaterial.specs);
+		const groupSpecs = filterSpecsForGroup(group, initialMaterial);
 		const groupPool = buildPool(groupSpecs);
 		const groupState = {
 			routes: group.routes,
 			pool: groupPool,
-			corsConfigByApiId: initialMaterial.corsConfigByApiId
+			corsConfigByApiId: corsConfigForGroup(group, initialMaterial)
 		};
 		if (options.warm) {
 			logger.info(`Pre-warming ${groupSpecs.size} container(s) for ${group.displayName}...`);
@@ -25369,7 +25495,7 @@ async function localStartApiCommand(target, options) {
 			host: options.host,
 			...mtlsConfig && { mtls: mtlsConfig },
 			port: basePort === 0 ? 0 : nextPort,
-			authorizerCache,
+			authorizerCache: perStack(authorizerCaches, groupStackName(group, initialMaterial.stacks), createAuthorizerCache),
 			jwksCache,
 			jwksWarnedAt,
 			sigV4CredentialsLoader,
@@ -25393,12 +25519,7 @@ async function localStartApiCommand(target, options) {
 	}
 	for (const api of initialWsApis) {
 		if (api.unsupported) continue;
-		const wsLambdaIds = new Set(api.routes.map((r) => r.targetLambdaLogicalId));
-		const wsSpecs = /* @__PURE__ */ new Map();
-		for (const id of wsLambdaIds) {
-			const spec = initialMaterial.specs.get(id);
-			if (spec) wsSpecs.set(id, spec);
-		}
+		const wsSpecs = filterSpecsForWebSocketApi(api, initialMaterial);
 		if (wsSpecs.size === 0) {
 			logger.warn(`WebSocket API ${api.declaredAt}: no resolvable Lambda backing routes; skipping.`);
 			continue;
@@ -25416,7 +25537,7 @@ async function localStartApiCommand(target, options) {
 			rieTimeoutMs,
 			host: options.host,
 			port: basePort === 0 ? 0 : nextPort,
-			authorizerCache,
+			authorizerCache: perStack(authorizerCaches, api.apiStackName, createAuthorizerCache),
 			jwksCache,
 			jwksWarnedAt,
 			sigV4WarnedForeignIds,
@@ -25441,9 +25562,7 @@ async function localStartApiCommand(target, options) {
 			host: "host.docker.internal",
 			ip: "host-gateway"
 		}];
-		for (const id of wsLambdaIds) {
-			const spec = initialMaterial.specs.get(id);
-			if (!spec) continue;
+		for (const spec of wsSpecs.values()) {
 			spec.env["AWS_ENDPOINT_URL_APIGATEWAYMANAGEMENTAPI"] = mgmtEndpoint;
 			if (!spec.env["AWS_ACCESS_KEY_ID"]) {
 				spec.env["AWS_ACCESS_KEY_ID"] = "AKIAIOSFODNN7EXAMPLE";
@@ -25609,12 +25728,14 @@ function installFatalShutdownHandlers(logger, shutdown) {
 }
 function targetStackHint(target, stacks) {
 	if (target?.includes("/") !== true) return void 0;
-	return stackForConstructPath(target, stacks) ?? target.slice(0, target.indexOf("/"));
+	const stack = stackForConstructPath(target, stacks);
+	if (stack === void 0) return target.slice(0, target.indexOf("/"));
+	return stackForConstructPath(target, [...stacks].reverse()) === stack ? stack : stack.stackName;
 }
 function pickTargetStacks(stacks, pattern, cfnStackFallback, targetFallback) {
 	const effective = pattern ?? cfnStackFallback ?? targetFallback;
 	if (effective !== void 0 && typeof effective !== "string") return [effective];
-	if (effective) return matchStacks(stacks, [effective]);
+	if (effective) return matchStacks(stacks, [effective], { dedupe: "identity" });
 	if (stacks.length === 1) return stacks;
 	if (stacks.length === 0) return [];
 	throw new Error(`Multi-stack app: pass --stack '<name>', --from-cfn-stack '<name>', or a stack-qualified target like "<StackName>/<construct>" to pick a target. Available stacks: ${stacks.map((s) => plainOrDescribed(s.stackName, "stack name")).join(", ")}.`);
@@ -25633,32 +25754,110 @@ function tryEmitFromCfnRedundancyTipOnce(fromCfnStack, routedStackNames, emitted
 	emit(routedStackName);
 	emittedRef.value = true;
 }
-function uniqueLambdaIds(routes, routesWithAuth, webSocketApis = []) {
+const LAMBDA_FUNCTION_TYPE = "AWS::Lambda::Function";
+function stacksDeclaring(logicalId, stacks, type) {
+	return stacks.filter((stack) => {
+		const resource = stack.template.Resources?.[logicalId];
+		return resource !== void 0 && (type === void 0 || resource.Type === type);
+	});
+}
+function renderServeOneStackAdvice(stacks) {
+	const example = stacks.find((s) => s.displayName && s.displayName !== s.stackName)?.displayName;
+	return `Serve one stack at a time: pass --stack with its CDK path${example !== void 0 && displayIdent(example) === example ? ` (e.g. --stack '${example}')` : ""}, or a target starting with that path.`;
+}
+function lambdaOwners(ref, stacks) {
+	if (ref.stackName !== void 0) {
+		const own = stacks.filter((s) => s.stackName === ref.stackName);
+		const declaring = stacksDeclaring(ref.logicalId, own, LAMBDA_FUNCTION_TYPE);
+		if (declaring.length > 0) return declaring;
+	}
+	return stacksDeclaring(ref.logicalId, stacks, LAMBDA_FUNCTION_TYPE);
+}
+function servedLambdaKey(stackName, logicalId) {
+	return `${stackName}:${logicalId}`;
+}
+function servedLambdaKeyFor(ref, stacks) {
+	const owners = lambdaOwners(ref, stacks);
+	return owners.length === 1 ? servedLambdaKey(owners[0].stackName, ref.logicalId) : void 0;
+}
+function routeStackName(route, stacks) {
+	if (route.apiStackName !== void 0) return route.apiStackName;
+	return stacks?.length === 1 ? stacks[0].stackName : void 0;
+}
+function groupStackName(group, stacks) {
+	const route = group.routes[0]?.route;
+	return route === void 0 ? void 0 : routeStackName(route, stacks);
+}
+function perStack(byStack, stackName, make) {
+	const key = JSON.stringify(stackName ?? null);
+	let value = byStack.get(key);
+	if (value === void 0) {
+		value = make();
+		byStack.set(key, value);
+	}
+	return value;
+}
+function assertServedLogicalIdsUnambiguous(stacks, routes, routesWithAuth, webSocketApis = [], userIds = {}) {
+	if (stacks.length < 2) return;
+	const byName = /* @__PURE__ */ new Map();
+	for (const stack of stacks) byName.set(stack.stackName, [...byName.get(stack.stackName) ?? [], stack]);
+	for (const [name, sharing] of byName) if (sharing.length > 1) throw new Error(`The served stacks ${sharing.map(describeStack).join(", ")} share the physical stack name ${displayIdent(name)}, and cdkd local start-api reads each stack's deployed state by that name, so it cannot serve them together. ${renderServeOneStackAdvice(sharing)}`);
+	const ownersById = /* @__PURE__ */ new Map();
+	for (const ref of reachedLambdas(routes, routesWithAuth, webSocketApis)) {
+		const owners = lambdaOwners(ref, stacks);
+		if (owners.length > 1) throw new Error(`Lambda ${displayIdent(ref.logicalId)} is declared by ${owners.length} of the served stacks (${owners.map(describeStack).join(", ")}), and cdkd local start-api cannot tell which one its route reaches. ${renderServeOneStackAdvice(owners)}`);
+		for (const owner of owners) {
+			const list = ownersById.get(ref.logicalId) ?? [];
+			if (!list.includes(owner)) list.push(owner);
+			ownersById.set(ref.logicalId, list);
+		}
+	}
+	const perLambda = userIds.assumeRole?.perLambda ?? {};
+	for (const logicalId of Object.keys(perLambda)) {
+		const owners = ownersById.get(logicalId) ?? [];
+		if (owners.length < 2) continue;
+		throw new Error(`--assume-role names Lambda ${displayIdent(logicalId)} by its bare logical ID, which ${owners.length} of the served stacks declare (${owners.map(describeStack).join(", ")}), so it does not say which one to assume the role for. ${renderServeOneStackAdvice(owners)}`);
+	}
+	for (const key of Object.keys(userIds.overrides ?? {})) {
+		if (key === "Parameters") continue;
+		const owners = ownersById.get(key) ?? [];
+		if (owners.length < 2) continue;
+		throw new Error(`--env-vars key ${displayIdent(key)} names a Lambda by its bare logical ID, which ${owners.length} of the served stacks declare (${owners.map(describeStack).join(", ")}), so it does not say which one it overrides. ${renderConstructPathKeyAdvice(key, owners)}`);
+	}
+}
+function renderConstructPathKeyAdvice(logicalId, owners) {
+	const paths = [];
+	for (const owner of owners) {
+		const resource = owner.template.Resources?.[logicalId];
+		const path = resource ? readCdkPathOrUndefined(resource)?.replace(/\/Resource$/, "") : void 0;
+		if (path !== void 0 && displayIdent(path) === path) paths.push(JSON.stringify(path));
+	}
+	return paths.length > 0 ? `Key it by the Lambda's construct path instead, which names one stack: ${paths.join(", ")}.` : `Key it by the Lambda's construct path instead, which names one stack.`;
+}
+function reachedLambdas(routes, routesWithAuth, webSocketApis = []) {
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];
+	const add = (stackName, logicalId) => {
+		const key = JSON.stringify([stackName ?? null, logicalId]);
+		if (seen.has(key)) return;
+		seen.add(key);
+		out.push({
+			stackName,
+			logicalId
+		});
+	};
 	for (const r of routes) {
 		if (r.unsupported || r.mockCors || r.serviceIntegration) continue;
 		if (r.lambdaLogicalId.length === 0) continue;
-		if (!seen.has(r.lambdaLogicalId)) {
-			seen.add(r.lambdaLogicalId);
-			out.push(r.lambdaLogicalId);
-		}
+		add(r.apiStackName, r.lambdaLogicalId);
 	}
 	for (const entry of routesWithAuth) {
 		if (entry.route.unsupported || entry.route.mockCors || entry.route.serviceIntegration) continue;
 		const auth = entry.authorizer;
 		if (!auth) continue;
-		if (auth.kind === "lambda-token" || auth.kind === "lambda-request") {
-			if (!seen.has(auth.lambdaLogicalId)) {
-				seen.add(auth.lambdaLogicalId);
-				out.push(auth.lambdaLogicalId);
-			}
-		}
-	}
-	for (const api of webSocketApis) for (const r of api.routes) if (!seen.has(r.targetLambdaLogicalId)) {
-		seen.add(r.targetLambdaLogicalId);
-		out.push(r.targetLambdaLogicalId);
+		if (auth.kind === "lambda-token" || auth.kind === "lambda-request") add(entry.route.apiStackName, auth.lambdaLogicalId);
 	}
+	for (const api of webSocketApis) for (const r of api.routes) add(r.lambdaStackName, r.targetLambdaLogicalId);
 	return out;
 }
 async function prewarmJwks(routesWithAuth, jwksCache) {
@@ -25676,27 +25875,29 @@ async function prewarmJwks(routesWithAuth, jwksCache) {
 }
 function warnVpcConfigLambdas(routesWithAuth, stacks) {
 	const logger = getLogger();
-	const seen = /* @__PURE__ */ new Set();
-	const reachable = [];
-	for (const entry of routesWithAuth) {
-		if (!seen.has(entry.route.lambdaLogicalId)) {
-			seen.add(entry.route.lambdaLogicalId);
-			reachable.push(entry.route.lambdaLogicalId);
-		}
-		const auth = entry.authorizer;
-		if (auth && (auth.kind === "lambda-token" || auth.kind === "lambda-request")) {
-			if (!seen.has(auth.lambdaLogicalId)) {
-				seen.add(auth.lambdaLogicalId);
-				reachable.push(auth.lambdaLogicalId);
-			}
-		}
+	const warned = /* @__PURE__ */ new Set();
+	const reached = [];
+	for (const { route, authorizer: auth } of routesWithAuth) {
+		reached.push({
+			stackName: route.apiStackName,
+			logicalId: route.lambdaLogicalId
+		});
+		if (auth && (auth.kind === "lambda-token" || auth.kind === "lambda-request")) reached.push({
+			stackName: route.apiStackName,
+			logicalId: auth.lambdaLogicalId
+		});
 	}
-	for (const logicalId of reachable) for (const stack of stacks) {
-		const resource = stack.template.Resources?.[logicalId];
-		if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
-		const vpcConfig = (resource.Properties ?? {})["VpcConfig"];
-		if (vpcConfig && typeof vpcConfig === "object" && Object.keys(vpcConfig).length > 0) logger.warn(`Lambda ${logicalId} has VpcConfig — local container will reach external services via the host's network, NOT through the deployed VPC's NAT/private subnets. Calls to private RDS/ElastiCache will fail. See https://cdkd.dev/local-start-api/#vpc-config-lambdas for details.`);
-		break;
+	for (const ref of reached) {
+		const owner = lambdaOwners(ref, stacks)[0];
+		if (owner === void 0) continue;
+		const key = servedLambdaKey(owner.stackName, ref.logicalId);
+		if (warned.has(key)) continue;
+		warned.add(key);
+		const vpcConfig = (owner.template.Resources?.[ref.logicalId]?.Properties ?? {})["VpcConfig"];
+		if (vpcConfig && typeof vpcConfig === "object" && Object.keys(vpcConfig).length > 0) {
+			const shown = stacks.length > 1 ? key : ref.logicalId;
+			logger.warn(`Lambda ${shown} has VpcConfig — local container will reach external services via the host's network, NOT through the deployed VPC's NAT/private subnets. Calls to private RDS/ElastiCache will fail. See https://cdkd.dev/local-start-api/#vpc-config-lambdas for details.`);
+		}
 	}
 }
 function warnIamRoutes(routesWithAuth) {
@@ -25920,9 +26121,10 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 	return dir;
 }
 function resolveLambdaByLogicalId(logicalId, stacks) {
-	for (const stack of stacks) {
-		const resource = stack.template.Resources?.[logicalId];
-		if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+	const owners = stacksDeclaring(logicalId, stacks, LAMBDA_FUNCTION_TYPE);
+	if (owners.length > 1) throw new Error(`Lambda ${displayIdent(logicalId)} is declared by ${owners.length} stacks (${owners.map(describeStack).join(", ")}). ${renderServeOneStackAdvice(owners)}`);
+	for (const stack of owners) {
+		const resource = stack.template.Resources[logicalId];
 		const props = resource.Properties ?? {};
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
@@ -26167,20 +26369,78 @@ function parsePerLambdaConcurrency(raw) {
 	}
 	return parsed;
 }
-function filterSpecsForGroup(group, allSpecs) {
-	const ids = /* @__PURE__ */ new Set();
+function attachStageContextPerStack(stacks, routes, stageOverride) {
+	const missingApis = /* @__PURE__ */ new Set();
+	for (const stack of stacks) {
+		const stageMap = buildStageMap(stack.template, stageOverride);
+		const own = routes.filter((r) => routeStackName(r, stacks) === stack.stackName);
+		if (stageOverride) for (const r of own) {
+			if (!r.apiLogicalId || stageMap.has(r.apiLogicalId)) continue;
+			missingApis.add(stacks.length > 1 ? `${stack.stackName}:${r.apiLogicalId}` : r.apiLogicalId);
+		}
+		attachStageContext(own, stageMap);
+	}
+	return missingApis;
+}
+function buildCorsConfigByStack(stacks) {
+	const out = /* @__PURE__ */ new Map();
+	for (const stack of stacks) {
+		const corsConfigByApiId = /* @__PURE__ */ new Map();
+		for (const [k, v] of buildCorsConfigFromCloudFrontChain(stack.template)) corsConfigByApiId.set(k, v);
+		for (const [k, v] of buildCorsConfigByApiId(stack.template)) corsConfigByApiId.set(k, v);
+		out.set(stack.stackName, corsConfigByApiId);
+	}
+	return out;
+}
+async function buildServedLambdaSpecs(stacks, routes, routesWithAuth, webSocketApis, build) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const ref of reachedLambdas(routes, routesWithAuth, webSocketApis)) {
+		const owners = lambdaOwners(ref, stacks);
+		const key = owners.length === 1 ? servedLambdaKey(owners[0].stackName, ref.logicalId) : void 0;
+		if (key !== void 0 && specs.has(key)) continue;
+		const spec = await build({
+			logicalId: ref.logicalId,
+			stacks: owners.length === 1 ? owners : stacks,
+			index: specs.size
+		});
+		specs.set(key ?? ref.logicalId, spec);
+	}
+	return specs;
+}
+function filterSpecsForGroup(group, material) {
+	const out = /* @__PURE__ */ new Map();
+	const add = (stackName, logicalId) => {
+		if (out.has(logicalId)) return;
+		const key = servedLambdaKeyFor({
+			stackName,
+			logicalId
+		}, material.stacks);
+		const spec = key === void 0 ? void 0 : material.specs.get(key);
+		if (spec) out.set(logicalId, spec);
+	};
 	for (const rwa of group.routes) {
-		ids.add(rwa.route.lambdaLogicalId);
+		add(rwa.route.apiStackName, rwa.route.lambdaLogicalId);
 		const auth = rwa.authorizer;
-		if (auth && (auth.kind === "lambda-token" || auth.kind === "lambda-request")) ids.add(auth.lambdaLogicalId);
+		if (auth && (auth.kind === "lambda-token" || auth.kind === "lambda-request")) add(rwa.route.apiStackName, auth.lambdaLogicalId);
 	}
+	return out;
+}
+function filterSpecsForWebSocketApi(api, material) {
 	const out = /* @__PURE__ */ new Map();
-	for (const id of ids) {
-		const spec = allSpecs.get(id);
-		if (spec) out.set(id, spec);
+	for (const r of api.routes) {
+		const key = servedLambdaKeyFor({
+			stackName: r.lambdaStackName,
+			logicalId: r.targetLambdaLogicalId
+		}, material.stacks);
+		const spec = key === void 0 ? void 0 : material.specs.get(key);
+		if (spec) out.set(r.targetLambdaLogicalId, spec);
 	}
 	return out;
 }
+function corsConfigForGroup(group, material) {
+	const stackName = groupStackName(group, material.stacks);
+	return (stackName === void 0 ? void 0 : material.corsConfigByStack.get(stackName)) ?? /* @__PURE__ */ new Map();
+}
 function printPerServerRouteTables(servers) {
 	for (const { group, server } of servers) {
 		process.stdout.write(`\n${group.displayName}  (http://${formatAuthority(server.host, server.port)})\n`);
@@ -26233,11 +26493,11 @@ async function reloadAllServers(args) {
 	for (const booted of servers) {
 		const group = newByKey.get(booted.group.serverKey);
 		if (!group) continue;
-		const newPool = buildPool(filterSpecsForGroup(group, material.specs));
+		const newPool = buildPool(filterSpecsForGroup(group, material));
 		const newState = {
 			routes: group.routes,
 			pool: newPool,
-			corsConfigByApiId: material.corsConfigByApiId
+			corsConfigByApiId: corsConfigForGroup(group, material)
 		};
 		const previousState = booted.server.setServerState(newState);
 		booted.group = group;
@@ -26264,24 +26524,14 @@ function envHasIntrinsicValue$1(templateEnv) {
 async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options) {
 	const logger = getLogger();
 	const out = /* @__PURE__ */ new Map();
-	const lambdaIds = uniqueLambdaIds(routes, routesWithAuth);
 	const reachableStackNames = /* @__PURE__ */ new Set();
-	for (const logicalId of lambdaIds) for (const stack of stacks) {
-		const resource = stack.template.Resources?.[logicalId];
-		if (resource && resource.Type === "AWS::Lambda::Function") {
-			reachableStackNames.add(stack.stackName);
-			break;
-		}
+	const intrinsicEnvStacks = /* @__PURE__ */ new Set();
+	for (const ref of reachedLambdas(routes, routesWithAuth)) for (const owner of lambdaOwners(ref, stacks)) {
+		reachableStackNames.add(owner.stackName);
+		const resource = owner.template.Resources?.[ref.logicalId];
+		if (resource && envHasIntrinsicValue$1(getTemplateEnv$1(resource))) intrinsicEnvStacks.add(owner.stackName);
 	}
-	const stackHasIntrinsicEnv = (stackName) => {
-		for (const logicalId of lambdaIds) for (const stack of stacks) {
-			if (stack.stackName !== stackName) continue;
-			const resource = stack.template.Resources?.[logicalId];
-			if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
-			if (envHasIntrinsicValue$1(getTemplateEnv$1(resource))) return true;
-		}
-		return false;
-	};
+	const stackHasIntrinsicEnv = (stackName) => intrinsicEnvStacks.has(stackName);
 	rejectExplicitCfnStackWithMultipleStacks(options, reachableStackNames.size);
 	for (const stackName of reachableStackNames) {
 		const stack = stacks.find((s) => s.stackName === stackName);
@@ -27591,7 +27841,7 @@ function pickCandidateStack(parsed, target, stacks) {
 		if (stacks.length === 1) return stacks[0];
 		return;
 	}
-	const matched = matchStacks(stacks, [stackPattern]);
+	const matched = matchStacks(stacks, [stackPattern], { dedupe: "identity" });
 	if (matched.length === 1) return matched[0];
 }
 async function resolveStackAccountId$1(source) {
@@ -29710,4 +29960,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DDJHp1K3.js.map
+//# sourceMappingURL=program-CAibYjpk.js.map