aws-cdk 2.1123.0 → 2.1124.1

package/lib/index.js

@@ -274,6 +274,13 @@ var init_interfaces = __esm({
   }
 });
 
+// ../@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/validation-report-schema.ts
+var init_validation_report_schema = __esm({
+  "../@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/validation-report-schema.ts"() {
+    "use strict";
+  }
+});
+
 // ../@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/index.ts
 var cloud_assembly_exports = {};
 __export(cloud_assembly_exports, {
@@ -291,6 +298,7 @@ var init_cloud_assembly = __esm({
     init_artifact_schema();
     init_context_queries();
     init_interfaces();
+    init_validation_report_schema();
   }
 });
 
@@ -3652,7 +3660,7 @@ var require_semver2 = __commonJS({
 // ../@aws-cdk/cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../@aws-cdk/cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "2.1123.0" };
+    module2.exports = { version: "2.1124.1" };
   }
 });
 
@@ -5685,6 +5693,175 @@ var require_integ_schema = __commonJS({
   }
 });
 
+// ../@aws-cdk/cloud-assembly-schema/schema/validation-report.schema.json
+var require_validation_report_schema = __commonJS({
+  "../@aws-cdk/cloud-assembly-schema/schema/validation-report.schema.json"(exports2, module2) {
+    module2.exports = {
+      $ref: "#/definitions/PolicyValidationReportJson",
+      definitions: {
+        PolicyValidationReportJson: {
+          description: "The top-level structure of the policy validation report file.",
+          type: "object",
+          properties: {
+            version: {
+              description: "Protocol version",
+              type: "string"
+            },
+            title: {
+              description: "Report title, if present.",
+              type: "string"
+            },
+            pluginReports: {
+              description: "Reports from all validation plugins that ran during synthesis.",
+              type: "array",
+              items: {
+                $ref: "#/definitions/PluginReportJson"
+              }
+            }
+          },
+          required: ["version", "pluginReports"]
+        },
+        PluginReportJson: {
+          description: "A report from a single validation plugin.",
+          type: "object",
+          properties: {
+            pluginName: {
+              description: "The name of the plugin that produced this report.",
+              type: "string"
+            },
+            pluginVersion: {
+              description: "Version of the plugin that produced this report.",
+              type: "string"
+            },
+            conclusion: {
+              description: "Whether the plugin's validation passed or failed.",
+              $ref: "#/definitions/PolicyValidationReportConclusion"
+            },
+            metadata: {
+              description: "Additional plugin-specific metadata.",
+              type: "object",
+              additionalProperties: {
+                type: "string"
+              }
+            },
+            violations: {
+              description: "Violations found by this plugin.",
+              type: "array",
+              items: {
+                $ref: "#/definitions/PolicyViolationJson"
+              }
+            }
+          },
+          required: ["pluginName", "conclusion", "violations"]
+        },
+        PolicyValidationReportConclusion: {
+          description: "The final conclusion of a validation report.",
+          type: "string",
+          enum: ["success", "failure"]
+        },
+        PolicyViolationJson: {
+          description: "A single policy violation found by a validation plugin.",
+          type: "object",
+          properties: {
+            ruleName: {
+              description: "The name of the rule that was violated.",
+              type: "string"
+            },
+            description: {
+              description: "A description of the violation.",
+              type: "string"
+            },
+            suggestedFix: {
+              description: "How to fix the violation.",
+              type: "string"
+            },
+            severity: {
+              description: "The severity of the violation.",
+              $ref: "#/definitions/PolicyViolationSeverity"
+            },
+            customSeverity: {
+              description: "If the plugin wants to report using a non-standard severity, put it here.",
+              type: "string"
+            },
+            ruleMetadata: {
+              description: "Additional rule-specific metadata.",
+              type: "object",
+              additionalProperties: {
+                type: "string"
+              }
+            },
+            violatingConstructs: {
+              description: "Constructs that violated the rule.",
+              type: "array",
+              items: {
+                $ref: "#/definitions/ViolatingConstructJson"
+              }
+            }
+          },
+          required: ["ruleName", "description", "severity", "violatingConstructs"]
+        },
+        PolicyViolationSeverity: {
+          description: "The severity of a policy violation.",
+          type: "string",
+          enum: ["fatal", "error", "warning", "info", "custom"]
+        },
+        ViolatingConstructJson: {
+          description: "A construct that violated a policy rule.",
+          type: "object",
+          properties: {
+            constructPath: {
+              description: "The construct path as defined in the application.",
+              type: "string"
+            },
+            constructFqn: {
+              description: "The fully qualified name of the construct class (includes the library name).",
+              type: "string"
+            },
+            libraryVersion: {
+              description: "The version of the library that contains this construct.",
+              type: "string"
+            },
+            cloudFormationResource: {
+              description: "If this construct violation regards a CloudFormation resource, a reference to the resource details.",
+              $ref: "#/definitions/CloudFormationResourceJson"
+            },
+            stackTraces: {
+              description: "Stack traces associated with this violation.",
+              type: "array",
+              items: {
+                type: "string"
+              }
+            }
+          },
+          required: ["constructPath"]
+        },
+        CloudFormationResourceJson: {
+          description: "CloudFormation resource details for a violating construct.",
+          type: "object",
+          properties: {
+            templatePath: {
+              description: "The path to the CloudFormation template containing this resource.",
+              type: "string"
+            },
+            logicalId: {
+              description: "The logical ID of the resource in the CloudFormation template.",
+              type: "string"
+            },
+            propertyPaths: {
+              description: "Properties within the construct where the violation was detected.",
+              type: "array",
+              items: {
+                type: "string"
+              }
+            }
+          },
+          required: ["templatePath", "logicalId"]
+        }
+      }
+    };
+  }
+});
+
 // ../@aws-cdk/cloud-assembly-schema/schema/version.json
 var require_version = __commonJS({
   "../@aws-cdk/cloud-assembly-schema/schema/version.json"(exports2, module2) {
@@ -5705,7 +5882,7 @@ __export(manifest_exports, {
 function stripEnumErrors(errors) {
   return errors.filter((e32) => typeof e32.schema === "string" || !("enum" in e32.schema));
 }
-var fs, jsonschema, semver, VERSION_MISMATCH, CLI_VERSION, ASSETS_SCHEMA, ASSEMBLY_SCHEMA, INTEG_SCHEMA, SCHEMA_VERSION, Manifest;
+var fs, jsonschema, semver, VERSION_MISMATCH, CLI_VERSION, ASSETS_SCHEMA, ASSEMBLY_SCHEMA, INTEG_SCHEMA, VALIDATION_REPORT_SCHEMA, SCHEMA_VERSION, Manifest;
 var init_manifest = __esm({
   "../@aws-cdk/cloud-assembly-schema/lib/manifest.ts"() {
     "use strict";
@@ -5718,6 +5895,7 @@ var init_manifest = __esm({
     ASSETS_SCHEMA = require_assets_schema();
     ASSEMBLY_SCHEMA = require_cloud_assembly_schema();
     INTEG_SCHEMA = require_integ_schema();
+    VALIDATION_REPORT_SCHEMA = require_validation_report_schema();
     SCHEMA_VERSION = require_version();
     Manifest = class _Manifest {
       static {
@@ -5778,6 +5956,14 @@ var init_manifest = __esm({
           testCases: manifest.testCases ?? []
         };
       }
+      /**
+       * Load and validate the policy validation report from file.
+       *
+       * @param filePath - path to the validation report file.
+       */
+      static loadValidationReport(filePath) {
+        return _Manifest.loadManifest(filePath, VALIDATION_REPORT_SCHEMA);
+      }
       /**
        * Fetch the current schema version number.
        */
@@ -64794,11 +64980,11 @@ var require_randomUUID = __commonJS({
 var require_dist_cjs19 = __commonJS({
   "../../node_modules/@smithy/uuid/dist-cjs/index.js"(exports2) {
     "use strict";
-    var randomUUID11 = require_randomUUID();
+    var randomUUID12 = require_randomUUID();
     var decimalToHex6 = Array.from({ length: 256 }, (_2, i32) => i32.toString(16).padStart(2, "0"));
     var v46 = /* @__PURE__ */ __name(() => {
-      if (randomUUID11.randomUUID) {
-        return randomUUID11.randomUUID();
+      if (randomUUID12.randomUUID) {
+        return randomUUID12.randomUUID();
       }
       const rnds = new Uint8Array(16);
       crypto.getRandomValues(rnds);
@@ -178323,11 +178509,6 @@ async function getNestedStackArn(nestedStackLogicalId, listStackResources) {
 function isCdkManagedNestedStack(stackResource) {
   return stackResource.Type === "AWS::CloudFormation::Stack" && stackResource.Metadata && stackResource.Metadata["aws:asset:path"];
 }
-function templateContainsNestedStacks(template) {
-  return Object.values(template?.Resources ?? {}).some(
-    (resource) => resource.Type === "AWS::CloudFormation::Stack"
-  );
-}
 var path17, fs17;
 var init_nested_stack_helpers = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloudformation/nested-stack-helpers.ts"() {
@@ -178344,7 +178525,6 @@ var init_nested_stack_helpers = __esm({
     __name(getNestedStackTemplates, "getNestedStackTemplates");
     __name(getNestedStackArn, "getNestedStackArn");
     __name(isCdkManagedNestedStack, "isCdkManagedNestedStack");
-    __name(templateContainsNestedStacks, "templateContainsNestedStacks");
   }
 });
 
@@ -179205,7 +179385,6 @@ var cfn_api_exports = {};
 __export(cfn_api_exports, {
   ParameterValues: () => ParameterValues,
   TemplateParameters: () => TemplateParameters,
-  createChangeSetAndCleanup: () => createChangeSetAndCleanup,
   createDiffChangeSet: () => createDiffChangeSet,
   stabilizeStack: () => stabilizeStack,
   uploadStackTemplateAssets: () => uploadStackTemplateAssets,
@@ -179246,13 +179425,13 @@ async function waitFor(valueProvider, timeout = 5e3) {
 async function waitForChangeSet(cfn, ioHelper, stackNameOrArn, changeSetNameOrArn, { fetchAll, diagnoser }) {
   const stackDisplayName = stackNameFromArn(stackNameOrArn);
   const changeSetDisplayName = changeSetNameFromArn(changeSetNameOrArn);
-  await ioHelper.defaults.debug((0, import_util12.format)("Waiting for changeset %s on stack %s to finish creating...", changeSetDisplayName, stackDisplayName));
+  await ioHelper.defaults.debug((0, import_node_util.format)("Waiting for changeset %s on stack %s to finish creating...", changeSetDisplayName, stackDisplayName));
   const ret = await waitFor(async () => {
     const description = await describeChangeSet(cfn, stackNameOrArn, changeSetNameOrArn, {
       fetchAll
     });
     if (description.Status === "CREATE_PENDING" || description.Status === "CREATE_IN_PROGRESS") {
-      await ioHelper.defaults.debug((0, import_util12.format)("Changeset %s on stack %s is still creating", changeSetDisplayName, stackDisplayName));
+      await ioHelper.defaults.debug((0, import_node_util.format)("Changeset %s on stack %s is still creating", changeSetDisplayName, stackDisplayName));
       return void 0;
     }
     const diag = await diagnoser.diagnoseChangeSet(description);
@@ -179269,7 +179448,7 @@ async function waitForChangeSet(cfn, ioHelper, stackNameOrArn, changeSetNameOrAr
 async function waitForChangeSetGone(cfn, ioHelper, stackNameOrArn, changeSetNameOrArn) {
   const stackDisplayName = stackNameFromArn(stackNameOrArn);
   const changeSetDisplayName = changeSetNameFromArn(changeSetNameOrArn);
-  await ioHelper.defaults.debug((0, import_util12.format)("Waiting for changeset %s on stack %s to finish deleting...", changeSetDisplayName, stackDisplayName));
+  await ioHelper.defaults.debug((0, import_node_util.format)("Waiting for changeset %s on stack %s to finish deleting...", changeSetDisplayName, stackDisplayName));
   await waitFor(async () => {
     try {
       const description = await cfn.describeChangeSet({
@@ -179293,7 +179472,7 @@ async function createDiffChangeSet(ioHelper, options) {
     const env3 = await options.deployments.envs.accessStackForMutableStackOperations(options.stack);
     return await uploadBodyParameterAndCreateChangeSet(ioHelper, env3, {
       ...options,
-      includeNestedStacks: templateContainsNestedStacks(options.stack.template)
+      includeNestedStacks: true
     });
   } catch (e32) {
     if (options.failOnError) {
@@ -179331,7 +179510,7 @@ async function uploadBodyParameterAndCreateChangeSet(ioHelper, env3, options) {
   );
   const cfn = env3.sdk.cloudFormation();
   const stack = await CloudFormationStack.lookup(cfn, options.stack.stackName, false);
-  const exists = stack.exists && stack.stackStatus.name !== "REVIEW_IN_PROGRESS";
+  const exists = stack.exists && stack.stackStatus.name !== "REVIEW_IN_PROGRESS" && stack.stackStatus.name !== "DELETE_IN_PROGRESS";
   const executionRoleArn = await env3.replacePlaceholders(options.stack.cloudFormationExecutionRoleArn);
   await ioHelper.defaults.info(
     "Hold on while we create a read-only change set to get a diff with accurate replacement information (use --method=template to use a less accurate but faster template-only diff)\n"
@@ -179397,7 +179576,7 @@ async function createChangeSetAndCleanup(ioHelper, options) {
     Tags: toCfnTags(options.stack.tags),
     Capabilities: ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM", "CAPABILITY_AUTO_EXPAND"]
   });
-  await ioHelper.defaults.debug((0, import_util12.format)("Initiated creation of changeset: %s; waiting for it to finish creating...", changeSet.Id));
+  await ioHelper.defaults.debug((0, import_node_util.format)("Initiated creation of changeset: %s; waiting for it to finish creating...", changeSet.Id));
   const createdChangeSet = await waitForChangeSet(
     options.cfn,
     ioHelper,
@@ -179414,6 +179593,13 @@ async function createChangeSetAndCleanup(ioHelper, options) {
     changeSet.Id ?? options.changeSetName,
     changeSet.StackId ?? options.stack.stackName
   );
+  if (!options.exists) {
+    await ioHelper.defaults.debug((0, import_node_util.format)("Deleting empty stack created by diff changeset: %s", changeSet.StackId ?? options.stack.stackName));
+    await options.cfn.deleteStack({
+      StackName: changeSet.StackId ?? options.stack.stackName,
+      ClientRequestToken: (0, import_node_crypto3.randomUUID)()
+    });
+  }
   return createdChangeSet;
 }
 function toCfnTags(tags) {
@@ -179465,28 +179651,29 @@ async function waitForStackDeploy(cfn, ioHelper, stackName) {
 }
 async function stabilizeStack(cfn, ioHelper, stackNameOrArn) {
   const stackDisplayName = stackNameFromArn(stackNameOrArn);
-  await ioHelper.defaults.debug((0, import_util12.format)("Waiting for stack %s to finish creating or updating...", stackDisplayName));
+  await ioHelper.defaults.debug((0, import_node_util.format)("Waiting for stack %s to finish creating or updating...", stackDisplayName));
   return waitFor(async () => {
     const stack = await CloudFormationStack.lookup(cfn, stackNameOrArn);
     if (!stack.exists) {
-      await ioHelper.defaults.debug((0, import_util12.format)("Stack %s does not exist", stackDisplayName));
+      await ioHelper.defaults.debug((0, import_node_util.format)("Stack %s does not exist", stackDisplayName));
       return null;
     }
     const status = stack.stackStatus;
     if (status.isInProgress) {
-      await ioHelper.defaults.debug((0, import_util12.format)("Stack %s has an ongoing operation in progress and is not stable (%s)", stackDisplayName, status));
+      await ioHelper.defaults.debug((0, import_node_util.format)("Stack %s has an ongoing operation in progress and is not stable (%s)", stackDisplayName, status));
       return void 0;
     } else if (status.isReviewInProgress) {
-      await ioHelper.defaults.debug((0, import_util12.format)("Stack %s is in REVIEW_IN_PROGRESS state. Considering this is a stable status (%s)", stackDisplayName, status));
+      await ioHelper.defaults.debug((0, import_node_util.format)("Stack %s is in REVIEW_IN_PROGRESS state. Considering this is a stable status (%s)", stackDisplayName, status));
     }
     return stack;
   });
 }
-var import_util12, import_cdk_assets_lib3, cxapi2, import_cloud_assembly_api4, import_client_cloudformation3, TemplateParameters, ParameterValues;
+var import_node_crypto3, import_node_util, import_cdk_assets_lib3, cxapi2, import_cloud_assembly_api4, import_client_cloudformation3, TemplateParameters, ParameterValues;
 var init_cfn_api = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/deployments/cfn-api.ts"() {
     "use strict";
-    import_util12 = require("util");
+    import_node_crypto3 = require("node:crypto");
+    import_node_util = require("node:util");
     import_cdk_assets_lib3 = __toESM(require_lib6());
     cxapi2 = __toESM(require_lib3());
     import_cloud_assembly_api4 = __toESM(require_lib3());
@@ -190150,11 +190337,11 @@ function _diffStrings(oldStr, newStr, context) {
   }
   __name(_findIndent, "_findIndent");
 }
-var import_util20, chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
+var import_util19, chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
 var init_format = __esm({
   "../@aws-cdk/cloudformation-diff/lib/format.ts"() {
     "use strict";
-    import_util20 = require("util");
+    import_util19 = require("util");
     chalk7 = __toESM(require_source());
     init_util4();
     init_diff_template();
@@ -190183,10 +190370,10 @@ var init_format = __esm({
         __name(this, "Formatter");
       }
       print(fmt, ...args) {
-        this.stream.write(chalk7.reset((0, import_util20.format)(fmt, ...args)) + "\n");
+        this.stream.write(chalk7.reset((0, import_util19.format)(fmt, ...args)) + "\n");
       }
       warning(fmt, ...args) {
-        this.stream.write(chalk7.yellow((0, import_util20.format)(fmt, ...args)) + "\n");
+        this.stream.write(chalk7.yellow((0, import_util19.format)(fmt, ...args)) + "\n");
       }
       formatSection(title, entryType, collection, formatter = this.formatDifference.bind(this)) {
         if (collection.differenceCount === 0) {
@@ -192150,7 +192337,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
   sdk.appendCustomUserAgent(customUserAgent);
   const resourceText = /* @__PURE__ */ __name((r32) => r32.description ?? `${r32.resourceType} '${r32.physicalName ?? r32.logicalId}'`, "resourceText");
   await ioSpan.notify(IO.CDK_TOOLKIT_I5402.msg(
-    hotswapOperation.change.resources.map((r32) => (0, import_util26.format)(`   ${ICON} %s`, chalk9.bold(resourceText(r32)))).join("\n"),
+    hotswapOperation.change.resources.map((r32) => (0, import_util25.format)(`   ${ICON} %s`, chalk9.bold(resourceText(r32)))).join("\n"),
     hotswapOperation.change
   ));
   try {
@@ -192165,7 +192352,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
     throw e32;
   }
   await ioSpan.notify(IO.CDK_TOOLKIT_I5403.msg(
-    hotswapOperation.change.resources.map((r32) => (0, import_util26.format)(`   ${ICON} %s %s`, chalk9.bold(resourceText(r32)), chalk9.green("hotswapped!"))).join("\n"),
+    hotswapOperation.change.resources.map((r32) => (0, import_util25.format)(`   ${ICON} %s %s`, chalk9.bold(resourceText(r32)), chalk9.green("hotswapped!"))).join("\n"),
     hotswapOperation.change
   ));
   sdk.removeCustomUserAgent(customUserAgent);
@@ -192194,9 +192381,9 @@ async function logRejectedChanges(ioSpan, rejectedChanges, hotswapMode) {
   }
   const messages = [""];
   if (hotswapMode === "hotswap-only") {
-    messages.push((0, import_util26.format)("%s %s", chalk9.red("\u26A0\uFE0F"), chalk9.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
+    messages.push((0, import_util25.format)("%s %s", chalk9.red("\u26A0\uFE0F"), chalk9.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
   } else {
-    messages.push((0, import_util26.format)("%s %s", chalk9.red("\u26A0\uFE0F"), chalk9.red("The following non-hotswappable changes were found:")));
+    messages.push((0, import_util25.format)("%s %s", chalk9.red("\u26A0\uFE0F"), chalk9.red("The following non-hotswappable changes were found:")));
   }
   for (const { change } of rejectedChanges) {
     messages.push("    " + nonHotswappableChangeMessage(change));
@@ -192209,7 +192396,7 @@ function nonHotswappableChangeMessage(change) {
   const reason = change.description ?? change.reason;
   switch (subject.type) {
     case "Output":
-      return (0, import_util26.format)(
+      return (0, import_util25.format)(
         "output: %s, reason: %s",
         chalk9.bold(subject.logicalId),
         chalk9.red(reason)
@@ -192220,7 +192407,7 @@ function nonHotswappableChangeMessage(change) {
 }
 function nonHotswappableResourceMessage(subject, reason) {
   if (subject.rejectedProperties?.length) {
-    return (0, import_util26.format)(
+    return (0, import_util25.format)(
       "resource: %s, type: %s, rejected changes: %s, reason: %s",
       chalk9.bold(subject.logicalId),
       chalk9.bold(subject.resourceType),
@@ -192228,18 +192415,18 @@ function nonHotswappableResourceMessage(subject, reason) {
       chalk9.red(reason)
     );
   }
-  return (0, import_util26.format)(
+  return (0, import_util25.format)(
     "resource: %s, type: %s, reason: %s",
     chalk9.bold(subject.logicalId),
     chalk9.bold(subject.resourceType),
     chalk9.red(reason)
   );
 }
-var import_util26, cfn_diff, chalk9, pLimit2, RESOURCE_DETECTORS;
+var import_util25, cfn_diff, chalk9, pLimit2, RESOURCE_DETECTORS;
 var init_hotswap_deployments = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts"() {
     "use strict";
-    import_util26 = require("util");
+    import_util25 = require("util");
     cfn_diff = __toESM(require_lib10());
     chalk9 = __toESM(require_source());
     init_payloads();
@@ -192345,7 +192532,7 @@ async function deployStack(options, ioHelper) {
     await ioHelper.defaults.debug(
       `Found existing stack ${deployName} that had previously failed creation. Deleting it before attempting to re-create it.`
     );
-    await cfn.deleteStack({ StackName: cloudFormationStack.stackId, ClientRequestToken: (0, import_node_crypto3.randomUUID)() });
+    await cfn.deleteStack({ StackName: cloudFormationStack.stackId, ClientRequestToken: (0, import_node_crypto4.randomUUID)() });
     const deletedStack = await waitForStackDelete(cfn, ioHelper, cloudFormationStack.stackId);
     if (deletedStack && deletedStack.stackStatus.name !== "DELETE_COMPLETE") {
       throw new DeploymentError(
@@ -192370,7 +192557,7 @@ async function deployStack(options, ioHelper) {
     await ioHelper.defaults.debug(`${deployName}: skipping deployment (use --force to override)`);
     if (deploymentMethod?.method === "hotswap") {
       await ioHelper.defaults.info(
-        (0, import_node_util.format)(
+        (0, import_node_util2.format)(
           `
  ${ICON} %s
 `,
@@ -192424,7 +192611,7 @@ async function deployStack(options, ioHelper) {
         );
         return hotswapDeploymentResult;
       }
-      await ioHelper.defaults.info((0, import_node_util.format)(
+      await ioHelper.defaults.info((0, import_node_util2.format)(
         "Could not perform a hotswap deployment, as the stack %s contains non-Asset changes",
         stackArtifact.displayName
       ));
@@ -192432,7 +192619,7 @@ async function deployStack(options, ioHelper) {
       if (!(e32 instanceof CfnEvaluationException)) {
         throw e32;
       }
-      await ioHelper.defaults.info((0, import_node_util.format)(
+      await ioHelper.defaults.info((0, import_node_util2.format)(
         "Could not perform a hotswap deployment, because the CloudFormation template could not be resolved: %s",
         formatErrorMessage(e32)
       ));
@@ -192477,7 +192664,7 @@ async function destroyStack(options, ioHelper) {
   });
   await monitor.start();
   try {
-    await cfn.deleteStack({ StackName: currentStack.stackId, RoleARN: options.roleArn, ClientRequestToken: (0, import_node_crypto3.randomUUID)() });
+    await cfn.deleteStack({ StackName: currentStack.stackId, RoleARN: options.roleArn, ClientRequestToken: (0, import_node_crypto4.randomUUID)() });
     const destroyedStack = await waitForStackDelete(cfn, ioHelper, currentStack.stackId);
     if (destroyedStack && destroyedStack.stackStatus.name !== "DELETE_COMPLETE") {
       throw new DeploymentError(`Failed to destroy ${deployName}: ${destroyedStack.stackStatus}`, "StackDestroyFailed");
@@ -192568,12 +192755,12 @@ function hasReplacement(cs) {
     return a32 === "ReplaceAndDelete" || a32 === "ReplaceAndRetain" || a32 === "ReplaceAndSnapshot";
   });
 }
-var import_node_crypto3, import_node_util, chalk10, FullCloudFormationDeployment;
+var import_node_crypto4, import_node_util2, chalk10, FullCloudFormationDeployment;
 var init_deploy_stack = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts"() {
     "use strict";
-    import_node_crypto3 = require("node:crypto");
-    import_node_util = require("node:util");
+    import_node_crypto4 = require("node:crypto");
+    import_node_util2 = require("node:util");
     chalk10 = __toESM(require_source());
     init_asset_manifest_builder();
     init_asset_publishing();
@@ -192607,7 +192794,7 @@ var init_deploy_stack = __esm({
         this.stackName = options.deployName ?? stackArtifact.stackName;
         this.update = cloudFormationStack.exists && cloudFormationStack.stackStatus.name !== "REVIEW_IN_PROGRESS";
         this.verb = this.update ? "update" : "create";
-        this.uuid = (0, import_node_crypto3.randomUUID)();
+        this.uuid = (0, import_node_crypto4.randomUUID)();
       }
       deploymentMethod;
       options;
@@ -192648,9 +192835,9 @@ var init_deploy_stack = __esm({
         const changeSetDescription = await this.createChangeSet(changeSetName, execute2, importExistingResources, revertDrift);
         await this.updateTerminationProtection();
         if (changeSetHasNoChanges(changeSetDescription)) {
-          await this.ioHelper.defaults.debug((0, import_node_util.format)("No changes are to be performed on %s.", this.stackName));
+          await this.ioHelper.defaults.debug((0, import_node_util2.format)("No changes are to be performed on %s.", this.stackName));
           if (execute2) {
-            await this.ioHelper.defaults.debug((0, import_node_util.format)("Deleting empty change set %s", changeSetDescription.ChangeSetId));
+            await this.ioHelper.defaults.debug((0, import_node_util2.format)("Deleting empty change set %s", changeSetDescription.ChangeSetId));
             await this.cfn.deleteChangeSet({
               StackName: changeSetDescription.StackId ?? this.stackName,
               ChangeSetName: changeSetDescription.ChangeSetId ?? changeSetName
@@ -192675,7 +192862,7 @@ var init_deploy_stack = __esm({
           };
         }
         if (!execute2) {
-          await this.ioHelper.defaults.info((0, import_node_util.format)(
+          await this.ioHelper.defaults.info((0, import_node_util2.format)(
             "Changeset %s created and waiting in review for manual execution (--no-execute)",
             changeSetDescription.ChangeSetId
           ));
@@ -192726,7 +192913,7 @@ var init_deploy_stack = __esm({
       async createChangeSet(changeSetName, willExecute, importExistingResources, revertDrift) {
         await this.cleanupOldChangeset(changeSetName);
         await this.ioHelper.defaults.debug(`Attempting to create ChangeSet with name ${changeSetName} to ${this.verb} stack ${this.stackName}`);
-        await this.ioHelper.defaults.info((0, import_node_util.format)("%s: creating CloudFormation changeset...", chalk10.bold(this.stackName)));
+        await this.ioHelper.defaults.info((0, import_node_util2.format)("%s: creating CloudFormation changeset...", chalk10.bold(this.stackName)));
         const changeSet = await this.cfn.createChangeSet({
           StackName: this.stackName,
           ChangeSetName: changeSetName,
@@ -192736,20 +192923,17 @@ var init_deploy_stack = __esm({
           ClientToken: `create${this.uuid}`,
           ImportExistingResources: importExistingResources,
           DeploymentMode: revertDrift ? "REVERT_DRIFT" : void 0,
-          // This is necessary to trigger early validation on nested stacks as well
-          // TODO: We currently have a test explicitly checking that this is NOT set to true, but on the other
-          // hand for 'cdk diff' we DO turn it on. Investigate later.
-          // IncludeNestedStacks: true,
+          IncludeNestedStacks: this.options.resourcesToImport || revertDrift ? void 0 : true,
           ...this.commonPrepareOptions()
         });
-        await this.ioHelper.defaults.debug((0, import_node_util.format)("Initiated creation of changeset: %s; waiting for it to finish creating...", changeSet.Id));
+        await this.ioHelper.defaults.debug((0, import_node_util2.format)("Initiated creation of changeset: %s; waiting for it to finish creating...", changeSet.Id));
         return waitForChangeSet(this.cfn, this.ioHelper, changeSet.StackId ?? this.stackName, changeSet.Id ?? changeSetName, {
           fetchAll: willExecute,
           diagnoser: this.diagnoser
         });
       }
       async executeChangeSet(changeSet) {
-        await this.ioHelper.defaults.debug((0, import_node_util.format)("Initiating execution of changeset %s on stack %s", changeSet.ChangeSetId, this.stackName));
+        await this.ioHelper.defaults.debug((0, import_node_util2.format)("Initiating execution of changeset %s on stack %s", changeSet.ChangeSetId, this.stackName));
         await this.cfn.executeChangeSet({
           StackName: changeSet.StackId ?? this.stackName,
           ChangeSetName: changeSet.ChangeSetId,
@@ -192757,7 +192941,7 @@ var init_deploy_stack = __esm({
           ...this.commonExecuteOptions()
         });
         await this.ioHelper.defaults.debug(
-          (0, import_node_util.format)(
+          (0, import_node_util2.format)(
             "Execution of changeset %s on stack %s has started; waiting for the update to complete...",
             changeSet.ChangeSetId,
             this.stackName
@@ -192781,7 +192965,7 @@ var init_deploy_stack = __esm({
         const terminationProtection = this.stackArtifact.terminationProtection ?? false;
         if (!!this.cloudFormationStack.terminationProtection !== terminationProtection) {
           await this.ioHelper.defaults.debug(
-            (0, import_node_util.format)(
+            (0, import_node_util2.format)(
               "Updating termination protection from %s to %s for stack %s",
               this.cloudFormationStack.terminationProtection,
               terminationProtection,
@@ -192792,11 +192976,11 @@ var init_deploy_stack = __esm({
             StackName: this.stackName,
             EnableTerminationProtection: terminationProtection
           });
-          await this.ioHelper.defaults.debug((0, import_node_util.format)("Termination protection updated to %s for stack %s", terminationProtection, this.stackName));
+          await this.ioHelper.defaults.debug((0, import_node_util2.format)("Termination protection updated to %s for stack %s", terminationProtection, this.stackName));
         }
       }
       async directDeployment() {
-        await this.ioHelper.defaults.info((0, import_node_util.format)("%s: %s stack...", chalk10.bold(this.stackName), this.update ? "updating" : "creating"));
+        await this.ioHelper.defaults.info((0, import_node_util2.format)("%s: %s stack...", chalk10.bold(this.stackName), this.update ? "updating" : "creating"));
         const startTime = /* @__PURE__ */ new Date();
         if (this.update) {
           await this.updateTerminationProtection();
@@ -192810,7 +192994,7 @@ var init_deploy_stack = __esm({
             return await this.monitorDeployment(startTime, stack.StackId, void 0);
           } catch (err) {
             if (err.message === "No updates are to be performed.") {
-              await this.ioHelper.defaults.debug((0, import_node_util.format)("No updates are to be performed for stack %s", this.stackName));
+              await this.ioHelper.defaults.debug((0, import_node_util2.format)("No updates are to be performed for stack %s", this.stackName));
               return {
                 type: "did-deploy-stack",
                 noOp: true,
@@ -192861,7 +193045,7 @@ var init_deploy_stack = __esm({
         } finally {
           await monitor.stop();
         }
-        await this.ioHelper.defaults.debug((0, import_node_util.format)("Stack %s has completed updating", this.stackName));
+        await this.ioHelper.defaults.debug((0, import_node_util2.format)("Stack %s has completed updating", this.stackName));
         return {
           type: "did-deploy-stack",
           noOp: false,
@@ -193557,11 +193741,11 @@ var init_notices2 = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
-var import_util32, chalk11, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
+var import_util31, chalk11, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
 var init_toolkit_info = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts"() {
     "use strict";
-    import_util32 = require("util");
+    import_util31 = require("util");
     chalk11 = __toESM(require_source());
     init_bootstrap_props();
     init_toolkit_error();
@@ -193581,7 +193765,7 @@ var init_toolkit_info = __esm({
           const stack = await stabilizeStack(cfn, ioHelper, stackName);
           if (!stack) {
             await ioHelper.defaults.debug(
-              (0, import_util32.format)(
+              (0, import_util31.format)(
                 "The environment %s doesn't have the CDK toolkit stack (%s) installed. Use %s to setup your environment for use with the toolkit.",
                 environment.name,
                 stackName,
@@ -193592,7 +193776,7 @@ var init_toolkit_info = __esm({
           }
           if (stack.stackStatus.isCreationFailure) {
             await ioHelper.defaults.debug(
-              (0, import_util32.format)(
+              (0, import_util31.format)(
                 "The environment %s has a CDK toolkit stack (%s) that failed to create. Use %s to try provisioning it again.",
                 environment.name,
                 stackName,
@@ -194145,11 +194329,11 @@ var init_environment2 = __esm({
 function suffixWithErrors2(msg, errors) {
   return errors && errors.length > 0 ? `${msg}: ${errors.join(", ")}` : msg;
 }
-var import_node_crypto4, cdk_assets, chalk12, BOOTSTRAP_STACK_VERSION_FOR_ROLLBACK, Deployments, ParallelSafeAssetProgress;
+var import_node_crypto5, cdk_assets, chalk12, BOOTSTRAP_STACK_VERSION_FOR_ROLLBACK, Deployments, ParallelSafeAssetProgress;
 var init_deployments = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts"() {
     "use strict";
-    import_node_crypto4 = require("node:crypto");
+    import_node_crypto5 = require("node:crypto");
     cdk_assets = __toESM(require_lib6());
     chalk12 = __toESM(require_source());
     init_asset_manifest_builder();
@@ -194320,7 +194504,7 @@ var init_deployments = __esm({
         }
         await cfn.deleteChangeSet({ StackName: deployName, ChangeSetName: changeSetName });
         if (cloudFormationStack.stackStatus.name === "REVIEW_IN_PROGRESS") {
-          await cfn.deleteStack({ StackName: deployName, ClientRequestToken: (0, import_node_crypto4.randomUUID)() });
+          await cfn.deleteStack({ StackName: deployName, ClientRequestToken: (0, import_node_crypto5.randomUUID)() });
           await waitForStackDelete(cfn, this.ioHelper, deployName);
         }
       }
@@ -194376,7 +194560,7 @@ var init_deployments = __esm({
               await cfn.rollbackStack({
                 StackName: stackArn,
                 RoleARN: executionRoleArn,
-                ClientRequestToken: (0, import_node_crypto4.randomUUID)(),
+                ClientRequestToken: (0, import_node_crypto5.randomUUID)(),
                 // Enabling this is just the better overall default, the only reason it isn't the upstream default is backwards compatibility
                 RetainExceptOnCreate: true
               });
@@ -194394,7 +194578,7 @@ var init_deployments = __esm({
               await this.ioHelper.defaults.warn(`Continuing rollback of stack ${deployName}${skipDescription}`);
               await cfn.continueUpdateRollback({
                 StackName: stackArn,
-                ClientRequestToken: (0, import_node_crypto4.randomUUID)(),
+                ClientRequestToken: (0, import_node_crypto5.randomUUID)(),
                 RoleARN: executionRoleArn,
                 ResourcesToSkip: resourcesToSkip
               });
@@ -197730,14 +197914,14 @@ var init_getProfileName = __esm({
 });
 
 // ../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-var import_node_crypto5, import_node_path2, getSSOTokenFilepath;
+var import_node_crypto6, import_node_path2, getSSOTokenFilepath;
 var init_getSSOTokenFilepath = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
-    import_node_crypto5 = require("node:crypto");
+    import_node_crypto6 = require("node:crypto");
     import_node_path2 = require("node:path");
     init_getHomeDir();
     getSSOTokenFilepath = /* @__PURE__ */ __name((id) => {
-      const hasher = (0, import_node_crypto5.createHash)("sha1");
+      const hasher = (0, import_node_crypto6.createHash)("sha1");
       const cacheName = hasher.update(id).digest("hex");
       return (0, import_node_path2.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     }, "getSSOTokenFilepath");
@@ -199972,10 +200156,10 @@ function castSourceData(toCast, encoding) {
   }
   return fromArrayBuffer(toCast);
 }
-var import_node_crypto6, Hash19;
+var import_node_crypto7, Hash19;
 var init_hash_node = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/core/dist-es/submodules/serde/hash-node/hash-node.js"() {
-    import_node_crypto6 = require("node:crypto");
+    import_node_crypto7 = require("node:crypto");
     init_buffer_from();
     init_toUint8Array();
     Hash19 = class {
@@ -199997,7 +200181,7 @@ var init_hash_node = __esm({
         return Promise.resolve(this.hash.digest());
       }
       reset() {
-        this.hash = this.secret ? (0, import_node_crypto6.createHmac)(this.algorithmIdentifier, castSourceData(this.secret)) : (0, import_node_crypto6.createHash)(this.algorithmIdentifier);
+        this.hash = this.secret ? (0, import_node_crypto7.createHmac)(this.algorithmIdentifier, castSourceData(this.secret)) : (0, import_node_crypto7.createHash)(this.algorithmIdentifier);
       }
     };
     __name(castSourceData, "castSourceData");
@@ -200998,10 +201182,10 @@ __export(serde_exports2, {
   toUtf8: () => toUtf836,
   v4: () => v42
 });
-var import_node_crypto7, Uint8ArrayBlobAdapter2, _getRandomValues, v42, generateIdempotencyToken2;
+var import_node_crypto8, Uint8ArrayBlobAdapter2, _getRandomValues, v42, generateIdempotencyToken2;
 var init_serde3 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/core/dist-es/submodules/serde/index.js"() {
-    import_node_crypto7 = require("node:crypto");
+    import_node_crypto8 = require("node:crypto");
     init_fromBase64();
     init_toBase64();
     init_Uint8ArrayBlobAdapter();
@@ -201039,7 +201223,7 @@ var init_serde3 = __esm({
         __name(this, "Uint8ArrayBlobAdapter");
       }
     };
-    _getRandomValues = import_node_crypto7.getRandomValues;
+    _getRandomValues = import_node_crypto8.getRandomValues;
     v42 = bindV4(_getRandomValues);
     generateIdempotencyToken2 = v42;
   }
@@ -214885,10 +215069,10 @@ function castSourceData2(toCast, encoding) {
   }
   return fromArrayBuffer2(toCast);
 }
-var import_node_crypto8, Hash20;
+var import_node_crypto9, Hash20;
 var init_hash_node2 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/signature-v4/node_modules/@smithy/core/dist-es/submodules/serde/hash-node/hash-node.js"() {
-    import_node_crypto8 = require("node:crypto");
+    import_node_crypto9 = require("node:crypto");
     init_buffer_from2();
     init_toUint8Array2();
     Hash20 = class {
@@ -214910,7 +215094,7 @@ var init_hash_node2 = __esm({
         return Promise.resolve(this.hash.digest());
       }
       reset() {
-        this.hash = this.secret ? (0, import_node_crypto8.createHmac)(this.algorithmIdentifier, castSourceData2(this.secret)) : (0, import_node_crypto8.createHash)(this.algorithmIdentifier);
+        this.hash = this.secret ? (0, import_node_crypto9.createHmac)(this.algorithmIdentifier, castSourceData2(this.secret)) : (0, import_node_crypto9.createHash)(this.algorithmIdentifier);
       }
     };
     __name(castSourceData2, "castSourceData");
@@ -215911,10 +216095,10 @@ __export(serde_exports3, {
   toUtf8: () => toUtf838,
   v4: () => v43
 });
-var import_node_crypto9, Uint8ArrayBlobAdapter3, _getRandomValues2, v43, generateIdempotencyToken3;
+var import_node_crypto10, Uint8ArrayBlobAdapter3, _getRandomValues2, v43, generateIdempotencyToken3;
 var init_serde4 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/signature-v4/node_modules/@smithy/core/dist-es/submodules/serde/index.js"() {
-    import_node_crypto9 = require("node:crypto");
+    import_node_crypto10 = require("node:crypto");
     init_fromBase642();
     init_toBase642();
     init_Uint8ArrayBlobAdapter2();
@@ -215952,7 +216136,7 @@ var init_serde4 = __esm({
         __name(this, "Uint8ArrayBlobAdapter");
       }
     };
-    _getRandomValues2 = import_node_crypto9.getRandomValues;
+    _getRandomValues2 = import_node_crypto10.getRandomValues;
     v43 = bindV42(_getRandomValues2);
     generateIdempotencyToken3 = v43;
   }
@@ -217091,14 +217275,14 @@ var init_getProfileName3 = __esm({
 });
 
 // ../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/credential-provider-imds/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-var import_node_crypto10, import_node_path13, getSSOTokenFilepath2;
+var import_node_crypto11, import_node_path13, getSSOTokenFilepath2;
 var init_getSSOTokenFilepath2 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/credential-provider-imds/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
-    import_node_crypto10 = require("node:crypto");
+    import_node_crypto11 = require("node:crypto");
     import_node_path13 = require("node:path");
     init_getHomeDir3();
     getSSOTokenFilepath2 = /* @__PURE__ */ __name((id) => {
-      const hasher = (0, import_node_crypto10.createHash)("sha1");
+      const hasher = (0, import_node_crypto11.createHash)("sha1");
       const cacheName = hasher.update(id).digest("hex");
       return (0, import_node_path13.join)(getHomeDir3(), ".aws", "sso", "cache", `${cacheName}.json`);
     }, "getSSOTokenFilepath");
@@ -218945,10 +219129,10 @@ var init_sdk_stream_mixin3 = __esm({
 });
 
 // ../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/credential-provider-imds/node_modules/@smithy/core/dist-es/submodules/serde/index.js
-var import_node_crypto11, Uint8ArrayBlobAdapter4, _getRandomValues3, v44, generateIdempotencyToken4;
+var import_node_crypto12, Uint8ArrayBlobAdapter4, _getRandomValues3, v44, generateIdempotencyToken4;
 var init_serde5 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/credential-provider-imds/node_modules/@smithy/core/dist-es/submodules/serde/index.js"() {
-    import_node_crypto11 = require("node:crypto");
+    import_node_crypto12 = require("node:crypto");
     init_fromBase643();
     init_toBase643();
     init_Uint8ArrayBlobAdapter3();
@@ -218969,7 +219153,7 @@ var init_serde5 = __esm({
         __name(this, "Uint8ArrayBlobAdapter");
       }
     };
-    _getRandomValues3 = import_node_crypto11.getRandomValues;
+    _getRandomValues3 = import_node_crypto12.getRandomValues;
     v44 = bindV43(_getRandomValues3);
     generateIdempotencyToken4 = v44;
   }
@@ -224139,10 +224323,10 @@ var init_sdk_stream_mixin4 = __esm({
 });
 
 // ../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/node-http-handler/node_modules/@smithy/core/dist-es/submodules/serde/index.js
-var import_node_crypto12, Uint8ArrayBlobAdapter5, _getRandomValues4, v45, generateIdempotencyToken5;
+var import_node_crypto13, Uint8ArrayBlobAdapter5, _getRandomValues4, v45, generateIdempotencyToken5;
 var init_serde6 = __esm({
   "../../node_modules/@aws-sdk/client-appsync/node_modules/@smithy/node-http-handler/node_modules/@smithy/core/dist-es/submodules/serde/index.js"() {
-    import_node_crypto12 = require("node:crypto");
+    import_node_crypto13 = require("node:crypto");
     init_fromBase644();
     init_toBase644();
     init_Uint8ArrayBlobAdapter4();
@@ -224163,7 +224347,7 @@ var init_serde6 = __esm({
         __name(this, "Uint8ArrayBlobAdapter");
       }
     };
-    _getRandomValues4 = import_node_crypto12.getRandomValues;
+    _getRandomValues4 = import_node_crypto13.getRandomValues;
     v45 = bindV44(_getRandomValues4);
     generateIdempotencyToken5 = v45;
   }
@@ -426165,11 +426349,11 @@ function sdkRequestHandler(agent) {
     httpAgent: agent
   };
 }
-var import_node_util2, import_credential_providers2, import_ec2_metadata_service, import_shared_ini_file_loader, DEFAULT_CONNECTION_TIMEOUT, DEFAULT_TIMEOUT, AwsCliCompatible;
+var import_node_util3, import_credential_providers2, import_ec2_metadata_service, import_shared_ini_file_loader, DEFAULT_CONNECTION_TIMEOUT, DEFAULT_TIMEOUT, AwsCliCompatible;
 var init_awscli_compatible = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/awscli-compatible.ts"() {
     "use strict";
-    import_node_util2 = require("node:util");
+    import_node_util3 = require("node:util");
     import_credential_providers2 = __toESM(require_dist_cjs128());
     import_ec2_metadata_service = __toESM(require_dist_cjs222());
     import_shared_ini_file_loader = __toESM(require_dist_cjs28());
@@ -426308,7 +426492,7 @@ var init_awscli_compatible = __esm({
        * Result is send to callback function for SDK to authorize the request
        */
       async tokenCodeFn(deviceArn) {
-        const debugFn = /* @__PURE__ */ __name((msg, ...args) => this.ioHelper.defaults.debug((0, import_node_util2.format)(msg, ...args)), "debugFn");
+        const debugFn = /* @__PURE__ */ __name((msg, ...args) => this.ioHelper.defaults.debug((0, import_node_util3.format)(msg, ...args)), "debugFn");
         await debugFn("Require MFA token from MFA device with ARN", deviceArn);
         try {
           const token = await this.ioHelper.requestResponse(IO.CDK_SDK_I1100.req(`MFA token for ${deviceArn}`, {
@@ -426341,7 +426525,7 @@ async function v3ProviderFromPlugin(producer) {
   } else if (isV2Credentials(initial)) {
     return v3ProviderFromV2Credentials(initial);
   } else {
-    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util43.inspect)(initial)}`);
+    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util42.inspect)(initial)}`);
   }
 }
 function v3ProviderFromV2Credentials(x) {
@@ -426360,7 +426544,7 @@ function refreshFromPluginProvider(current, producer) {
     if (credentialsAboutToExpire(current)) {
       const newCreds = await producer();
       if (!isV3Credentials(newCreds)) {
-        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util43.inspect)(newCreds)}`);
+        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util42.inspect)(newCreds)}`);
       }
       current = newCreds;
     }
@@ -426376,11 +426560,11 @@ function isV2Credentials(x) {
 function isV3Credentials(x) {
   return !!(x && typeof x === "object" && x.accessKeyId && !isV2Credentials(x));
 }
-var import_util43, CredentialPlugins;
+var import_util42, CredentialPlugins;
 var init_credential_plugins = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts"() {
     "use strict";
-    import_util43 = require("util");
+    import_util42 = require("util");
     init_provider_caching();
     init_toolkit_error();
     init_util3();
@@ -426779,7 +426963,7 @@ function formatSdkLoggerContent(content) {
       return apiFmt;
     }
   }
-  return content.map((x) => typeof x === "string" ? x : (0, import_util46.inspect)(x)).join("");
+  return content.map((x) => typeof x === "string" ? x : (0, import_util45.inspect)(x)).join("");
 }
 function formatApiCall(content) {
   if (!isSdkApiCallSuccess(content) && !isSdkApiCallError(content)) {
@@ -426805,11 +426989,11 @@ function isSdkApiCallSuccess(x) {
 function isSdkApiCallError(x) {
   return x && typeof x === "object" && x.commandName && x.error;
 }
-var import_util46, IoHostSdkLogger;
+var import_util45, IoHostSdkLogger;
 var init_sdk_logger = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-logger.ts"() {
     "use strict";
-    import_util46 = require("util");
+    import_util45 = require("util");
     init_util3();
     init_private();
     IoHostSdkLogger = class {
@@ -426821,7 +427005,7 @@ var init_sdk_logger = __esm({
         this.ioHelper = ioHelper;
       }
       notify(level, ...content) {
-        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util46.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
+        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util45.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
           sdkLevel: level,
           content
         }));
@@ -431700,14 +431884,14 @@ function settingsFromSynthOptions(synthOpts = {}) {
 function parametersFromSynthOptions(synthOptions) {
   return synthParametersFromSettings(settingsFromSynthOptions(synthOptions ?? {}));
 }
-var import_dispose_polyfill4, os10, path31, import_node_util3, import_cloud_assembly_api11, cxschema10, cxapi5, fs30, import_semver, ExecutionEnvironment;
+var import_dispose_polyfill4, os10, path31, import_node_util4, import_cloud_assembly_api11, cxschema10, cxapi5, fs30, import_semver, ExecutionEnvironment;
 var init_prepare_source = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/prepare-source.ts"() {
     "use strict";
     import_dispose_polyfill4 = __toESM(require_dispose_polyfill());
     os10 = __toESM(require("node:os"));
     path31 = __toESM(require("node:path"));
-    import_node_util3 = require("node:util");
+    import_node_util4 = require("node:util");
     import_cloud_assembly_api11 = __toESM(require_lib3());
     cxschema10 = __toESM(require_lib2());
     cxapi5 = __toESM(require_lib12());
@@ -431845,10 +432029,10 @@ var init_prepare_source = __esm({
         const debugFn = /* @__PURE__ */ __name((msg) => this.ioHelper.notify(IO.CDK_ASSEMBLY_I0010.msg(msg)), "debugFn");
         const env3 = this.options.resolveDefaultAppEnv ? await prepareDefaultEnvironment(this.sdkProvider, debugFn) : {};
         env3[cxapi5.OUTDIR_ENV] = this.outdir;
-        await debugFn((0, import_node_util3.format)("outdir:", this.outdir));
+        await debugFn((0, import_node_util4.format)("outdir:", this.outdir));
         env3[cxapi5.CLI_ASM_VERSION_ENV] = cxschema10.Manifest.version();
         env3[cxapi5.CLI_VERSION_ENV] = versionNumber();
-        await debugFn((0, import_node_util3.format)("env:", env3));
+        await debugFn((0, import_node_util4.format)("env:", env3));
         return env3;
       }
       /**
@@ -431913,12 +432097,12 @@ var init_readable_assembly = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts
-var path32, import_util51, cxapi6, fs32, CloudAssemblySourceBuilder;
+var path32, import_util50, cxapi6, fs32, CloudAssemblySourceBuilder;
 var init_source_builder = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts"() {
     "use strict";
     path32 = __toESM(require("path"));
-    import_util51 = require("util");
+    import_util50 = require("util");
     cxapi6 = __toESM(require_lib3());
     fs32 = __toESM(require_lib4());
     init_context_store();
@@ -431984,7 +432168,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util51.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util50.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Versioning, outdir, default account and region
                   ...await execution.defaultEnvVars(),
@@ -432123,7 +432307,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util51.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util50.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Need to start with full env of `writeContextToEnv` will not be able to do the size
                   // calculation correctly.
@@ -432803,11 +432987,11 @@ function obscureDiff(diff) {
     });
   }
 }
-var import_node_util4, import_cloudformation_diff, chalk14, DiffFormatter;
+var import_node_util5, import_cloudformation_diff, chalk14, DiffFormatter;
 var init_diff_formatter = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/diff/diff-formatter.ts"() {
     "use strict";
-    import_node_util4 = require("node:util");
+    import_node_util5 = require("node:util");
     import_cloudformation_diff = __toESM(require_lib10());
     chalk14 = __toESM(require_source());
     init_payloads();
@@ -432891,7 +433075,7 @@ var init_diff_formatter = __esm({
         let filteredChangesCount = 0;
         try {
           if (stackName && (!options.quiet || !diff.isEmpty)) {
-            stream.write((0, import_node_util4.format)(`Stack ${chalk14.bold(stackName)}
+            stream.write((0, import_node_util5.format)(`Stack ${chalk14.bold(stackName)}
 `));
           }
           if (!options.quiet && this.isImport) {
@@ -432966,7 +433150,7 @@ var init_diff_formatter = __esm({
         const permissionChangeType = permissionTypeFromDiff(diff);
         const stream = new StringWriteStream();
         if (!options.quiet || permissionChangeType !== "none" /* NONE */) {
-          stream.write((0, import_node_util4.format)(`Stack ${chalk14.bold(stackName)}
+          stream.write((0, import_node_util5.format)(`Stack ${chalk14.bold(stackName)}
 `));
         }
         try {
@@ -433049,11 +433233,11 @@ var init_io = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/logs-monitor/logs-monitor.ts
-var import_node_crypto13, util6, chalk15, CloudWatchLogEventMonitor;
+var import_node_crypto14, util6, chalk15, CloudWatchLogEventMonitor;
 var init_logs_monitor2 = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/logs-monitor/logs-monitor.ts"() {
     "use strict";
-    import_node_crypto13 = require("node:crypto");
+    import_node_crypto14 = require("node:crypto");
     util6 = __toESM(require("node:util"));
     chalk15 = __toESM(require_source());
     init_util3();
@@ -433089,7 +433273,7 @@ var init_logs_monitor2 = __esm({
        * resume reading/printing events
        */
       async activate() {
-        this.monitorId = (0, import_node_crypto13.randomUUID)();
+        this.monitorId = (0, import_node_crypto14.randomUUID)();
         await this.ioHelper.notify(IO.CDK_TOOLKIT_I5032.msg("Start monitoring log groups", {
           monitor: this.monitorId,
           logGroupNames: this.logGroupNames()
@@ -433356,11 +433540,11 @@ function removeNonImportResources(stack) {
   delete template.Outputs;
   return template;
 }
-var import_util56, cfnDiff, chalk16, fs33, ResourceImporter;
+var import_util55, cfnDiff, chalk16, fs33, ResourceImporter;
 var init_importer = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts"() {
     "use strict";
-    import_util56 = require("util");
+    import_util55 = require("util");
     cfnDiff = __toESM(require_lib10());
     chalk16 = __toESM(require_source());
     fs33 = __toESM(require_lib4());
@@ -433424,12 +433608,12 @@ var init_importer = __esm({
           const descr = this.describeResource(resource.logicalId);
           const idProps = remaining[resource.logicalId];
           if (idProps) {
-            await this.ioHelper.defaults.info((0, import_util56.format)("%s: importing using %s", chalk16.blue(descr), chalk16.blue(fmtdict(idProps))));
+            await this.ioHelper.defaults.info((0, import_util55.format)("%s: importing using %s", chalk16.blue(descr), chalk16.blue(fmtdict(idProps))));
             ret.importResources.push(resource);
             ret.resourceMap[resource.logicalId] = idProps;
             delete remaining[resource.logicalId];
           } else {
-            await this.ioHelper.defaults.info((0, import_util56.format)("%s: skipping", chalk16.blue(descr)));
+            await this.ioHelper.defaults.info((0, import_util55.format)("%s: skipping", chalk16.blue(descr)));
           }
         }
         const unknown = Object.keys(remaining);
@@ -433473,9 +433657,9 @@ var init_importer = __esm({
           });
           assertIsSuccessfulDeployStackResult(result2);
           const message2 = result2.noOp ? " \u2705  %s (no changes)" : " \u2705  %s";
-          await this.ioHelper.defaults.info("\n" + chalk16.green((0, import_util56.format)(message2, this.stack.displayName)));
+          await this.ioHelper.defaults.info("\n" + chalk16.green((0, import_util55.format)(message2, this.stack.displayName)));
         } catch (e32) {
-          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util56.format)("\n \u274C  %s failed: %s", chalk16.bold(this.stack.displayName), e32), { error: e32 }));
+          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util55.format)("\n \u274C  %s failed: %s", chalk16.bold(this.stack.displayName), e32), { error: e32 }));
           throw e32;
         }
       }
@@ -433605,7 +433789,7 @@ var init_importer = __esm({
           for (const idProp of idProps) {
             const defaultValue2 = resourceProps[idProp] ?? "";
             const response = await this.ioHelper.requestResponse(IO.CDK_TOOLKIT_I3110.req(
-              (0, import_util56.format)(promptPattern, chalk16.blue(idProp)),
+              (0, import_util55.format)(promptPattern, chalk16.blue(idProp)),
               {
                 resource: {
                   name: resourceName,
@@ -435631,7 +435815,6 @@ __export(api_exports, {
   some: () => some,
   spaceAvailableForContext: () => spaceAvailableForContext,
   synthParametersFromSettings: () => synthParametersFromSettings,
-  templateContainsNestedStacks: () => templateContainsNestedStacks,
   writeContextToEnv: () => writeContextToEnv
 });
 var init_api = __esm({
@@ -439298,7 +439481,7 @@ async function cfnDiff2(ioHelper, stacks, deployments, options, sdkProvider, inc
       parameters: methodOptions.parameters ?? {},
       failOnError: !(methodOptions.fallbackToTemplate ?? true),
       importExistingResources: methodOptions.importExistingResources,
-      uuid: (0, import_node_crypto14.randomUUID)(),
+      uuid: (0, import_node_crypto15.randomUUID)(),
       willExecute: false
     }) : void 0;
     if (changeSet) {
@@ -439349,11 +439532,11 @@ function appendObject(obj1, obj2) {
   }
   return obj1;
 }
-var import_node_crypto14, fs35;
+var import_node_crypto15, fs35;
 var init_helpers5 = __esm({
   "../@aws-cdk/toolkit-lib/lib/actions/diff/private/helpers.ts"() {
     "use strict";
-    import_node_crypto14 = require("node:crypto");
+    import_node_crypto15 = require("node:crypto");
     fs35 = __toESM(require_lib4());
     init_diff4();
     init_cfn_api();
@@ -439487,11 +439670,11 @@ var init_tags2 = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/drift/drift-formatter.ts
-var import_node_util5, import_cloudformation_diff3, import_client_cloudformation5, chalk23, DriftFormatter, ADDITION3, CONTEXT2, UPDATE3, REMOVAL3;
+var import_node_util6, import_cloudformation_diff3, import_client_cloudformation5, chalk23, DriftFormatter, ADDITION3, CONTEXT2, UPDATE3, REMOVAL3;
 var init_drift_formatter = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/drift/drift-formatter.ts"() {
     "use strict";
-    import_node_util5 = require("node:util");
+    import_node_util6 = require("node:util");
     import_cloudformation_diff3 = __toESM(require_lib10());
     import_client_cloudformation5 = __toESM(require_dist_cjs144());
     chalk23 = __toESM(require_source());
@@ -439523,7 +439706,7 @@ var init_drift_formatter = __esm({
       formatStackDrift() {
         const formatterOutput = this.formatStackDriftChanges(buildLogicalToPathMap(this.stack).toPath);
         const actualDrifts = this.resourceDriftResults.filter((d32) => (d32.StackResourceDriftStatus === "MODIFIED" || d32.StackResourceDriftStatus === "DELETED") && d32.ResourceType !== "AWS::CDK::Metadata");
-        const stackHeader = (0, import_node_util5.format)(`Stack ${chalk23.bold(this.stackName)}
+        const stackHeader = (0, import_node_util6.format)(`Stack ${chalk23.bold(this.stackName)}
 `);
         if (actualDrifts.length === 0) {
           const finalResult2 = chalk23.green("No drift detected\n");
@@ -439645,15 +439828,15 @@ ${actualDrifts.length} resource${actualDrifts.length === 1 ? "" : "s"} ${actualD
         return "\n";
       }
       formatTreeDiff(propertyPath, difference2, isLast) {
-        let result2 = (0, import_node_util5.format)(
+        let result2 = (0, import_node_util6.format)(
           " %s\u2500 %s %s\n",
           isLast ? "\u2514" : "\u251C",
           difference2.isAddition ? ADDITION3 : difference2.isRemoval ? REMOVAL3 : UPDATE3,
           propertyPath
         );
         if (difference2.isUpdate) {
-          result2 += (0, import_node_util5.format)("     \u251C\u2500 %s %s\n", REMOVAL3, chalk23.red(difference2.oldValue));
-          result2 += (0, import_node_util5.format)("     \u2514\u2500 %s %s\n", ADDITION3, chalk23.green(difference2.newValue));
+          result2 += (0, import_node_util6.format)("     \u251C\u2500 %s %s\n", REMOVAL3, chalk23.red(difference2.oldValue));
+          result2 += (0, import_node_util6.format)("     \u2514\u2500 %s %s\n", ADDITION3, chalk23.green(difference2.newValue));
         }
         return result2;
       }
@@ -439671,7 +439854,7 @@ async function detectStackDrift(cfn, ioHelper, stackName) {
     StackName: stackName
   });
   await ioHelper.defaults.trace(
-    (0, import_node_util6.format)("Detecting drift with ID %s for stack %s...", driftDetection.StackDriftDetectionId, stackName)
+    (0, import_node_util7.format)("Detecting drift with ID %s for stack %s...", driftDetection.StackDriftDetectionId, stackName)
   );
   const driftStatus = await waitForDriftDetection(cfn, ioHelper, driftDetection.StackDriftDetectionId);
   if (driftStatus?.StackDriftStatus === "UNKNOWN") {
@@ -439721,11 +439904,11 @@ async function waitForDriftDetection(cfn, ioHelper, driftDetectionId) {
     await new Promise((resolve15) => setTimeout(resolve15, timeBetweenApiCalls));
   }
 }
-var import_node_util6;
+var import_node_util7;
 var init_drift2 = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/drift/drift.ts"() {
     "use strict";
-    import_node_util6 = require("node:util");
+    import_node_util7 = require("node:util");
     init_toolkit_error();
     init_string_manipulation();
     __name(detectStackDrift, "detectStackDrift");
@@ -442014,7 +442197,7 @@ async function getOrCreateInstallationId(ioHelper) {
         return cachedId;
       }
     }
-    const newId = (0, import_node_crypto15.randomUUID)();
+    const newId = (0, import_node_crypto16.randomUUID)();
     try {
       fs37.writeFileSync(INSTALLATION_ID_PATH, newId);
     } catch (e32) {
@@ -442023,14 +442206,14 @@ async function getOrCreateInstallationId(ioHelper) {
     return newId;
   } catch (e32) {
     await ioHelper.defaults.trace(`Error getting installation ID: ${e32}`);
-    return (0, import_node_crypto15.randomUUID)();
+    return (0, import_node_crypto16.randomUUID)();
   }
 }
-var import_node_crypto15, fs37, path35, INSTALLATION_ID_PATH;
+var import_node_crypto16, fs37, path35, INSTALLATION_ID_PATH;
 var init_installation_id = __esm({
   "lib/cli/telemetry/installation-id.ts"() {
     "use strict";
-    import_node_crypto15 = require("node:crypto");
+    import_node_crypto16 = require("node:crypto");
     fs37 = __toESM(require("node:fs"));
     path35 = __toESM(require("node:path"));
     init_util9();
@@ -442043,7 +442226,7 @@ var init_installation_id = __esm({
 async function getLibraryVersion(ioHelper) {
   try {
     const command = `node -e 'process.stdout.write(require.resolve("aws-cdk-lib"))'`;
-    const { stdout } = await (0, import_util69.promisify)(import_child_process.exec)(command);
+    const { stdout } = await (0, import_util68.promisify)(import_child_process.exec)(command);
     if (!fs38.existsSync(stdout)) {
       await ioHelper.defaults.trace('Could not get CDK Library Version: require.resolve("aws-cdk-lib") did not return a file path');
       return;
@@ -442060,13 +442243,13 @@ async function getLibraryVersion(ioHelper) {
     return;
   }
 }
-var import_child_process, path36, import_util69, fs38;
+var import_child_process, path36, import_util68, fs38;
 var init_library_version = __esm({
   "lib/cli/telemetry/library-version.ts"() {
     "use strict";
     import_child_process = require("child_process");
     path36 = __toESM(require("path"));
-    import_util69 = require("util");
+    import_util68 = require("util");
     fs38 = __toESM(require_lib4());
     __name(getLibraryVersion, "getLibraryVersion");
   }
@@ -443578,11 +443761,11 @@ function isAbortedError(error5) {
 function mutable(x) {
   return x;
 }
-var import_node_crypto16, import_toolkit_lib3, ABORTED_ERROR_MESSAGE, TelemetrySession;
+var import_node_crypto17, import_toolkit_lib3, ABORTED_ERROR_MESSAGE, TelemetrySession;
 var init_session = __esm({
   "lib/cli/telemetry/session.ts"() {
     "use strict";
-    import_node_crypto16 = require("node:crypto");
+    import_node_crypto17 = require("node:crypto");
     import_toolkit_lib3 = __toESM(require_lib13());
     init_installation_id();
     init_library_version();
@@ -443608,7 +443791,7 @@ var init_session = __esm({
         this._sessionInfo = {
           identifiers: {
             installationId: await getOrCreateInstallationId(this.ioHost.asIoHelper()),
-            sessionId: (0, import_node_crypto16.randomUUID)(),
+            sessionId: (0, import_node_crypto17.randomUUID)(),
             telemetryVersion: "2.0",
             cdkCliVersion: versionNumber2(),
             cdkLibraryVersion: await getLibraryVersion(this.ioHost.asIoHelper())
@@ -444993,7 +445176,7 @@ async function execProgram(aws, ioHelper, config2) {
     ...config2.context.all,
     ...params.context
   };
-  await debugFn((0, import_util71.format)("context:", context));
+  await debugFn((0, import_util70.format)("context:", context));
   if (params.env.CDK_DEBUG === "true") {
     await ioHelper.defaults.info("\u{1F50D} Synthesizing with debug information. This may take a bit longer.");
   }
@@ -445043,7 +445226,7 @@ async function execProgram(aws, ioHelper, config2) {
   const perfCountersFile = path39.join(outdir, "performance-counters.json");
   await fs43.promises.rm(perfCountersFile, { force: true });
   env3.CDK_PERF_COUNTERS_FILE = perfCountersFile;
-  await debugFn((0, import_util71.format)("env:", env3));
+  await debugFn((0, import_util70.format)("env:", env3));
   const cleanupTemp = writeContextToEnv(env3, context, "add-process-env-later");
   try {
     await exec5(commandLine);
@@ -445096,12 +445279,12 @@ function createAssembly(appDir) {
 function noUndefined2(xs) {
   return Object.fromEntries(Object.entries(xs).filter(([_2, v]) => v !== void 0));
 }
-var path39, import_util71, import_cloud_assembly_api16, cxschema11, cxapi10, import_toolkit_lib12, fs43;
+var path39, import_util70, import_cloud_assembly_api16, cxschema11, cxapi10, import_toolkit_lib12, fs43;
 var init_exec2 = __esm({
   "lib/cxapp/exec.ts"() {
     "use strict";
     path39 = __toESM(require("path"));
-    import_util71 = require("util");
+    import_util70 = require("util");
     import_cloud_assembly_api16 = __toESM(require_lib3());
     cxschema11 = __toESM(require_lib2());
     cxapi10 = __toESM(require_lib12());
@@ -448013,13 +448196,13 @@ function stackMetadataLogger(ioHelper, verbose) {
 function requiresApproval(requireApproval, permissionChangeType) {
   return requireApproval === import_cloud_assembly_schema7.RequireApproval.ANYCHANGE || requireApproval === import_cloud_assembly_schema7.RequireApproval.BROADENING && permissionChangeType === import_toolkit_lib18.PermissionChangeType.BROADENING;
 }
-var import_node_crypto17, path44, import_node_util7, cxapi11, import_cloud_assembly_schema7, import_toolkit_lib18, chalk31, fs47, pLimit5, FILE_EVENTS2, InternalToolkit, CdkToolkit;
+var import_node_crypto18, path44, import_node_util8, cxapi11, import_cloud_assembly_schema7, import_toolkit_lib18, chalk31, fs47, pLimit5, FILE_EVENTS2, InternalToolkit, CdkToolkit;
 var init_cdk_toolkit = __esm({
   "lib/cli/cdk-toolkit.ts"() {
     "use strict";
-    import_node_crypto17 = require("node:crypto");
+    import_node_crypto18 = require("node:crypto");
     path44 = __toESM(require("node:path"));
-    import_node_util7 = require("node:util");
+    import_node_util8 = require("node:util");
     cxapi11 = __toESM(require_lib3());
     import_cloud_assembly_schema7 = __toESM(require_lib2());
     import_toolkit_lib18 = __toESM(require_lib13());
@@ -448205,7 +448388,7 @@ var init_cdk_toolkit = __esm({
             }
           }
         }
-        await this.ioHost.asIoHelper().defaults.info((0, import_node_util7.format)("\n\u2728  Number of stacks with differences: %s\n", diffs));
+        await this.ioHost.asIoHelper().defaults.info((0, import_node_util8.format)("\n\u2728  Number of stacks with differences: %s\n", diffs));
         return diffs && options.fail ? 1 : 0;
       }
       /**
@@ -448234,7 +448417,7 @@ var init_cdk_toolkit = __esm({
         }
         return cfn_api_exports.createDiffChangeSet(asIoHelper(this.ioHost, "diff"), {
           stack,
-          uuid: (0, import_node_crypto17.randomUUID)(),
+          uuid: (0, import_node_crypto18.randomUUID)(),
           deployments: this.props.deployments,
           willExecute: false,
           sdkProvider: this.props.sdkProvider,
@@ -449284,14 +449467,14 @@ async function execNpmView(currentVersion) {
     throw err;
   }
 }
-var import_child_process2, import_util76, import_toolkit_lib19, exec2;
+var import_child_process2, import_util75, import_toolkit_lib19, exec2;
 var init_npm = __esm({
   "lib/cli/util/npm.ts"() {
     "use strict";
     import_child_process2 = require("child_process");
-    import_util76 = require("util");
+    import_util75 = require("util");
     import_toolkit_lib19 = __toESM(require_lib13());
-    exec2 = (0, import_util76.promisify)(import_child_process2.exec);
+    exec2 = (0, import_util75.promisify)(import_child_process2.exec);
     __name(execNpmView, "execNpmView");
   }
 });
@@ -483913,7 +484096,7 @@ async function docs(options) {
   await ioHelper.defaults.info(chalk35.green(url));
   const browserCommand = options.browser.replace(/%u/g, url);
   await ioHelper.defaults.debug(`Opening documentation ${chalk35.green(browserCommand)}`);
-  const exec5 = (0, import_node_util8.promisify)(childProcess2.exec);
+  const exec5 = (0, import_node_util9.promisify)(childProcess2.exec);
   try {
     const { stdout, stderr } = await exec5(browserCommand);
     if (stdout) {
@@ -483928,12 +484111,12 @@ async function docs(options) {
   }
   return 0;
 }
-var childProcess2, import_node_util8, chalk35;
+var childProcess2, import_node_util9, chalk35;
 var init_docs = __esm({
   "lib/commands/docs.ts"() {
     "use strict";
     childProcess2 = __toESM(require("child_process"));
-    import_node_util8 = require("node:util");
+    import_node_util9 = require("node:util");
     chalk35 = __toESM(require_source());
     __name(docs, "docs");
   }
@@ -488939,15 +489122,17 @@ function collectKnownOptions(optionDefs) {
 }
 function findUnknownOptions(argv) {
   const command = argv._[0];
-  const commandDef = config.commands[command];
+  const canonicalCommand = commandAliasMap.get(command) ?? command;
+  const commandDef = config.commands[canonicalCommand];
   const commandKnownOptions = commandDef?.options ? collectKnownOptions(commandDef.options) : /* @__PURE__ */ new Set();
-  const positionalArg = commandDef?.arg?.name;
+  const positionalArgRaw = commandDef?.arg?.name;
+  const positionalArgs = positionalArgRaw ? /* @__PURE__ */ new Set([positionalArgRaw, positionalArgRaw.toLowerCase()]) : /* @__PURE__ */ new Set();
   const unknown = [];
   for (const key of Object.keys(argv)) {
     if (argv[key] === void 0) {
       continue;
     }
-    if (yargsInternals.has(key) || key === positionalArg) {
+    if (yargsInternals.has(key) || positionalArgs.has(key)) {
       continue;
     }
     if (globalKnownOptions.has(key) || commandKnownOptions.has(key)) {
@@ -488967,13 +489152,21 @@ function isFromEnvPrefix(key, prefix) {
   const screamingSnake = key.replace(/[A-Z]/g, (m20) => `_${m20}`).toUpperCase();
   return process.env[`${prefix}_${screamingSnake}`] !== void 0;
 }
-var config, globalKnownOptions, yargsInternals;
+var config, globalKnownOptions, commandAliasMap, yargsInternals;
 var init_check_unknown_options = __esm({
   "lib/cli/util/check-unknown-options.ts"() {
     "use strict";
     config = require_cli_type_registry();
     __name(collectKnownOptions, "collectKnownOptions");
     globalKnownOptions = collectKnownOptions(config.globalOptions);
+    commandAliasMap = /* @__PURE__ */ new Map();
+    for (const [name, def] of Object.entries(config.commands)) {
+      if (def.aliases) {
+        for (const alias of def.aliases) {
+          commandAliasMap.set(alias, name);
+        }
+      }
+    }
     yargsInternals = /* @__PURE__ */ new Set(["_", "$0", "help", "h", "version"]);
     __name(findUnknownOptions, "findUnknownOptions");
     __name(kebabToCamel, "kebabToCamel");