aws-cdk 2.1140.0 → 2.1141.0

package/lib/index.js

@@ -1609,8 +1609,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      let parsed = new URL(switchSchema, "thismessage::/");
-      let fragment = parsed.hash;
+      let hashIndex = switchSchema.indexOf("#");
+      let fragment = hashIndex === -1 || hashIndex === switchSchema.length - 1 ? "" : switchSchema.substr(hashIndex);
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema);
@@ -3695,7 +3695,7 @@ var require_semver2 = __commonJS({
 // ../@aws-cdk/cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../@aws-cdk/cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "2.1140.0" };
+    module2.exports = { version: "2.1141.0" };
   }
 });
 
@@ -46811,6 +46811,7 @@ var require_dist_cjs15 = __commonJS({
             if (!passiveLock) {
               passiveLock = chain3(options).then((c6) => {
                 credentials = c6;
+              }).catch(() => {
               }).finally(() => {
                 passiveLock = void 0;
               });
@@ -83391,6 +83392,11 @@ var init_messages = __esm({
         description: "Stack Monitoring error",
         interface: "ErrorPayload"
       }),
+      CDK_TOOLKIT_W5500: warn({
+        code: "CDK_TOOLKIT_W5500",
+        description: "Stack events could not be read; the reported event log may be incomplete",
+        interface: "ErrorPayload"
+      }),
       // 6: Rollback (6xxx)
       CDK_TOOLKIT_I6000: info({
         code: "CDK_TOOLKIT_I6000",
@@ -92912,31 +92918,6 @@ var init_template_body_parameter = __esm({
   }
 });
 
-// ../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts
-function isAccessDeniedError(e6) {
-  const name = e6?.name ?? e6?.Code ?? "";
-  return name === "AccessDenied" || name === "AccessDeniedException";
-}
-function readIfPossible(filename) {
-  try {
-    if (!fs16.pathExistsSync(filename)) {
-      return void 0;
-    }
-    return fs16.readFileSync(filename, { encoding: "utf-8" });
-  } catch (e6) {
-    return void 0;
-  }
-}
-var fs16;
-var init_util5 = __esm({
-  "../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts"() {
-    "use strict";
-    fs16 = __toESM(require_lib4());
-    __name(isAccessDeniedError, "isAccessDeniedError");
-    __name(readIfPossible, "readIfPossible");
-  }
-});
-
 // ../@aws-cdk/toolkit-lib/lib/api/stack-events/hook-result-details.ts
 function formatHookResultDetails(result2) {
   const annotations = ("Annotations" in result2 ? result2.Annotations : void 0) ?? [];
@@ -92971,21 +92952,9 @@ async function fetchHookResultDetails(cfn, hookInvocationId, options) {
     return formatHookResultDetails(result2);
   } catch (e6) {
     const errorMessage = e6 instanceof Error ? e6.message : String(e6);
-    const isPermissionsError = isAccessDeniedError(e6) || typeof errorMessage === "string" && errorMessage.toLowerCase().includes("not authorized to perform: cloudformation:gethookresult");
-    if (isPermissionsError && options.envResources) {
-      let currentVersion = void 0;
-      try {
-        currentVersion = (await options.envResources.lookupToolkit()).version;
-      } catch {
-      }
-      await options.ioHelper.defaults.warn(
-        `Failed to fetch result details for Hook invocation ${hookInvocationId}: ${errorMessage}. Make sure you have permissions to call the GetHookResult API, or re-bootstrap your environment by running 'cdk bootstrap' to update the Bootstrap CDK Toolkit stack. Bootstrap toolkit stack version 31 or later is needed; current version: ${currentVersion ?? "unknown"}.`
-      );
-    } else {
-      await options.ioHelper.defaults.warn(
-        util4.format("Failed to fetch Hook details for invocation %s: %s", hookInvocationId, errorMessage)
-      );
-    }
+    await options.ioHelper.defaults.warn(
+      util4.format("Could not fetch extra detail for Hook invocation %s (%s). Run again with -v to see the full error.", hookInvocationId, errorMessage)
+    );
     return void 0;
   }
 }
@@ -92998,7 +92967,6 @@ var init_hook_result_details = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/stack-events/hook-result-details.ts"() {
     "use strict";
     util4 = __toESM(require("node:util"));
-    init_util5();
     __name(formatHookResultDetails, "formatHookResultDetails");
     __name(isFailedHookStatus, "isFailedHookStatus");
     __name(fetchHookResultDetails, "fetchHookResultDetails");
@@ -93590,7 +93558,6 @@ var init_stack_activity_monitor = __esm({
       stackDisplayName;
       stack;
       cfn;
-      envResources;
       isStackUpdate;
       constructor({
         cfn,
@@ -93600,14 +93567,12 @@ var init_stack_activity_monitor = __esm({
         resourcesTotal,
         changeSetCreationTime,
         pollingInterval = 2e3,
-        envResources,
         isStackUpdate = false
       }) {
         this.ioHelper = ioHelper;
         this.stack = stack;
         this.stackDisplayName = stackNameFromArn(stackArn);
         this.cfn = cfn;
-        this.envResources = envResources;
         this.isStackUpdate = isStackUpdate;
         this.progressMonitor = new StackProgressMonitor(resourcesTotal);
         this.pollingInterval = pollingInterval;
@@ -93675,7 +93640,6 @@ var init_stack_activity_monitor = __esm({
         try {
           this.readPromise = this.readNewEvents(this.monitorId);
           await this.readPromise;
-          this.readPromise = void 0;
           if (!this.monitorId) {
             return;
           }
@@ -93684,6 +93648,8 @@ var init_stack_activity_monitor = __esm({
             util6.format("Error occurred while monitoring stack: %s", e6),
             { error: e6 }
           ));
+        } finally {
+          this.readPromise = void 0;
         }
         this.scheduleNextTick();
       }
@@ -93705,8 +93671,7 @@ var init_stack_activity_monitor = __esm({
           this.progressMonitor.process(resourceEvent);
           if (resourceEvent.event.HookInvocationId) {
             const details = await fetchHookResultDetails(this.cfn, resourceEvent.event.HookInvocationId, {
-              ioHelper: this.ioHelper,
-              envResources: this.envResources
+              ioHelper: this.ioHelper
             });
             if (details) {
               resourceEvent.event.HookStatusReason = details;
@@ -93728,10 +93693,20 @@ var init_stack_activity_monitor = __esm({
        * reached the last page.
        */
       async finalPollToEnd(monitorId) {
-        if (this.readPromise) {
+        try {
           await this.readPromise;
+        } catch {
+        }
+        try {
+          await this.readNewEvents(monitorId);
+        } catch (e6) {
+          const errorName = e6 instanceof Error ? e6.name : String(e6);
+          await this.ioHelper.notify(IO.CDK_TOOLKIT_W5500.msg(
+            util6.format("Could not read the final stack events, the event log may be incomplete (%s). Run again with -v to see the full error.", errorName),
+            { error: e6 }
+          ));
+          await this.ioHelper.defaults.debug(util6.format("Error occurred during final stack event poll: %s", e6));
         }
-        await this.readNewEvents(monitorId);
       }
       /**
        * Formats a stack activity into a basic string
@@ -94055,7 +94030,7 @@ async function getNestedStackTemplates(rootStackArtifact, nestedTemplateAssetPat
   const nestedStackArn = await getNestedStackArn(nestedStackLogicalId, listStackResources);
   const deployedStackName = nestedStackArn?.slice(nestedStackArn.indexOf("/") + 1, nestedStackArn.lastIndexOf("/"));
   return {
-    generatedTemplate: JSON.parse(fs17.readFileSync(nestedTemplatePath, "utf-8")),
+    generatedTemplate: JSON.parse(fs16.readFileSync(nestedTemplatePath, "utf-8")),
     deployedTemplate: deployedStackName ? await loadCurrentStackTemplate(deployedStackName, sdk) : {},
     deployedStackName
   };
@@ -94074,12 +94049,12 @@ async function getNestedStackArn(nestedStackLogicalId, listStackResources) {
 function isCdkManagedNestedStack(stackResource) {
   return stackResource.Type === "AWS::CloudFormation::Stack" && stackResource.Metadata && stackResource.Metadata["aws:asset:path"];
 }
-var path16, fs17;
+var path16, fs16;
 var init_nested_stack_helpers = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloudformation/nested-stack-helpers.ts"() {
     "use strict";
     path16 = __toESM(require("path"));
-    fs17 = __toESM(require_lib4());
+    fs16 = __toESM(require_lib4());
     init_evaluate_cloudformation_template();
     init_stack_helpers();
     init_util4();
@@ -94344,6 +94319,31 @@ var init_stack_template = __esm({
   }
 });
 
+// ../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts
+function isAccessDeniedError(e6) {
+  const name = e6?.name ?? e6?.Code ?? "";
+  return name === "AccessDenied" || name === "AccessDeniedException";
+}
+function readIfPossible(filename) {
+  try {
+    if (!fs17.pathExistsSync(filename)) {
+      return void 0;
+    }
+    return fs17.readFileSync(filename, { encoding: "utf-8" });
+  } catch (e6) {
+    return void 0;
+  }
+}
+var fs17;
+var init_util5 = __esm({
+  "../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts"() {
+    "use strict";
+    fs17 = __toESM(require_lib4());
+    __name(isAccessDeniedError, "isAccessDeniedError");
+    __name(readIfPossible, "readIfPossible");
+  }
+});
+
 // ../@aws-cdk/toolkit-lib/lib/api/diagnosing/cloudtrail-investigation.ts
 async function investigateStackViaCloudTrail(sdk, errors, ioHelper) {
   const debug2 = /* @__PURE__ */ __name((msg) => ioHelper.defaults.debug(msg), "debug");
@@ -95625,29 +95625,31 @@ var init_stack_diagnoser = __esm({
         if (ev.type === "could-not-check") {
           await this.props.ioHelper.defaults.warn(ev.message);
         }
-        const hookErrors = await this._changeSetHookErrors(changeSet);
+        let hookErrors = [];
+        let warnings = [];
+        try {
+          hookErrors = await this._changeSetHookErrors(changeSet);
+        } catch (e6) {
+          const errorMessage = e6 instanceof Error ? e6.message : String(e6);
+          warnings = [`Could not fetch extra hook failure detail for change set ${changeSet.ChangeSetName} (${errorMessage}). Run again with -v to see the full error.`];
+        }
         if (hookErrors.length > 0) {
           return Diagnosis.problem(detectedBy, await this.enhanceErrors(hookErrors));
         }
-        return this._nonSpecificChangeSetError(changeSet, detectedBy);
+        return this._nonSpecificChangeSetError(changeSet, detectedBy, warnings);
       }
       /**
        * Find the hooks that failed this change set, and return their failure details as resource errors.
        *
        * Failures of hooks with failure mode WARN don't fail a change set, so those are excluded.
-       * Returns an empty array if hook results can't be listed (e.g. for lack of permissions).
+       * Throws if hook results can't be listed (e.g. lack of permissions, or the API being
+       * unavailable).
        */
       async _changeSetHookErrors(changeSet) {
-        let hookResults;
-        try {
-          hookResults = (await this.cfn.listHookResults({
-            TargetType: "CHANGE_SET",
-            TargetId: changeSet.ChangeSetId
-          })).HookResults ?? [];
-        } catch (e6) {
-          await this.props.ioHelper.defaults.debug(`Could not list hook results for change set ${changeSet.ChangeSetName}: ${e6.message}`);
-          return [];
-        }
+        const hookResults = (await this.cfn.listHookResults({
+          TargetType: "CHANGE_SET",
+          TargetId: changeSet.ChangeSetId
+        })).HookResults ?? [];
         const failedHooks = hookResults.filter((r6) => isFailedHookStatus(r6.Status) && r6.FailureMode === "FAIL");
         const errors = [];
         for (const hook of failedHooks) {
@@ -95674,8 +95676,7 @@ var init_stack_diagnoser = __esm({
       async _hookResultDetails(hook) {
         if (hook.HookResultId) {
           const details = await fetchHookResultDetails(this.cfn, hook.HookResultId, {
-            ioHelper: this.props.ioHelper,
-            envResources: this.props.envResources
+            ioHelper: this.props.ioHelper
           });
           if (details) {
             return details;
@@ -95693,7 +95694,11 @@ var init_stack_diagnoser = __esm({
           this.investigateResourceBestEffort(err),
           this.hookFailureContext(err)
         ]);
-        const allContext = [...hookContext, ...additionalContext];
+        const allContext = [
+          ...hookContext,
+          ...additionalContext,
+          ...err.warnings?.length ? [{ source: "Warnings", messages: err.warnings }] : []
+        ];
         return {
           ...err,
           sourceTrace,
@@ -95719,8 +95724,7 @@ var init_stack_diagnoser = __esm({
         const ret = [];
         for (const hook of err.hookFailures ?? []) {
           let details = hook.hookInvocationId ? await fetchHookResultDetails(this.cfn, hook.hookInvocationId, {
-            ioHelper: this.props.ioHelper,
-            envResources: this.props.envResources
+            ioHelper: this.props.ioHelper
           }) : void 0;
           details = details ?? (hook.hookStatusReason ? normalizeHookMessage(hook.hookStatusReason) : void 0);
           if (details) {
@@ -95750,8 +95754,12 @@ var init_stack_diagnoser = __esm({
        * Build a generic stack error from the given change set information
        *
        * We can't point to a specific resource.
+       *
+       * @param warnings - Warnings to attach to the error (e.g. a note that hook detail couldn't
+       * be fetched). Rendered after the main failure message, instead of appearing to precede or
+       * replace it.
        */
-      async _nonSpecificChangeSetError(changeSet, detectedBy) {
+      async _nonSpecificChangeSetError(changeSet, detectedBy, warnings = []) {
         return Diagnosis.problem(detectedBy, [
           await this.enhanceError({
             // It's about a stack
@@ -95760,7 +95768,8 @@ var init_stack_diagnoser = __esm({
             parentStackLogicalIds: this.parentStackLogicalIds,
             stackArn: changeSet.StackId ?? "",
             physicalId: changeSet.StackId,
-            resourceType: "AWS::CloudFormation::Stack"
+            resourceType: "AWS::CloudFormation::Stack",
+            warnings
           })
         ]);
       }
@@ -99562,6 +99571,28 @@ function contextProperties(context) {
   }
   return parsed && typeof parsed === "object" ? parsed.Properties : void 0;
 }
+function propertyIsResolvedAtDeployTime(difference2) {
+  return containsDeployTimeValue(difference2.oldValue) || containsDeployTimeValue(difference2.newValue);
+}
+function containsDeployTimeValue(value2) {
+  if (typeof value2 === "string") {
+    return value2.includes("{{resolve:");
+  }
+  if (Array.isArray(value2)) {
+    return value2.some(containsDeployTimeValue);
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    for (const [key, nested] of Object.entries(value2)) {
+      if (key === "Ref" || key.startsWith("Fn::")) {
+        return true;
+      }
+      if (containsDeployTimeValue(nested)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var TemplateAndChangeSetDiffMerger;
 var init_template_and_changeset_diff_merger = __esm({
   "../@aws-cdk/cloudformation-diff/lib/diff/template-and-changeset-diff-merger.ts"() {
@@ -99632,6 +99663,9 @@ var init_template_and_changeset_diff_merger = __esm({
         change.forEachDifference((type, name, value2) => {
           if (type === "Property") {
             if (!this.changeSetResources[logicalId]) {
+              if (!propertyIsResolvedAtDeployTime(value2)) {
+                return;
+              }
               value2.changeImpact = "NO_CHANGE" /* NO_CHANGE */;
               value2.isDifferent = false;
               return;
@@ -99648,6 +99682,9 @@ var init_template_and_changeset_diff_merger = __esm({
                 value2.changeImpact = "MAY_REPLACE" /* MAY_REPLACE */;
                 break;
               case void 0:
+                if (!propertyIsResolvedAtDeployTime(value2)) {
+                  break;
+                }
                 value2.changeImpact = "NO_CHANGE" /* NO_CHANGE */;
                 value2.isDifferent = false;
                 break;
@@ -99898,6 +99935,8 @@ var init_template_and_changeset_diff_merger = __esm({
     __name(tryJsonParse, "tryJsonParse");
     __name(changeImpactForReplacementMode, "changeImpactForReplacementMode");
     __name(contextProperties, "contextProperties");
+    __name(propertyIsResolvedAtDeployTime, "propertyIsResolvedAtDeployTime");
+    __name(containsDeployTimeValue, "containsDeployTimeValue");
   }
 });
 
@@ -106994,11 +107033,11 @@ function _diffStrings(oldStr, newStr, context) {
   }
   __name(_findIndent, "_findIndent");
 }
-var import_util24, import_chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
+var import_util23, import_chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
 var init_format = __esm({
   "../@aws-cdk/cloudformation-diff/lib/format.ts"() {
     "use strict";
-    import_util24 = require("util");
+    import_util23 = require("util");
     import_chalk7 = __toESM(require_source());
     init_util6();
     init_diff_template();
@@ -107030,10 +107069,10 @@ var init_format = __esm({
         __name(this, "Formatter");
       }
       print(fmt, ...args) {
-        this.stream.write(import_chalk7.default.reset((0, import_util24.format)(fmt, ...args)) + "\n");
+        this.stream.write(import_chalk7.default.reset((0, import_util23.format)(fmt, ...args)) + "\n");
       }
       warning(fmt, ...args) {
-        this.stream.write(import_chalk7.default.yellow((0, import_util24.format)(fmt, ...args)) + "\n");
+        this.stream.write(import_chalk7.default.yellow((0, import_util23.format)(fmt, ...args)) + "\n");
       }
       formatSection(title, entryType, collection, formatter = this.formatDifference.bind(this)) {
         if (collection.differenceCount === 0) {
@@ -108809,6 +108848,8 @@ async function isHotswappableCloudControlChange(logicalId, change, evaluateCfnTe
           patchOps.push({ op: "remove", path: `/${propName}` });
         } else if (diff.isAddition) {
           patchOps.push({ op: "add", path: `/${propName}`, value: newValue });
+        } else if (propName === "Tags" && newValue && typeof newValue === "object") {
+          patchOps.push(...await buildTagPatchOps(cloudControl, resourceType, identifier, newValue));
         } else {
           patchOps.push({ op: "replace", path: `/${propName}`, value: newValue });
         }
@@ -108829,6 +108870,103 @@ async function isHotswappableCloudControlChange(logicalId, change, evaluateCfnTe
   });
   return ret;
 }
+function isReservedTagKey(key) {
+  return typeof key === "string" && key.toLowerCase().startsWith("aws:");
+}
+function escapeJsonPointerToken(key) {
+  return key.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+async function buildTagPatchOps(cloudControl, resourceType, identifier, desiredTags) {
+  const readTags = await currentResourceTags(cloudControl, resourceType, identifier);
+  const desiredIsList = Array.isArray(desiredTags);
+  const currentTags = readTags ?? (desiredIsList ? [] : {});
+  if (desiredIsList && Array.isArray(currentTags)) {
+    return buildListTagPatchOps(currentTags, desiredTags);
+  }
+  if (!desiredIsList && !Array.isArray(currentTags) && typeof currentTags === "object") {
+    return buildMapTagPatchOps(currentTags, desiredTags);
+  }
+  throw new ToolkitError(
+    "HotswapTagReadFailed",
+    `could not interpret the current tags of ${identifier} (${resourceType}): the resource reports Tags as ${describeTagsShape(currentTags)} but the template declares ${describeTagsShape(desiredTags)}`
+  );
+}
+function describeTagsShape(tags) {
+  if (Array.isArray(tags)) {
+    return "a list";
+  }
+  if (tags === null) {
+    return "null";
+  }
+  if (typeof tags === "object") {
+    return "a map";
+  }
+  return typeof tags;
+}
+function buildMapTagPatchOps(currentTags, desiredTags) {
+  const ops = [];
+  for (const [key, value2] of Object.entries(desiredTags)) {
+    const path54 = `/Tags/${escapeJsonPointerToken(key)}`;
+    if (!Object.hasOwn(currentTags, key)) {
+      ops.push({ op: "add", path: path54, value: value2 });
+    } else if (JSON.stringify(currentTags[key]) !== JSON.stringify(value2)) {
+      ops.push({ op: "replace", path: path54, value: value2 });
+    }
+  }
+  for (const key of Object.keys(currentTags)) {
+    if (!Object.hasOwn(desiredTags, key) && !isReservedTagKey(key)) {
+      ops.push({ op: "remove", path: `/Tags/${escapeJsonPointerToken(key)}` });
+    }
+  }
+  return ops;
+}
+function buildListTagPatchOps(currentTags, desiredTags) {
+  const isTag = /* @__PURE__ */ __name((tag) => tag && typeof tag === "object" && typeof tag.Key === "string", "isTag");
+  const indexByKey = /* @__PURE__ */ new Map();
+  currentTags.forEach((tag, i6) => {
+    if (isTag(tag) && !indexByKey.has(tag.Key)) {
+      indexByKey.set(tag.Key, i6);
+    }
+  });
+  const replacements = [];
+  const additions = [];
+  for (const tag of desiredTags) {
+    if (!isTag(tag)) {
+      continue;
+    }
+    const index = indexByKey.get(tag.Key);
+    if (index === void 0) {
+      additions.push({ op: "add", path: "/Tags/-", value: tag });
+    } else if (JSON.stringify(currentTags[index]) !== JSON.stringify(tag)) {
+      replacements.push({ op: "replace", path: `/Tags/${index}`, value: tag });
+    }
+  }
+  const desiredKeys = new Set(desiredTags.filter(isTag).map((tag) => tag.Key));
+  const removals = currentTags.map((tag, i6) => ({ tag, i: i6 })).filter(({ tag }) => isTag(tag) && !desiredKeys.has(tag.Key) && !isReservedTagKey(tag.Key)).sort((a6, b6) => b6.i - a6.i).map(({ i: i6 }) => ({ op: "remove", path: `/Tags/${i6}` }));
+  return [...replacements, ...removals, ...additions];
+}
+async function currentResourceTags(cloudControl, resourceType, identifier) {
+  const unreadable = /* @__PURE__ */ __name((cause) => ToolkitError.withCause(
+    "HotswapTagReadFailed",
+    `could not read the current tags of ${identifier} (${resourceType}), which are needed to update tags without removing the reserved aws: tags that AWS manages - ensure the deployment role is allowed to call cloudcontrolapi:GetResource for this resource type`,
+    cause
+  ), "unreadable");
+  let current;
+  try {
+    current = await cloudControl.getResource({ TypeName: resourceType, Identifier: identifier });
+  } catch (e6) {
+    throw unreadable(e6);
+  }
+  const properties = current.ResourceDescription?.Properties;
+  if (!properties) {
+    throw unreadable(new Error("GetResource returned no resource properties"));
+  }
+  try {
+    return JSON.parse(properties).Tags;
+  } catch (e6) {
+    throw unreadable(e6);
+  }
+}
 async function resolveCloudControlIdentifier(logicalId, resourceType, evaluateCfnTemplate) {
   const cfnPhysicalId = await evaluateCfnTemplate.findPhysicalNameFor(logicalId);
   if (!cfnPhysicalId) {
@@ -108844,6 +108982,13 @@ var init_cloud_control_resource = __esm({
     init_toolkit_error();
     init_cloudformation2();
     __name(isHotswappableCloudControlChange, "isHotswappableCloudControlChange");
+    __name(isReservedTagKey, "isReservedTagKey");
+    __name(escapeJsonPointerToken, "escapeJsonPointerToken");
+    __name(buildTagPatchOps, "buildTagPatchOps");
+    __name(describeTagsShape, "describeTagsShape");
+    __name(buildMapTagPatchOps, "buildMapTagPatchOps");
+    __name(buildListTagPatchOps, "buildListTagPatchOps");
+    __name(currentResourceTags, "currentResourceTags");
     __name(resolveCloudControlIdentifier, "resolveCloudControlIdentifier");
   }
 });
@@ -109291,7 +109436,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
   sdk.appendCustomUserAgent(customUserAgent);
   const resourceText = /* @__PURE__ */ __name((r6) => r6.description ?? `${r6.resourceType} '${r6.physicalName ?? r6.logicalId}'`, "resourceText");
   await ioSpan.notify(IO.CDK_TOOLKIT_I5402.msg(
-    hotswapOperation.change.resources.map((r6) => (0, import_util30.format)(`   ${ICON} %s`, import_chalk10.default.bold(resourceText(r6)))).join("\n"),
+    hotswapOperation.change.resources.map((r6) => (0, import_util29.format)(`   ${ICON} %s`, import_chalk10.default.bold(resourceText(r6)))).join("\n"),
     hotswapOperation.change
   ));
   try {
@@ -109306,7 +109451,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
     throw e6;
   }
   await ioSpan.notify(IO.CDK_TOOLKIT_I5403.msg(
-    hotswapOperation.change.resources.map((r6) => (0, import_util30.format)(`   ${ICON} %s %s`, import_chalk10.default.bold(resourceText(r6)), import_chalk10.default.green("hotswapped!"))).join("\n"),
+    hotswapOperation.change.resources.map((r6) => (0, import_util29.format)(`   ${ICON} %s %s`, import_chalk10.default.bold(resourceText(r6)), import_chalk10.default.green("hotswapped!"))).join("\n"),
     hotswapOperation.change
   ));
   sdk.removeCustomUserAgent(customUserAgent);
@@ -109335,9 +109480,9 @@ async function logRejectedChanges(ioSpan, rejectedChanges, hotswapMode) {
   }
   const messages = [""];
   if (hotswapMode === "hotswap-only") {
-    messages.push((0, import_util30.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
+    messages.push((0, import_util29.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
   } else {
-    messages.push((0, import_util30.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found:")));
+    messages.push((0, import_util29.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found:")));
   }
   for (const { change } of rejectedChanges) {
     messages.push("    " + nonHotswappableChangeMessage(change));
@@ -109350,7 +109495,7 @@ function nonHotswappableChangeMessage(change) {
   const reason = change.description ?? change.reason;
   switch (subject.type) {
     case "Output":
-      return (0, import_util30.format)(
+      return (0, import_util29.format)(
         "output: %s, reason: %s",
         import_chalk10.default.bold(subject.logicalId),
         import_chalk10.default.red(reason)
@@ -109361,7 +109506,7 @@ function nonHotswappableChangeMessage(change) {
 }
 function nonHotswappableResourceMessage(subject, reason) {
   if (subject.rejectedProperties?.length) {
-    return (0, import_util30.format)(
+    return (0, import_util29.format)(
       "resource: %s, type: %s, rejected changes: %s, reason: %s",
       import_chalk10.default.bold(subject.logicalId),
       import_chalk10.default.bold(subject.resourceType),
@@ -109369,18 +109514,18 @@ function nonHotswappableResourceMessage(subject, reason) {
       import_chalk10.default.red(reason)
     );
   }
-  return (0, import_util30.format)(
+  return (0, import_util29.format)(
     "resource: %s, type: %s, reason: %s",
     import_chalk10.default.bold(subject.logicalId),
     import_chalk10.default.bold(subject.resourceType),
     import_chalk10.default.red(reason)
   );
 }
-var import_util30, cfn_diff, import_chalk10, pLimit2, RESOURCE_DETECTORS;
+var import_util29, cfn_diff, import_chalk10, pLimit2, RESOURCE_DETECTORS;
 var init_hotswap_deployments = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts"() {
     "use strict";
-    import_util30 = require("util");
+    import_util29 = require("util");
     cfn_diff = __toESM(require_lib9());
     import_chalk10 = __toESM(require_source());
     init_payloads();
@@ -110751,11 +110896,11 @@ var init_notices2 = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
-var import_util36, import_chalk12, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
+var import_util35, import_chalk12, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
 var init_toolkit_info = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts"() {
     "use strict";
-    import_util36 = require("util");
+    import_util35 = require("util");
     import_chalk12 = __toESM(require_source());
     init_bootstrap_props();
     init_toolkit_error();
@@ -110775,7 +110920,7 @@ var init_toolkit_info = __esm({
           const stack = await stabilizeStack(cfn, ioHelper, stackName);
           if (!stack) {
             await ioHelper.defaults.debug(
-              (0, import_util36.format)(
+              (0, import_util35.format)(
                 "The environment %s doesn't have the CDK toolkit stack (%s) installed. Use %s to setup your environment for use with the toolkit.",
                 environment.name,
                 stackName,
@@ -110786,7 +110931,7 @@ var init_toolkit_info = __esm({
           }
           if (stack.stackStatus.isCreationFailure) {
             await ioHelper.defaults.debug(
-              (0, import_util36.format)(
+              (0, import_util35.format)(
                 "The environment %s has a CDK toolkit stack (%s) that failed to create. Use %s to try provisioning it again.",
                 environment.name,
                 stackName,
@@ -284523,7 +284668,10 @@ function makeSdkLoggerSafeByBindingThis(logger2) {
   };
 }
 function cappedExponentialBackoff(baseMs, capMs) {
-  return (attempt) => Math.min(baseMs * 2 ** attempt, capMs);
+  return (attempt) => {
+    const delay = Math.min(baseMs * 2 ** attempt, capMs);
+    return Math.floor(delay / 2 + Math.random() * (delay / 2));
+  };
 }
 var import_client_appsync, import_client_bedrock_agentcore_control, import_client_cloudcontrol, import_client_cloudformation6, import_client_cloudtrail, import_client_cloudwatch_logs, import_client_codebuild, import_client_ec2, import_client_ecr2, import_client_ecs, import_client_elastic_load_balancing_v2, import_client_iam, import_client_kms, import_client_lambda, import_client_route_53, import_client_s33, import_client_secrets_manager2, import_client_sfn, import_client_ssm, import_client_sts2, import_lib_storage2, import_middleware_endpoint2, import_util_retry, SDK, CURRENT_ACCOUNT_KEY;
 var init_sdk2 = __esm({
@@ -285552,7 +285700,7 @@ async function v3ProviderFromPlugin(producer) {
   } else if (isV2Credentials(initial)) {
     return v3ProviderFromV2Credentials(initial);
   } else {
-    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util46.inspect)(initial)}`);
+    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util45.inspect)(initial)}`);
   }
 }
 function v3ProviderFromV2Credentials(x) {
@@ -285571,7 +285719,7 @@ function refreshFromPluginProvider(current, producer) {
     if (credentialsAboutToExpire(current)) {
       const newCreds = await producer();
       if (!isV3Credentials(newCreds)) {
-        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util46.inspect)(newCreds)}`);
+        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util45.inspect)(newCreds)}`);
       }
       current = newCreds;
     }
@@ -285587,11 +285735,11 @@ function isV2Credentials(x) {
 function isV3Credentials(x) {
   return !!(x && typeof x === "object" && x.accessKeyId && !isV2Credentials(x));
 }
-var import_util46, CredentialPlugins;
+var import_util45, CredentialPlugins;
 var init_credential_plugins = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts"() {
     "use strict";
-    import_util46 = require("util");
+    import_util45 = require("util");
     init_provider_caching();
     init_toolkit_error();
     init_util4();
@@ -285990,7 +286138,7 @@ function formatSdkLoggerContent(content) {
       return apiFmt;
     }
   }
-  return content.map((x) => typeof x === "string" ? x : (0, import_util49.inspect)(x)).join("");
+  return content.map((x) => typeof x === "string" ? x : (0, import_util48.inspect)(x)).join("");
 }
 function formatApiCall(content) {
   if (!isSdkApiCallSuccess(content) && !isSdkApiCallError(content)) {
@@ -286016,11 +286164,11 @@ function isSdkApiCallSuccess(x) {
 function isSdkApiCallError(x) {
   return x && typeof x === "object" && x.commandName && x.error;
 }
-var import_util49, IoHostSdkLogger;
+var import_util48, IoHostSdkLogger;
 var init_sdk_logger = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-logger.ts"() {
     "use strict";
-    import_util49 = require("util");
+    import_util48 = require("util");
     init_util4();
     init_private();
     IoHostSdkLogger = class {
@@ -286032,7 +286180,7 @@ var init_sdk_logger = __esm({
         this.ioHelper = ioHelper;
       }
       notify(level, ...content) {
-        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util49.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
+        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util48.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
           sdkLevel: level,
           content
         }));
@@ -290793,6 +290941,12 @@ function quoteShellPart(part) {
     return part;
   }
   if (isWindows2) {
+    if (/%[^%]*%/.test(part)) {
+      throw new ToolkitError(
+        "UnsafeWindowsPath",
+        `Cannot safely run a path containing a '%...%' substring through the Windows shell: '${part}'. Rename the file or directory to remove the percent signs.`
+      );
+    }
     return `"${part}"`;
   }
   return `"${part.replace(/([\\"$`])/g, "\\$1")}"`;
@@ -290804,6 +290958,7 @@ var init_environment3 = __esm({
     path29 = __toESM(require("path"));
     cxapi4 = __toESM(require_lib11());
     fs28 = __toESM(require_lib4());
+    init_toolkit_error();
     __name(prepareDefaultEnvironment, "prepareDefaultEnvironment");
     __name(contextFromSettings, "contextFromSettings");
     __name(synthParametersFromSettings, "synthParametersFromSettings");
@@ -291109,12 +291264,12 @@ var init_readable_assembly = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts
-var path31, import_util54, cxapi6, fs31, CloudAssemblySourceBuilder;
+var path31, import_util53, cxapi6, fs31, CloudAssemblySourceBuilder;
 var init_source_builder = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts"() {
     "use strict";
     path31 = __toESM(require("path"));
-    import_util54 = require("util");
+    import_util53 = require("util");
     cxapi6 = __toESM(require_lib3());
     fs31 = __toESM(require_lib4());
     init_context_store();
@@ -291180,7 +291335,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util54.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util53.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Versioning, outdir, default account and region
                   ...await execution.defaultEnvVars(),
@@ -291319,7 +291474,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util54.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util53.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Need to start with full env of `writeContextToEnv` will not be able to do the size
                   // calculation correctly.
@@ -291520,6 +291675,21 @@ var init_stack_collection = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts
+function matcherFor(patterns) {
+  const positives = [];
+  const negatives = [];
+  for (const pattern of patterns) {
+    const parsed = (0, import_picomatch.default)(pattern, void 0, true);
+    (parsed.state.negated ? negatives : positives).push(parsed);
+  }
+  if (positives.length === 0 && negatives.length === 0) {
+    return () => false;
+  }
+  return (hierarchicalId) => {
+    const included = positives.length === 0 || positives.some((matches) => matches(hierarchicalId));
+    return included && negatives.every((matches) => matches(hierarchicalId));
+  };
+}
 function indexByHierarchicalId(stacks) {
   const result2 = /* @__PURE__ */ new Map();
   for (const stack of stacks) {
@@ -291584,7 +291754,6 @@ var init_stack_assembly = __esm({
     import_picomatch = __toESM(require_picomatch4());
     import_semver2 = __toESM(require_semver4());
     init_toolkit_error();
-    init_util4();
     init_private();
     init_stack_collection();
     init_stack_selector();
@@ -291708,7 +291877,7 @@ var init_stack_assembly = __esm({
             }
             return {
               stacks: matched,
-              suggestions: options.suggestPatternMatches ? this.suggestionsForPatterns(patterns, matched) : void 0
+              suggestions: options.suggestPatternMatches ? this.suggestionsForPatterns(patterns) : void 0
             };
         }
       }
@@ -291718,13 +291887,16 @@ var init_stack_assembly = __esm({
        * at least one stack are omitted; the array is empty when there is no close
        * match. Pure computation, never throws, emits no output.
        */
-      suggestionsForPatterns(patterns, matched) {
+      suggestionsForPatterns(patterns) {
         const suggestions = {};
         for (const pattern of patterns) {
-          if (matched.stackArtifacts.some((stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId, pattern))) {
+          const exact = (0, import_picomatch.default)(pattern, void 0, true);
+          const loose = (0, import_picomatch.default)(pattern.toLowerCase());
+          const refersTo = exact.state.negated ? (matches, id) => !matches(id) : (matches, id) => matches(id);
+          if (this.allStacks.some((stack) => refersTo(exact, stack.hierarchicalId))) {
             continue;
           }
-          suggestions[pattern] = this.allStacks.filter((stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId.toLowerCase(), pattern.toLowerCase())).map((stack) => stack.hierarchicalId);
+          suggestions[pattern] = this.allStacks.filter((stack) => refersTo(loose, stack.hierarchicalId.toLowerCase())).map((stack) => stack.hierarchicalId);
         }
         return suggestions;
       }
@@ -291738,8 +291910,8 @@ var init_stack_assembly = __esm({
         return new StackCollection(this, selected);
       }
       async selectMatchingStacks(stacks, patterns, extend = "none" /* NONE */) {
-        const matchingPattern = /* @__PURE__ */ __name((pattern) => (stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId, pattern), "matchingPattern");
-        const matchedStacks = flatten2(patterns.map((pattern) => stacks.filter(matchingPattern(pattern))));
+        const selects = matcherFor(patterns);
+        const matchedStacks = stacks.filter((stack) => selects(stack.hierarchicalId));
         return this.extendStacks(matchedStacks, stacks, extend);
       }
       async extendStacks(matched, all, extend = "none" /* NONE */) {
@@ -291760,6 +291932,7 @@ var init_stack_assembly = __esm({
         return new StackCollection(this, selectedList);
       }
     };
+    __name(matcherFor, "matcherFor");
     __name(indexByHierarchicalId, "indexByHierarchicalId");
     __name(includeDownstreamStacks, "includeDownstreamStacks");
     __name(includeUpstreamStacks, "includeUpstreamStacks");
@@ -292628,11 +292801,11 @@ function removeNonImportResources(stack) {
   delete template.Outputs;
   return template;
 }
-var import_util59, cfnDiff, import_chalk17, fs32, ResourceImporter;
+var import_util57, cfnDiff, import_chalk17, fs32, ResourceImporter;
 var init_importer = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts"() {
     "use strict";
-    import_util59 = require("util");
+    import_util57 = require("util");
     cfnDiff = __toESM(require_lib9());
     import_chalk17 = __toESM(require_source());
     fs32 = __toESM(require_lib4());
@@ -292696,12 +292869,12 @@ var init_importer = __esm({
           const descr = this.describeResource(resource.logicalId);
           const idProps = remaining[resource.logicalId];
           if (idProps) {
-            await this.ioHelper.defaults.info((0, import_util59.format)("%s: importing using %s", import_chalk17.default.blue(descr), import_chalk17.default.blue(fmtdict(idProps))));
+            await this.ioHelper.defaults.info((0, import_util57.format)("%s: importing using %s", import_chalk17.default.blue(descr), import_chalk17.default.blue(fmtdict(idProps))));
             ret.importResources.push(resource);
             ret.resourceMap[resource.logicalId] = idProps;
             delete remaining[resource.logicalId];
           } else {
-            await this.ioHelper.defaults.info((0, import_util59.format)("%s: skipping", import_chalk17.default.blue(descr)));
+            await this.ioHelper.defaults.info((0, import_util57.format)("%s: skipping", import_chalk17.default.blue(descr)));
           }
         }
         const unknown = Object.keys(remaining);
@@ -292745,9 +292918,9 @@ var init_importer = __esm({
           });
           assertIsSuccessfulDeployStackResult(result2);
           const message2 = result2.noOp ? "\u2705  %s (no changes)" : "\u2705  %s";
-          await this.ioHelper.defaults.info("\n" + import_chalk17.default.green((0, import_util59.format)(message2, this.stack.displayName)));
+          await this.ioHelper.defaults.info("\n" + import_chalk17.default.green((0, import_util57.format)(message2, this.stack.displayName)));
         } catch (e6) {
-          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util59.format)("\n \u274C  %s failed: %s", import_chalk17.default.bold(this.stack.displayName), e6), { error: e6 }));
+          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util57.format)("\n \u274C  %s failed: %s", import_chalk17.default.bold(this.stack.displayName), e6), { error: e6 }));
           throw e6;
         }
       }
@@ -292877,7 +293050,7 @@ var init_importer = __esm({
           for (const idProp of idProps) {
             const defaultValue2 = resourceProps[idProp] ?? "";
             const response = await this.ioHelper.requestResponse(IO.CDK_TOOLKIT_I3110.req(
-              (0, import_util59.format)(promptPattern, import_chalk17.default.blue(idProp)),
+              (0, import_util57.format)(promptPattern, import_chalk17.default.blue(idProp)),
               {
                 resource: {
                   name: resourceName,
@@ -298909,7 +299082,7 @@ function countAssemblyResults(span, assembly) {
   span.incCounter("assemblies", asmCount(assembly));
   span.incCounter("errorAnns", sum3(stacksRecursively.map((s2) => s2.messages.filter((m4) => m4.level === import_cloud_assembly_api14.SynthesisMessageLevel.ERROR).length)));
   span.incCounter("warnings", sum3(stacksRecursively.map((s2) => s2.messages.filter((m4) => m4.level === import_cloud_assembly_api14.SynthesisMessageLevel.WARNING).length)));
-  const annotationErrorCodes = stacksRecursively.flatMap((s2) => Object.values(s2.metadata).flatMap((ms) => ms.filter((m4) => m4.type === ANNOTATION_ERROR_CODE_TYPE)));
+  const annotationErrorCodes = stacksRecursively.flatMap((s2) => Object.values(s2.metadata ?? {}).flatMap((ms) => ms.filter((m4) => m4.type === ANNOTATION_ERROR_CODE_TYPE)));
   for (const annotationErrorCode of annotationErrorCodes) {
     span.incCounter(`errorAnn:${annotationErrorCode.data}`);
   }
@@ -300035,33 +300208,7 @@ var init_toolkit = __esm({
         try {
           const ioHelper = asIoHelper(this.ioHost, "synth");
           const assembly = __using(_stack, new AsyncDisposableBox(await synthAndMeasure(ioHelper, cx, stacksOpt(options))), true);
-          const stacks = await assembly.value.selectStacks(stacksOpt(options));
-          const autoValidateStacks = options.validateStacks ? [assembly.value.selectStacksForValidation()] : [];
-          await throwIfValidationFailures(assembly.value, stacks.concat(...autoValidateStacks), this.assemblyFailureAt, ioHelper);
-          const message2 = `Successfully synthesized to ${import_chalk29.default.blue(path35.resolve(stacks.assembly.directory))}`;
-          const assemblyData = {
-            assemblyDirectory: stacks.assembly.directory,
-            stacksCount: stacks.stackCount,
-            stackIds: stacks.hierarchicalIds
-          };
-          if (stacks.stackCount === 1) {
-            const firstStack = stacks.firstStack;
-            const template = firstStack.template;
-            const obscuredTemplate = obscureTemplate(template);
-            await ioHelper.notify(IO.CDK_TOOLKIT_I1901.msg(message2, {
-              ...assemblyData,
-              stack: {
-                stackName: firstStack.stackName,
-                hierarchicalId: firstStack.hierarchicalId,
-                template,
-                stringifiedJson: serializeStructure(obscuredTemplate, true),
-                stringifiedYaml: serializeStructure(obscuredTemplate, false)
-              }
-            }));
-          } else {
-            await ioHelper.notify(IO.CDK_TOOLKIT_I1902.msg(import_chalk29.default.green(message2), assemblyData));
-            await ioHelper.defaults.info(`Supply a stack id (${stacks.stackArtifacts.map((s2) => import_chalk29.default.green(s2.hierarchicalId)).join(", ")}) to display its template.`);
-          }
+          await this._synth(assembly.value, options);
           return new CachedCloudAssembly(assembly.take());
         } catch (_) {
           var _error = _, _hasError = true;
@@ -300070,6 +300217,40 @@ var init_toolkit = __esm({
           _promise && await _promise;
         }
       }
+      /**
+       * Helper to allow synth being called with an already-produced assembly,
+       * e.g. as part of the watch action which reuses the startup assembly.
+       */
+      async _synth(assembly, options = {}) {
+        const ioHelper = asIoHelper(this.ioHost, "synth");
+        const stacks = await assembly.selectStacks(stacksOpt(options));
+        const autoValidateStacks = options.validateStacks ? [assembly.selectStacksForValidation()] : [];
+        await throwIfValidationFailures(assembly, stacks.concat(...autoValidateStacks), this.assemblyFailureAt, ioHelper);
+        const message2 = `Successfully synthesized to ${import_chalk29.default.blue(path35.resolve(stacks.assembly.directory))}`;
+        const assemblyData = {
+          assemblyDirectory: stacks.assembly.directory,
+          stacksCount: stacks.stackCount,
+          stackIds: stacks.hierarchicalIds
+        };
+        if (stacks.stackCount === 1) {
+          const firstStack = stacks.firstStack;
+          const template = firstStack.template;
+          const obscuredTemplate = obscureTemplate(template);
+          await ioHelper.notify(IO.CDK_TOOLKIT_I1901.msg(message2, {
+            ...assemblyData,
+            stack: {
+              stackName: firstStack.stackName,
+              hierarchicalId: firstStack.hierarchicalId,
+              template,
+              stringifiedJson: serializeStructure(obscuredTemplate, true),
+              stringifiedYaml: serializeStructure(obscuredTemplate, false)
+            }
+          }));
+        } else {
+          await ioHelper.notify(IO.CDK_TOOLKIT_I1902.msg(import_chalk29.default.green(message2), assemblyData));
+          await ioHelper.defaults.info(`Supply a stack id (${stacks.stackArtifacts.map((s2) => import_chalk29.default.green(s2.hierarchicalId)).join(", ")}) to display its template.`);
+        }
+      }
       /**
        * Diff Action
        */
@@ -300766,6 +300947,40 @@ ${deployResult.stackArn}`));
           onDispose: /* @__PURE__ */ __name(async () => cloudWatchLogMonitor?.deactivate(), "onDispose")
         });
       }
+      /**
+       * Continuously observe project files and re-synthesize the selected stacks
+       * automatically when changes are detected.
+       *
+       * Never deploys: each iteration re-synthesizes the app to the cloud assembly
+       * output directory and runs the same checks as the `synth` action.
+       *
+       * This function returns immediately, starting a watcher in the background.
+       */
+      async watchSynth(cx, options = {}) {
+        const ioHelper = asIoHelper(this.ioHost, "synth");
+        return this._watch(cx, options, {
+          command: "cdk synth",
+          activity: "synthesis",
+          // `_watch` runs this inside `invokeSafe`, which reports (and swallows)
+          // failures so the loop survives synth errors while the user is mid-edit.
+          invoke: /* @__PURE__ */ __name(async (initialAssembly) => {
+            var _stack = [];
+            try {
+              if (initialAssembly) {
+                await this._synth(initialAssembly, options);
+                return;
+              }
+              const assembly = __using(_stack, await synthAndMeasure(ioHelper, cx, stacksOpt(options)), true);
+              await this._synth(assembly, options);
+            } catch (_) {
+              var _error = _, _hasError = true;
+            } finally {
+              var _promise = __callDispose(_stack, _error, _hasError);
+              _promise && await _promise;
+            }
+          }, "invoke")
+        });
+      }
       /**
        * Continuously observe project files and validate the selected stacks
        * automatically when changes are detected.
@@ -302743,6 +302958,10 @@ var require_cli_type_registry = __commonJS({
               alias: "q",
               desc: "Do not output CloudFormation Template to stdout",
               default: false
+            },
+            watch: {
+              type: "boolean",
+              desc: "Continuously observe the project files, and synthesize the given stack(s) automatically when changes are detected. Never deploys, and never prints templates to stdout (--quiet and --json have no effect)"
             }
           }
         },
@@ -309404,7 +309623,7 @@ async function execProgram(aws, ioHelper, config2) {
     ...config2.context.all,
     ...params.context
   };
-  await debugFn((0, import_util77.format)("context:", context));
+  await debugFn((0, import_util75.format)("context:", context));
   if (params.env.CDK_DEBUG === "true") {
     await ioHelper.defaults.info("\u{1F50D} Synthesizing with debug information. This may take a bit longer.");
   }
@@ -309454,7 +309673,7 @@ async function execProgram(aws, ioHelper, config2) {
   const perfCountersFile = path44.join(outdir, "performance-counters.json");
   await fs47.promises.rm(perfCountersFile, { force: true });
   env3.CDK_PERF_COUNTERS_FILE = perfCountersFile;
-  await debugFn((0, import_util77.format)("env:", env3));
+  await debugFn((0, import_util75.format)("env:", env3));
   const cleanupTemp = writeContextToEnv(env3, context, "add-process-env-later");
   try {
     await exec2(commandLine);
@@ -309507,12 +309726,12 @@ function createAssembly(appDir) {
 function noUndefined2(xs) {
   return Object.fromEntries(Object.entries(xs).filter(([_, v]) => v !== void 0));
 }
-var path44, import_util77, import_cloud_assembly_api16, cxschema11, cxapi12, import_toolkit_lib15, fs47;
+var path44, import_util75, import_cloud_assembly_api16, cxschema11, cxapi12, import_toolkit_lib15, fs47;
 var init_exec2 = __esm({
   "lib/cxapp/exec.ts"() {
     "use strict";
     path44 = __toESM(require("path"));
-    import_util77 = require("util");
+    import_util75 = require("util");
     import_cloud_assembly_api16 = __toESM(require_lib3());
     cxschema11 = __toESM(require_lib2());
     cxapi12 = __toESM(require_lib11());
@@ -311408,6 +311627,38 @@ Do you wish to deploy these changes?`;
         await displayFlagsMessage(this.ioHost.asIoHelper(), this.toolkit, this.props.cloudExecutable);
         return void 0;
       }
+      /**
+       * Continuously synthesize the project, re-synthesizing on every file change.
+       * Never deploys, and never prints templates to stdout.
+       *
+       * The files to observe are configured with the "watch" key of `cdk.json`,
+       * exactly like `cdk deploy --watch`.
+       */
+      async synthWatch(options) {
+        const rootDir = path46.dirname(path46.resolve(PROJECT_CONFIG));
+        const watchSettings = this.props.configuration.settings.get(["watch"]);
+        if (!watchSettings) {
+          throw new import_toolkit_lib17.ToolkitError(
+            "WatchConfigMissing",
+            `Cannot use '--watch' without specifying at least one directory to monitor. Make sure to add a "watch" key to your cdk.json`
+          );
+        }
+        const include = this.patternsArrayForWatch(watchSettings.include, {
+          defaultPattern: "**",
+          returnDefaultIfEmpty: true
+        });
+        const exclude = this.patternsArrayForWatch(watchSettings.exclude, {
+          defaultPattern: "",
+          returnDefaultIfEmpty: false
+        });
+        const watcher = await this.toolkit.watchSynth(this.props.cloudExecutable.uncachedSource(), {
+          ...options,
+          watchDir: rootDir,
+          include,
+          exclude
+        });
+        return watcher.waitForEnd();
+      }
       /**
        * Bootstrap the CDK Toolkit stack in the accounts used by the specified stack(s).
        *
@@ -317213,6 +317464,10 @@ function parseCommandLineArguments(args) {
       type: "boolean",
       alias: "q",
       desc: "Do not output CloudFormation Template to stdout"
+    }).option("watch", {
+      default: void 0,
+      type: "boolean",
+      desc: "Continuously observe the project files, and synthesize the given stack(s) automatically when changes are detected. Never deploys, and never prints templates to stdout (--quiet and --json have no effect)"
     })
   ).command(
     "bootstrap [ENVIRONMENTS..]",
@@ -368786,6 +369041,12 @@ async function exec(args, synthesizer) {
       case "synthesize":
       case "synth":
         ioHost.currentAction = "synth";
+        if (args2.watch) {
+          return cli2.synthWatch({
+            stacks: specificStacksOrAllRecursively(args2.STACKS),
+            validateStacks: args2.validation
+          });
+        }
         const quiet = configuration.settings.get(["quiet"]) ?? args2.quiet;
         return cli2.synth({
           stackNames: args2.STACKS,