aws-cdk 2.1140.0 → 2.1142.0

package/lib/index.js

@@ -1609,8 +1609,8 @@ var require_validator = __commonJS({
       if (ctx.schemas[switchSchema]) {
         return { subschema: ctx.schemas[switchSchema], switchSchema };
       }
-      let parsed = new URL(switchSchema, "thismessage::/");
-      let fragment = parsed.hash;
+      let hashIndex = switchSchema.indexOf("#");
+      let fragment = hashIndex === -1 || hashIndex === switchSchema.length - 1 ? "" : switchSchema.substr(hashIndex);
       var document2 = fragment && fragment.length && switchSchema.substr(0, switchSchema.length - fragment.length);
       if (!document2 || !ctx.schemas[document2]) {
         throw new SchemaError("no such schema <" + switchSchema + ">", schema);
@@ -3695,7 +3695,7 @@ var require_semver2 = __commonJS({
 // ../@aws-cdk/cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../@aws-cdk/cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "2.1140.0" };
+    module2.exports = { version: "2.1142.0" };
   }
 });
 
@@ -35566,7 +35566,7 @@ For more information, please visit: ` + STATIC_STABILITY_DOC_URL);
 // ../../node_modules/@smithy/node-http-handler/dist-cjs/index.js
 var require_dist_cjs5 = __commonJS({
   "../../node_modules/@smithy/node-http-handler/dist-cjs/index.js"(exports2) {
-    var { hasOwn: hasOwn2 } = (init_serde(), __toCommonJS(serde_exports));
+    var { hasOwn: hasOwn3 } = (init_serde(), __toCommonJS(serde_exports));
     var { streamCollector: streamCollector8 } = (init_serde(), __toCommonJS(serde_exports));
     exports2.streamCollector = streamCollector8;
     var { buildQueryString: buildQueryString2, HttpResponse: HttpResponse2 } = (init_protocols(), __toCommonJS(protocols_exports));
@@ -35595,7 +35595,7 @@ var require_dist_cjs5 = __commonJS({
     var getTransformedHeaders = /* @__PURE__ */ __name((headers) => {
       const transformedHeaders = {};
       for (const name in headers) {
-        if (!hasOwn2(headers, name))
+        if (!hasOwn3(headers, name))
           continue;
         const headerValues = headers[name];
         transformedHeaders[name] = Array.isArray(headerValues) ? headerValues.join(",") : headerValues;
@@ -35787,7 +35787,7 @@ var require_dist_cjs5 = __commonJS({
         }
         if (sockets && requests) {
           for (const origin in sockets) {
-            if (!hasOwn2(sockets, origin))
+            if (!hasOwn3(sockets, origin))
               continue;
             const socketsInUse = sockets[origin]?.length ?? 0;
             const requestsEnqueued = requests[origin]?.length ?? 0;
@@ -36644,7 +36644,7 @@ var init_package = __esm({
   "../../node_modules/@aws-sdk/nested-clients/package.json"() {
     package_default = {
       name: "@aws-sdk/nested-clients",
-      version: "3.997.44",
+      version: "3.997.45",
       description: "Nested clients for AWS SDK packages.",
       homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/nested-clients",
       license: "Apache-2.0",
@@ -36744,7 +36744,7 @@ var init_package = __esm({
         "test:watch": "yarn g:vitest watch"
       },
       dependencies: {
-        "@aws-sdk/core": "^3.977.9",
+        "@aws-sdk/core": "^3.978.0",
         "@aws-sdk/signature-v4-multi-region": "^3.996.46",
         "@aws-sdk/types": "^3.974.5",
         "@smithy/core": "^3.33.3",
@@ -46811,6 +46811,7 @@ var require_dist_cjs15 = __commonJS({
             if (!passiveLock) {
               passiveLock = chain3(options).then((c6) => {
                 credentials = c6;
+              }).catch(() => {
               }).finally(() => {
                 passiveLock = void 0;
               });
@@ -53491,11 +53492,22 @@ var init_format_url = __esm({
   }
 });
 
+// ../../node_modules/@aws-sdk/core/dist-es/submodules/util/hasOwn.js
+function hasOwn2(container, key) {
+  return Object.prototype.hasOwnProperty.call(container, key);
+}
+var init_hasOwn2 = __esm({
+  "../../node_modules/@aws-sdk/core/dist-es/submodules/util/hasOwn.js"() {
+    __name(hasOwn2, "hasOwn");
+  }
+});
+
 // ../../node_modules/@aws-sdk/core/dist-es/submodules/util/index.js
 var util_exports = {};
 __export(util_exports, {
   build: () => build,
   formatUrl: () => formatUrl,
+  hasOwn: () => hasOwn2,
   parse: () => parse2,
   validate: () => validate
 });
@@ -53503,6 +53515,7 @@ var init_util3 = __esm({
   "../../node_modules/@aws-sdk/core/dist-es/submodules/util/index.js"() {
     init_arn();
     init_format_url();
+    init_hasOwn2();
   }
 });
 
@@ -83391,6 +83404,11 @@ var init_messages = __esm({
         description: "Stack Monitoring error",
         interface: "ErrorPayload"
       }),
+      CDK_TOOLKIT_W5500: warn({
+        code: "CDK_TOOLKIT_W5500",
+        description: "Stack events could not be read; the reported event log may be incomplete",
+        interface: "ErrorPayload"
+      }),
       // 6: Rollback (6xxx)
       CDK_TOOLKIT_I6000: info({
         code: "CDK_TOOLKIT_I6000",
@@ -92912,31 +92930,6 @@ var init_template_body_parameter = __esm({
   }
 });
 
-// ../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts
-function isAccessDeniedError(e6) {
-  const name = e6?.name ?? e6?.Code ?? "";
-  return name === "AccessDenied" || name === "AccessDeniedException";
-}
-function readIfPossible(filename) {
-  try {
-    if (!fs16.pathExistsSync(filename)) {
-      return void 0;
-    }
-    return fs16.readFileSync(filename, { encoding: "utf-8" });
-  } catch (e6) {
-    return void 0;
-  }
-}
-var fs16;
-var init_util5 = __esm({
-  "../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts"() {
-    "use strict";
-    fs16 = __toESM(require_lib4());
-    __name(isAccessDeniedError, "isAccessDeniedError");
-    __name(readIfPossible, "readIfPossible");
-  }
-});
-
 // ../@aws-cdk/toolkit-lib/lib/api/stack-events/hook-result-details.ts
 function formatHookResultDetails(result2) {
   const annotations = ("Annotations" in result2 ? result2.Annotations : void 0) ?? [];
@@ -92971,21 +92964,9 @@ async function fetchHookResultDetails(cfn, hookInvocationId, options) {
     return formatHookResultDetails(result2);
   } catch (e6) {
     const errorMessage = e6 instanceof Error ? e6.message : String(e6);
-    const isPermissionsError = isAccessDeniedError(e6) || typeof errorMessage === "string" && errorMessage.toLowerCase().includes("not authorized to perform: cloudformation:gethookresult");
-    if (isPermissionsError && options.envResources) {
-      let currentVersion = void 0;
-      try {
-        currentVersion = (await options.envResources.lookupToolkit()).version;
-      } catch {
-      }
-      await options.ioHelper.defaults.warn(
-        `Failed to fetch result details for Hook invocation ${hookInvocationId}: ${errorMessage}. Make sure you have permissions to call the GetHookResult API, or re-bootstrap your environment by running 'cdk bootstrap' to update the Bootstrap CDK Toolkit stack. Bootstrap toolkit stack version 31 or later is needed; current version: ${currentVersion ?? "unknown"}.`
-      );
-    } else {
-      await options.ioHelper.defaults.warn(
-        util4.format("Failed to fetch Hook details for invocation %s: %s", hookInvocationId, errorMessage)
-      );
-    }
+    await options.ioHelper.defaults.warn(
+      util4.format("Could not fetch extra detail for Hook invocation %s (%s). Run again with -v to see the full error.", hookInvocationId, errorMessage)
+    );
     return void 0;
   }
 }
@@ -92998,7 +92979,6 @@ var init_hook_result_details = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/stack-events/hook-result-details.ts"() {
     "use strict";
     util4 = __toESM(require("node:util"));
-    init_util5();
     __name(formatHookResultDetails, "formatHookResultDetails");
     __name(isFailedHookStatus, "isFailedHookStatus");
     __name(fetchHookResultDetails, "fetchHookResultDetails");
@@ -93590,7 +93570,6 @@ var init_stack_activity_monitor = __esm({
       stackDisplayName;
       stack;
       cfn;
-      envResources;
       isStackUpdate;
       constructor({
         cfn,
@@ -93600,14 +93579,12 @@ var init_stack_activity_monitor = __esm({
         resourcesTotal,
         changeSetCreationTime,
         pollingInterval = 2e3,
-        envResources,
         isStackUpdate = false
       }) {
         this.ioHelper = ioHelper;
         this.stack = stack;
         this.stackDisplayName = stackNameFromArn(stackArn);
         this.cfn = cfn;
-        this.envResources = envResources;
         this.isStackUpdate = isStackUpdate;
         this.progressMonitor = new StackProgressMonitor(resourcesTotal);
         this.pollingInterval = pollingInterval;
@@ -93675,7 +93652,6 @@ var init_stack_activity_monitor = __esm({
         try {
           this.readPromise = this.readNewEvents(this.monitorId);
           await this.readPromise;
-          this.readPromise = void 0;
           if (!this.monitorId) {
             return;
           }
@@ -93684,6 +93660,8 @@ var init_stack_activity_monitor = __esm({
             util6.format("Error occurred while monitoring stack: %s", e6),
             { error: e6 }
           ));
+        } finally {
+          this.readPromise = void 0;
         }
         this.scheduleNextTick();
       }
@@ -93705,8 +93683,7 @@ var init_stack_activity_monitor = __esm({
           this.progressMonitor.process(resourceEvent);
           if (resourceEvent.event.HookInvocationId) {
             const details = await fetchHookResultDetails(this.cfn, resourceEvent.event.HookInvocationId, {
-              ioHelper: this.ioHelper,
-              envResources: this.envResources
+              ioHelper: this.ioHelper
             });
             if (details) {
               resourceEvent.event.HookStatusReason = details;
@@ -93728,10 +93705,20 @@ var init_stack_activity_monitor = __esm({
        * reached the last page.
        */
       async finalPollToEnd(monitorId) {
-        if (this.readPromise) {
+        try {
           await this.readPromise;
+        } catch {
+        }
+        try {
+          await this.readNewEvents(monitorId);
+        } catch (e6) {
+          const errorName = e6 instanceof Error ? e6.name : String(e6);
+          await this.ioHelper.notify(IO.CDK_TOOLKIT_W5500.msg(
+            util6.format("Could not read the final stack events, the event log may be incomplete (%s). Run again with -v to see the full error.", errorName),
+            { error: e6 }
+          ));
+          await this.ioHelper.defaults.debug(util6.format("Error occurred during final stack event poll: %s", e6));
         }
-        await this.readNewEvents(monitorId);
       }
       /**
        * Formats a stack activity into a basic string
@@ -94055,7 +94042,7 @@ async function getNestedStackTemplates(rootStackArtifact, nestedTemplateAssetPat
   const nestedStackArn = await getNestedStackArn(nestedStackLogicalId, listStackResources);
   const deployedStackName = nestedStackArn?.slice(nestedStackArn.indexOf("/") + 1, nestedStackArn.lastIndexOf("/"));
   return {
-    generatedTemplate: JSON.parse(fs17.readFileSync(nestedTemplatePath, "utf-8")),
+    generatedTemplate: JSON.parse(fs16.readFileSync(nestedTemplatePath, "utf-8")),
     deployedTemplate: deployedStackName ? await loadCurrentStackTemplate(deployedStackName, sdk) : {},
     deployedStackName
   };
@@ -94074,12 +94061,12 @@ async function getNestedStackArn(nestedStackLogicalId, listStackResources) {
 function isCdkManagedNestedStack(stackResource) {
   return stackResource.Type === "AWS::CloudFormation::Stack" && stackResource.Metadata && stackResource.Metadata["aws:asset:path"];
 }
-var path16, fs17;
+var path16, fs16;
 var init_nested_stack_helpers = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloudformation/nested-stack-helpers.ts"() {
     "use strict";
     path16 = __toESM(require("path"));
-    fs17 = __toESM(require_lib4());
+    fs16 = __toESM(require_lib4());
     init_evaluate_cloudformation_template();
     init_stack_helpers();
     init_util4();
@@ -94344,6 +94331,31 @@ var init_stack_template = __esm({
   }
 });
 
+// ../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts
+function isAccessDeniedError(e6) {
+  const name = e6?.name ?? e6?.Code ?? "";
+  return name === "AccessDenied" || name === "AccessDeniedException";
+}
+function readIfPossible(filename) {
+  try {
+    if (!fs17.pathExistsSync(filename)) {
+      return void 0;
+    }
+    return fs17.readFileSync(filename, { encoding: "utf-8" });
+  } catch (e6) {
+    return void 0;
+  }
+}
+var fs17;
+var init_util5 = __esm({
+  "../@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts"() {
+    "use strict";
+    fs17 = __toESM(require_lib4());
+    __name(isAccessDeniedError, "isAccessDeniedError");
+    __name(readIfPossible, "readIfPossible");
+  }
+});
+
 // ../@aws-cdk/toolkit-lib/lib/api/diagnosing/cloudtrail-investigation.ts
 async function investigateStackViaCloudTrail(sdk, errors, ioHelper) {
   const debug2 = /* @__PURE__ */ __name((msg) => ioHelper.defaults.debug(msg), "debug");
@@ -95625,29 +95637,31 @@ var init_stack_diagnoser = __esm({
         if (ev.type === "could-not-check") {
           await this.props.ioHelper.defaults.warn(ev.message);
         }
-        const hookErrors = await this._changeSetHookErrors(changeSet);
+        let hookErrors = [];
+        let warnings = [];
+        try {
+          hookErrors = await this._changeSetHookErrors(changeSet);
+        } catch (e6) {
+          const errorMessage = e6 instanceof Error ? e6.message : String(e6);
+          warnings = [`Could not fetch extra hook failure detail for change set ${changeSet.ChangeSetName} (${errorMessage}). Run again with -v to see the full error.`];
+        }
         if (hookErrors.length > 0) {
           return Diagnosis.problem(detectedBy, await this.enhanceErrors(hookErrors));
         }
-        return this._nonSpecificChangeSetError(changeSet, detectedBy);
+        return this._nonSpecificChangeSetError(changeSet, detectedBy, warnings);
       }
       /**
        * Find the hooks that failed this change set, and return their failure details as resource errors.
        *
        * Failures of hooks with failure mode WARN don't fail a change set, so those are excluded.
-       * Returns an empty array if hook results can't be listed (e.g. for lack of permissions).
+       * Throws if hook results can't be listed (e.g. lack of permissions, or the API being
+       * unavailable).
        */
       async _changeSetHookErrors(changeSet) {
-        let hookResults;
-        try {
-          hookResults = (await this.cfn.listHookResults({
-            TargetType: "CHANGE_SET",
-            TargetId: changeSet.ChangeSetId
-          })).HookResults ?? [];
-        } catch (e6) {
-          await this.props.ioHelper.defaults.debug(`Could not list hook results for change set ${changeSet.ChangeSetName}: ${e6.message}`);
-          return [];
-        }
+        const hookResults = (await this.cfn.listHookResults({
+          TargetType: "CHANGE_SET",
+          TargetId: changeSet.ChangeSetId
+        })).HookResults ?? [];
         const failedHooks = hookResults.filter((r6) => isFailedHookStatus(r6.Status) && r6.FailureMode === "FAIL");
         const errors = [];
         for (const hook of failedHooks) {
@@ -95674,8 +95688,7 @@ var init_stack_diagnoser = __esm({
       async _hookResultDetails(hook) {
         if (hook.HookResultId) {
           const details = await fetchHookResultDetails(this.cfn, hook.HookResultId, {
-            ioHelper: this.props.ioHelper,
-            envResources: this.props.envResources
+            ioHelper: this.props.ioHelper
           });
           if (details) {
             return details;
@@ -95693,7 +95706,11 @@ var init_stack_diagnoser = __esm({
           this.investigateResourceBestEffort(err),
           this.hookFailureContext(err)
         ]);
-        const allContext = [...hookContext, ...additionalContext];
+        const allContext = [
+          ...hookContext,
+          ...additionalContext,
+          ...err.warnings?.length ? [{ source: "Warnings", messages: err.warnings }] : []
+        ];
         return {
           ...err,
           sourceTrace,
@@ -95719,8 +95736,7 @@ var init_stack_diagnoser = __esm({
         const ret = [];
         for (const hook of err.hookFailures ?? []) {
           let details = hook.hookInvocationId ? await fetchHookResultDetails(this.cfn, hook.hookInvocationId, {
-            ioHelper: this.props.ioHelper,
-            envResources: this.props.envResources
+            ioHelper: this.props.ioHelper
           }) : void 0;
           details = details ?? (hook.hookStatusReason ? normalizeHookMessage(hook.hookStatusReason) : void 0);
           if (details) {
@@ -95750,8 +95766,12 @@ var init_stack_diagnoser = __esm({
        * Build a generic stack error from the given change set information
        *
        * We can't point to a specific resource.
+       *
+       * @param warnings - Warnings to attach to the error (e.g. a note that hook detail couldn't
+       * be fetched). Rendered after the main failure message, instead of appearing to precede or
+       * replace it.
        */
-      async _nonSpecificChangeSetError(changeSet, detectedBy) {
+      async _nonSpecificChangeSetError(changeSet, detectedBy, warnings = []) {
         return Diagnosis.problem(detectedBy, [
           await this.enhanceError({
             // It's about a stack
@@ -95760,7 +95780,8 @@ var init_stack_diagnoser = __esm({
             parentStackLogicalIds: this.parentStackLogicalIds,
             stackArn: changeSet.StackId ?? "",
             physicalId: changeSet.StackId,
-            resourceType: "AWS::CloudFormation::Stack"
+            resourceType: "AWS::CloudFormation::Stack",
+            warnings
           })
         ]);
       }
@@ -99562,6 +99583,28 @@ function contextProperties(context) {
   }
   return parsed && typeof parsed === "object" ? parsed.Properties : void 0;
 }
+function propertyIsResolvedAtDeployTime(difference2) {
+  return containsDeployTimeValue(difference2.oldValue) || containsDeployTimeValue(difference2.newValue);
+}
+function containsDeployTimeValue(value2) {
+  if (typeof value2 === "string") {
+    return value2.includes("{{resolve:");
+  }
+  if (Array.isArray(value2)) {
+    return value2.some(containsDeployTimeValue);
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    for (const [key, nested] of Object.entries(value2)) {
+      if (key === "Ref" || key.startsWith("Fn::")) {
+        return true;
+      }
+      if (containsDeployTimeValue(nested)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var TemplateAndChangeSetDiffMerger;
 var init_template_and_changeset_diff_merger = __esm({
   "../@aws-cdk/cloudformation-diff/lib/diff/template-and-changeset-diff-merger.ts"() {
@@ -99632,6 +99675,9 @@ var init_template_and_changeset_diff_merger = __esm({
         change.forEachDifference((type, name, value2) => {
           if (type === "Property") {
             if (!this.changeSetResources[logicalId]) {
+              if (!propertyIsResolvedAtDeployTime(value2)) {
+                return;
+              }
               value2.changeImpact = "NO_CHANGE" /* NO_CHANGE */;
               value2.isDifferent = false;
               return;
@@ -99648,6 +99694,9 @@ var init_template_and_changeset_diff_merger = __esm({
                 value2.changeImpact = "MAY_REPLACE" /* MAY_REPLACE */;
                 break;
               case void 0:
+                if (!propertyIsResolvedAtDeployTime(value2)) {
+                  break;
+                }
                 value2.changeImpact = "NO_CHANGE" /* NO_CHANGE */;
                 value2.isDifferent = false;
                 break;
@@ -99898,6 +99947,8 @@ var init_template_and_changeset_diff_merger = __esm({
     __name(tryJsonParse, "tryJsonParse");
     __name(changeImpactForReplacementMode, "changeImpactForReplacementMode");
     __name(contextProperties, "contextProperties");
+    __name(propertyIsResolvedAtDeployTime, "propertyIsResolvedAtDeployTime");
+    __name(containsDeployTimeValue, "containsDeployTimeValue");
   }
 });
 
@@ -106994,11 +107045,11 @@ function _diffStrings(oldStr, newStr, context) {
   }
   __name(_findIndent, "_findIndent");
 }
-var import_util24, import_chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
+var import_util23, import_chalk7, PATH_METADATA_KEY3, structuredPatch, ADDITION2, CONTEXT, UPDATE2, REMOVAL2, IMPORT, Formatter;
 var init_format = __esm({
   "../@aws-cdk/cloudformation-diff/lib/format.ts"() {
     "use strict";
-    import_util24 = require("util");
+    import_util23 = require("util");
     import_chalk7 = __toESM(require_source());
     init_util6();
     init_diff_template();
@@ -107030,10 +107081,10 @@ var init_format = __esm({
         __name(this, "Formatter");
       }
       print(fmt, ...args) {
-        this.stream.write(import_chalk7.default.reset((0, import_util24.format)(fmt, ...args)) + "\n");
+        this.stream.write(import_chalk7.default.reset((0, import_util23.format)(fmt, ...args)) + "\n");
       }
       warning(fmt, ...args) {
-        this.stream.write(import_chalk7.default.yellow((0, import_util24.format)(fmt, ...args)) + "\n");
+        this.stream.write(import_chalk7.default.yellow((0, import_util23.format)(fmt, ...args)) + "\n");
       }
       formatSection(title, entryType, collection, formatter = this.formatDifference.bind(this)) {
         if (collection.differenceCount === 0) {
@@ -108809,6 +108860,8 @@ async function isHotswappableCloudControlChange(logicalId, change, evaluateCfnTe
           patchOps.push({ op: "remove", path: `/${propName}` });
         } else if (diff.isAddition) {
           patchOps.push({ op: "add", path: `/${propName}`, value: newValue });
+        } else if (propName === "Tags" && newValue && typeof newValue === "object") {
+          patchOps.push(...await buildTagPatchOps(cloudControl, resourceType, identifier, newValue));
         } else {
           patchOps.push({ op: "replace", path: `/${propName}`, value: newValue });
         }
@@ -108829,6 +108882,103 @@ async function isHotswappableCloudControlChange(logicalId, change, evaluateCfnTe
   });
   return ret;
 }
+function isReservedTagKey(key) {
+  return typeof key === "string" && key.toLowerCase().startsWith("aws:");
+}
+function escapeJsonPointerToken(key) {
+  return key.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+async function buildTagPatchOps(cloudControl, resourceType, identifier, desiredTags) {
+  const readTags = await currentResourceTags(cloudControl, resourceType, identifier);
+  const desiredIsList = Array.isArray(desiredTags);
+  const currentTags = readTags ?? (desiredIsList ? [] : {});
+  if (desiredIsList && Array.isArray(currentTags)) {
+    return buildListTagPatchOps(currentTags, desiredTags);
+  }
+  if (!desiredIsList && !Array.isArray(currentTags) && typeof currentTags === "object") {
+    return buildMapTagPatchOps(currentTags, desiredTags);
+  }
+  throw new ToolkitError(
+    "HotswapTagReadFailed",
+    `could not interpret the current tags of ${identifier} (${resourceType}): the resource reports Tags as ${describeTagsShape(currentTags)} but the template declares ${describeTagsShape(desiredTags)}`
+  );
+}
+function describeTagsShape(tags) {
+  if (Array.isArray(tags)) {
+    return "a list";
+  }
+  if (tags === null) {
+    return "null";
+  }
+  if (typeof tags === "object") {
+    return "a map";
+  }
+  return typeof tags;
+}
+function buildMapTagPatchOps(currentTags, desiredTags) {
+  const ops = [];
+  for (const [key, value2] of Object.entries(desiredTags)) {
+    const path54 = `/Tags/${escapeJsonPointerToken(key)}`;
+    if (!Object.hasOwn(currentTags, key)) {
+      ops.push({ op: "add", path: path54, value: value2 });
+    } else if (JSON.stringify(currentTags[key]) !== JSON.stringify(value2)) {
+      ops.push({ op: "replace", path: path54, value: value2 });
+    }
+  }
+  for (const key of Object.keys(currentTags)) {
+    if (!Object.hasOwn(desiredTags, key) && !isReservedTagKey(key)) {
+      ops.push({ op: "remove", path: `/Tags/${escapeJsonPointerToken(key)}` });
+    }
+  }
+  return ops;
+}
+function buildListTagPatchOps(currentTags, desiredTags) {
+  const isTag = /* @__PURE__ */ __name((tag) => tag && typeof tag === "object" && typeof tag.Key === "string", "isTag");
+  const indexByKey = /* @__PURE__ */ new Map();
+  currentTags.forEach((tag, i6) => {
+    if (isTag(tag) && !indexByKey.has(tag.Key)) {
+      indexByKey.set(tag.Key, i6);
+    }
+  });
+  const replacements = [];
+  const additions = [];
+  for (const tag of desiredTags) {
+    if (!isTag(tag)) {
+      continue;
+    }
+    const index = indexByKey.get(tag.Key);
+    if (index === void 0) {
+      additions.push({ op: "add", path: "/Tags/-", value: tag });
+    } else if (JSON.stringify(currentTags[index]) !== JSON.stringify(tag)) {
+      replacements.push({ op: "replace", path: `/Tags/${index}`, value: tag });
+    }
+  }
+  const desiredKeys = new Set(desiredTags.filter(isTag).map((tag) => tag.Key));
+  const removals = currentTags.map((tag, i6) => ({ tag, i: i6 })).filter(({ tag }) => isTag(tag) && !desiredKeys.has(tag.Key) && !isReservedTagKey(tag.Key)).sort((a6, b6) => b6.i - a6.i).map(({ i: i6 }) => ({ op: "remove", path: `/Tags/${i6}` }));
+  return [...replacements, ...removals, ...additions];
+}
+async function currentResourceTags(cloudControl, resourceType, identifier) {
+  const unreadable = /* @__PURE__ */ __name((cause) => ToolkitError.withCause(
+    "HotswapTagReadFailed",
+    `could not read the current tags of ${identifier} (${resourceType}), which are needed to update tags without removing the reserved aws: tags that AWS manages - ensure the deployment role is allowed to call cloudcontrolapi:GetResource for this resource type`,
+    cause
+  ), "unreadable");
+  let current;
+  try {
+    current = await cloudControl.getResource({ TypeName: resourceType, Identifier: identifier });
+  } catch (e6) {
+    throw unreadable(e6);
+  }
+  const properties = current.ResourceDescription?.Properties;
+  if (!properties) {
+    throw unreadable(new Error("GetResource returned no resource properties"));
+  }
+  try {
+    return JSON.parse(properties).Tags;
+  } catch (e6) {
+    throw unreadable(e6);
+  }
+}
 async function resolveCloudControlIdentifier(logicalId, resourceType, evaluateCfnTemplate) {
   const cfnPhysicalId = await evaluateCfnTemplate.findPhysicalNameFor(logicalId);
   if (!cfnPhysicalId) {
@@ -108844,6 +108994,13 @@ var init_cloud_control_resource = __esm({
     init_toolkit_error();
     init_cloudformation2();
     __name(isHotswappableCloudControlChange, "isHotswappableCloudControlChange");
+    __name(isReservedTagKey, "isReservedTagKey");
+    __name(escapeJsonPointerToken, "escapeJsonPointerToken");
+    __name(buildTagPatchOps, "buildTagPatchOps");
+    __name(describeTagsShape, "describeTagsShape");
+    __name(buildMapTagPatchOps, "buildMapTagPatchOps");
+    __name(buildListTagPatchOps, "buildListTagPatchOps");
+    __name(currentResourceTags, "currentResourceTags");
     __name(resolveCloudControlIdentifier, "resolveCloudControlIdentifier");
   }
 });
@@ -109291,7 +109448,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
   sdk.appendCustomUserAgent(customUserAgent);
   const resourceText = /* @__PURE__ */ __name((r6) => r6.description ?? `${r6.resourceType} '${r6.physicalName ?? r6.logicalId}'`, "resourceText");
   await ioSpan.notify(IO.CDK_TOOLKIT_I5402.msg(
-    hotswapOperation.change.resources.map((r6) => (0, import_util30.format)(`   ${ICON} %s`, import_chalk10.default.bold(resourceText(r6)))).join("\n"),
+    hotswapOperation.change.resources.map((r6) => (0, import_util29.format)(`   ${ICON} %s`, import_chalk10.default.bold(resourceText(r6)))).join("\n"),
     hotswapOperation.change
   ));
   try {
@@ -109306,7 +109463,7 @@ async function applyHotswapOperation(sdk, ioSpan, hotswapOperation) {
     throw e6;
   }
   await ioSpan.notify(IO.CDK_TOOLKIT_I5403.msg(
-    hotswapOperation.change.resources.map((r6) => (0, import_util30.format)(`   ${ICON} %s %s`, import_chalk10.default.bold(resourceText(r6)), import_chalk10.default.green("hotswapped!"))).join("\n"),
+    hotswapOperation.change.resources.map((r6) => (0, import_util29.format)(`   ${ICON} %s %s`, import_chalk10.default.bold(resourceText(r6)), import_chalk10.default.green("hotswapped!"))).join("\n"),
     hotswapOperation.change
   ));
   sdk.removeCustomUserAgent(customUserAgent);
@@ -109335,9 +109492,9 @@ async function logRejectedChanges(ioSpan, rejectedChanges, hotswapMode) {
   }
   const messages = [""];
   if (hotswapMode === "hotswap-only") {
-    messages.push((0, import_util30.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
+    messages.push((0, import_util29.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback")));
   } else {
-    messages.push((0, import_util30.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found:")));
+    messages.push((0, import_util29.format)("%s %s", import_chalk10.default.red("\u26A0\uFE0F"), import_chalk10.default.red("The following non-hotswappable changes were found:")));
   }
   for (const { change } of rejectedChanges) {
     messages.push("    " + nonHotswappableChangeMessage(change));
@@ -109350,7 +109507,7 @@ function nonHotswappableChangeMessage(change) {
   const reason = change.description ?? change.reason;
   switch (subject.type) {
     case "Output":
-      return (0, import_util30.format)(
+      return (0, import_util29.format)(
         "output: %s, reason: %s",
         import_chalk10.default.bold(subject.logicalId),
         import_chalk10.default.red(reason)
@@ -109361,7 +109518,7 @@ function nonHotswappableChangeMessage(change) {
 }
 function nonHotswappableResourceMessage(subject, reason) {
   if (subject.rejectedProperties?.length) {
-    return (0, import_util30.format)(
+    return (0, import_util29.format)(
       "resource: %s, type: %s, rejected changes: %s, reason: %s",
       import_chalk10.default.bold(subject.logicalId),
       import_chalk10.default.bold(subject.resourceType),
@@ -109369,18 +109526,18 @@ function nonHotswappableResourceMessage(subject, reason) {
       import_chalk10.default.red(reason)
     );
   }
-  return (0, import_util30.format)(
+  return (0, import_util29.format)(
     "resource: %s, type: %s, reason: %s",
     import_chalk10.default.bold(subject.logicalId),
     import_chalk10.default.bold(subject.resourceType),
     import_chalk10.default.red(reason)
   );
 }
-var import_util30, cfn_diff, import_chalk10, pLimit2, RESOURCE_DETECTORS;
+var import_util29, cfn_diff, import_chalk10, pLimit2, RESOURCE_DETECTORS;
 var init_hotswap_deployments = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts"() {
     "use strict";
-    import_util30 = require("util");
+    import_util29 = require("util");
     cfn_diff = __toESM(require_lib9());
     import_chalk10 = __toESM(require_source());
     init_payloads();
@@ -110751,11 +110908,11 @@ var init_notices2 = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
-var import_util36, import_chalk12, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
+var import_util35, import_chalk12, DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo, ExistingToolkitInfo, BootstrapStackNotFoundInfo;
 var init_toolkit_info = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts"() {
     "use strict";
-    import_util36 = require("util");
+    import_util35 = require("util");
     import_chalk12 = __toESM(require_source());
     init_bootstrap_props();
     init_toolkit_error();
@@ -110775,7 +110932,7 @@ var init_toolkit_info = __esm({
           const stack = await stabilizeStack(cfn, ioHelper, stackName);
           if (!stack) {
             await ioHelper.defaults.debug(
-              (0, import_util36.format)(
+              (0, import_util35.format)(
                 "The environment %s doesn't have the CDK toolkit stack (%s) installed. Use %s to setup your environment for use with the toolkit.",
                 environment.name,
                 stackName,
@@ -110786,7 +110943,7 @@ var init_toolkit_info = __esm({
           }
           if (stack.stackStatus.isCreationFailure) {
             await ioHelper.defaults.debug(
-              (0, import_util36.format)(
+              (0, import_util35.format)(
                 "The environment %s has a CDK toolkit stack (%s) that failed to create. Use %s to try provisioning it again.",
                 environment.name,
                 stackName,
@@ -284523,7 +284680,10 @@ function makeSdkLoggerSafeByBindingThis(logger2) {
   };
 }
 function cappedExponentialBackoff(baseMs, capMs) {
-  return (attempt) => Math.min(baseMs * 2 ** attempt, capMs);
+  return (attempt) => {
+    const delay = Math.min(baseMs * 2 ** attempt, capMs);
+    return Math.floor(delay / 2 + Math.random() * (delay / 2));
+  };
 }
 var import_client_appsync, import_client_bedrock_agentcore_control, import_client_cloudcontrol, import_client_cloudformation6, import_client_cloudtrail, import_client_cloudwatch_logs, import_client_codebuild, import_client_ec2, import_client_ecr2, import_client_ecs, import_client_elastic_load_balancing_v2, import_client_iam, import_client_kms, import_client_lambda, import_client_route_53, import_client_s33, import_client_secrets_manager2, import_client_sfn, import_client_ssm, import_client_sts2, import_lib_storage2, import_middleware_endpoint2, import_util_retry, SDK, CURRENT_ACCOUNT_KEY;
 var init_sdk2 = __esm({
@@ -285552,7 +285712,7 @@ async function v3ProviderFromPlugin(producer) {
   } else if (isV2Credentials(initial)) {
     return v3ProviderFromV2Credentials(initial);
   } else {
-    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util46.inspect)(initial)}`);
+    throw new AuthenticationError("InvalidPluginCredentials", `Plugin returned a value that doesn't resemble AWS credentials: ${(0, import_util45.inspect)(initial)}`);
   }
 }
 function v3ProviderFromV2Credentials(x) {
@@ -285571,7 +285731,7 @@ function refreshFromPluginProvider(current, producer) {
     if (credentialsAboutToExpire(current)) {
       const newCreds = await producer();
       if (!isV3Credentials(newCreds)) {
-        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util46.inspect)(newCreds)}`);
+        throw new AuthenticationError("PluginCredentialTypeMismatch", `Plugin initially returned static V3 credentials but now returned something else: ${(0, import_util45.inspect)(newCreds)}`);
       }
       current = newCreds;
     }
@@ -285587,11 +285747,11 @@ function isV2Credentials(x) {
 function isV3Credentials(x) {
   return !!(x && typeof x === "object" && x.accessKeyId && !isV2Credentials(x));
 }
-var import_util46, CredentialPlugins;
+var import_util45, CredentialPlugins;
 var init_credential_plugins = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts"() {
     "use strict";
-    import_util46 = require("util");
+    import_util45 = require("util");
     init_provider_caching();
     init_toolkit_error();
     init_util4();
@@ -285990,7 +286150,7 @@ function formatSdkLoggerContent(content) {
       return apiFmt;
     }
   }
-  return content.map((x) => typeof x === "string" ? x : (0, import_util49.inspect)(x)).join("");
+  return content.map((x) => typeof x === "string" ? x : (0, import_util48.inspect)(x)).join("");
 }
 function formatApiCall(content) {
   if (!isSdkApiCallSuccess(content) && !isSdkApiCallError(content)) {
@@ -286016,11 +286176,11 @@ function isSdkApiCallSuccess(x) {
 function isSdkApiCallError(x) {
   return x && typeof x === "object" && x.commandName && x.error;
 }
-var import_util49, IoHostSdkLogger;
+var import_util48, IoHostSdkLogger;
 var init_sdk_logger = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-logger.ts"() {
     "use strict";
-    import_util49 = require("util");
+    import_util48 = require("util");
     init_util4();
     init_private();
     IoHostSdkLogger = class {
@@ -286032,7 +286192,7 @@ var init_sdk_logger = __esm({
         this.ioHelper = ioHelper;
       }
       notify(level, ...content) {
-        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util49.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
+        void this.ioHelper.notify(IO.CDK_SDK_I0100.msg((0, import_util48.format)("[SDK %s] %s", level, formatSdkLoggerContent(content)), {
           sdkLevel: level,
           content
         }));
@@ -290793,6 +290953,12 @@ function quoteShellPart(part) {
     return part;
   }
   if (isWindows2) {
+    if (/%[^%]*%/.test(part)) {
+      throw new ToolkitError(
+        "UnsafeWindowsPath",
+        `Cannot safely run a path containing a '%...%' substring through the Windows shell: '${part}'. Rename the file or directory to remove the percent signs.`
+      );
+    }
     return `"${part}"`;
   }
   return `"${part.replace(/([\\"$`])/g, "\\$1")}"`;
@@ -290804,6 +290970,7 @@ var init_environment3 = __esm({
     path29 = __toESM(require("path"));
     cxapi4 = __toESM(require_lib11());
     fs28 = __toESM(require_lib4());
+    init_toolkit_error();
     __name(prepareDefaultEnvironment, "prepareDefaultEnvironment");
     __name(contextFromSettings, "contextFromSettings");
     __name(synthParametersFromSettings, "synthParametersFromSettings");
@@ -291109,12 +291276,12 @@ var init_readable_assembly = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts
-var path31, import_util54, cxapi6, fs31, CloudAssemblySourceBuilder;
+var path31, import_util53, cxapi6, fs31, CloudAssemblySourceBuilder;
 var init_source_builder = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/source-builder.ts"() {
     "use strict";
     path31 = __toESM(require("path"));
-    import_util54 = require("util");
+    import_util53 = require("util");
     cxapi6 = __toESM(require_lib3());
     fs31 = __toESM(require_lib4());
     init_context_store();
@@ -291180,7 +291347,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util54.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util53.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Versioning, outdir, default account and region
                   ...await execution.defaultEnvVars(),
@@ -291319,7 +291486,7 @@ var init_source_builder = __esm({
                   ...await contextStore.read(),
                   ...synthParams.context
                 };
-                await services.ioHelper.defaults.debug((0, import_util54.format)("context:", fullContext));
+                await services.ioHelper.defaults.debug((0, import_util53.format)("context:", fullContext));
                 const env3 = noUndefined({
                   // Need to start with full env of `writeContextToEnv` will not be able to do the size
                   // calculation correctly.
@@ -291520,6 +291687,21 @@ var init_stack_collection = __esm({
 });
 
 // ../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts
+function matcherFor(patterns) {
+  const positives = [];
+  const negatives = [];
+  for (const pattern of patterns) {
+    const parsed = (0, import_picomatch.default)(pattern, void 0, true);
+    (parsed.state.negated ? negatives : positives).push(parsed);
+  }
+  if (positives.length === 0 && negatives.length === 0) {
+    return () => false;
+  }
+  return (hierarchicalId) => {
+    const included = positives.length === 0 || positives.some((matches) => matches(hierarchicalId));
+    return included && negatives.every((matches) => matches(hierarchicalId));
+  };
+}
 function indexByHierarchicalId(stacks) {
   const result2 = /* @__PURE__ */ new Map();
   for (const stack of stacks) {
@@ -291584,7 +291766,6 @@ var init_stack_assembly = __esm({
     import_picomatch = __toESM(require_picomatch4());
     import_semver2 = __toESM(require_semver4());
     init_toolkit_error();
-    init_util4();
     init_private();
     init_stack_collection();
     init_stack_selector();
@@ -291708,7 +291889,7 @@ var init_stack_assembly = __esm({
             }
             return {
               stacks: matched,
-              suggestions: options.suggestPatternMatches ? this.suggestionsForPatterns(patterns, matched) : void 0
+              suggestions: options.suggestPatternMatches ? this.suggestionsForPatterns(patterns) : void 0
             };
         }
       }
@@ -291718,13 +291899,16 @@ var init_stack_assembly = __esm({
        * at least one stack are omitted; the array is empty when there is no close
        * match. Pure computation, never throws, emits no output.
        */
-      suggestionsForPatterns(patterns, matched) {
+      suggestionsForPatterns(patterns) {
         const suggestions = {};
         for (const pattern of patterns) {
-          if (matched.stackArtifacts.some((stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId, pattern))) {
+          const exact = (0, import_picomatch.default)(pattern, void 0, true);
+          const loose = (0, import_picomatch.default)(pattern.toLowerCase());
+          const refersTo = exact.state.negated ? (matches, id) => !matches(id) : (matches, id) => matches(id);
+          if (this.allStacks.some((stack) => refersTo(exact, stack.hierarchicalId))) {
             continue;
           }
-          suggestions[pattern] = this.allStacks.filter((stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId.toLowerCase(), pattern.toLowerCase())).map((stack) => stack.hierarchicalId);
+          suggestions[pattern] = this.allStacks.filter((stack) => refersTo(loose, stack.hierarchicalId.toLowerCase())).map((stack) => stack.hierarchicalId);
         }
         return suggestions;
       }
@@ -291738,8 +291922,8 @@ var init_stack_assembly = __esm({
         return new StackCollection(this, selected);
       }
       async selectMatchingStacks(stacks, patterns, extend = "none" /* NONE */) {
-        const matchingPattern = /* @__PURE__ */ __name((pattern) => (stack) => (0, import_picomatch.isMatch)(stack.hierarchicalId, pattern), "matchingPattern");
-        const matchedStacks = flatten2(patterns.map((pattern) => stacks.filter(matchingPattern(pattern))));
+        const selects = matcherFor(patterns);
+        const matchedStacks = stacks.filter((stack) => selects(stack.hierarchicalId));
         return this.extendStacks(matchedStacks, stacks, extend);
       }
       async extendStacks(matched, all, extend = "none" /* NONE */) {
@@ -291760,6 +291944,7 @@ var init_stack_assembly = __esm({
         return new StackCollection(this, selectedList);
       }
     };
+    __name(matcherFor, "matcherFor");
     __name(indexByHierarchicalId, "indexByHierarchicalId");
     __name(includeDownstreamStacks, "includeDownstreamStacks");
     __name(includeUpstreamStacks, "includeUpstreamStacks");
@@ -292628,11 +292813,11 @@ function removeNonImportResources(stack) {
   delete template.Outputs;
   return template;
 }
-var import_util59, cfnDiff, import_chalk17, fs32, ResourceImporter;
+var import_util57, cfnDiff, import_chalk17, fs32, ResourceImporter;
 var init_importer = __esm({
   "../@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts"() {
     "use strict";
-    import_util59 = require("util");
+    import_util57 = require("util");
     cfnDiff = __toESM(require_lib9());
     import_chalk17 = __toESM(require_source());
     fs32 = __toESM(require_lib4());
@@ -292696,12 +292881,12 @@ var init_importer = __esm({
           const descr = this.describeResource(resource.logicalId);
           const idProps = remaining[resource.logicalId];
           if (idProps) {
-            await this.ioHelper.defaults.info((0, import_util59.format)("%s: importing using %s", import_chalk17.default.blue(descr), import_chalk17.default.blue(fmtdict(idProps))));
+            await this.ioHelper.defaults.info((0, import_util57.format)("%s: importing using %s", import_chalk17.default.blue(descr), import_chalk17.default.blue(fmtdict(idProps))));
             ret.importResources.push(resource);
             ret.resourceMap[resource.logicalId] = idProps;
             delete remaining[resource.logicalId];
           } else {
-            await this.ioHelper.defaults.info((0, import_util59.format)("%s: skipping", import_chalk17.default.blue(descr)));
+            await this.ioHelper.defaults.info((0, import_util57.format)("%s: skipping", import_chalk17.default.blue(descr)));
           }
         }
         const unknown = Object.keys(remaining);
@@ -292745,9 +292930,9 @@ var init_importer = __esm({
           });
           assertIsSuccessfulDeployStackResult(result2);
           const message2 = result2.noOp ? "\u2705  %s (no changes)" : "\u2705  %s";
-          await this.ioHelper.defaults.info("\n" + import_chalk17.default.green((0, import_util59.format)(message2, this.stack.displayName)));
+          await this.ioHelper.defaults.info("\n" + import_chalk17.default.green((0, import_util57.format)(message2, this.stack.displayName)));
         } catch (e6) {
-          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util59.format)("\n \u274C  %s failed: %s", import_chalk17.default.bold(this.stack.displayName), e6), { error: e6 }));
+          await this.ioHelper.notify(IO.CDK_TOOLKIT_E3900.msg((0, import_util57.format)("\n \u274C  %s failed: %s", import_chalk17.default.bold(this.stack.displayName), e6), { error: e6 }));
           throw e6;
         }
       }
@@ -292877,7 +293062,7 @@ var init_importer = __esm({
           for (const idProp of idProps) {
             const defaultValue2 = resourceProps[idProp] ?? "";
             const response = await this.ioHelper.requestResponse(IO.CDK_TOOLKIT_I3110.req(
-              (0, import_util59.format)(promptPattern, import_chalk17.default.blue(idProp)),
+              (0, import_util57.format)(promptPattern, import_chalk17.default.blue(idProp)),
               {
                 resource: {
                   name: resourceName,
@@ -298909,7 +299094,7 @@ function countAssemblyResults(span, assembly) {
   span.incCounter("assemblies", asmCount(assembly));
   span.incCounter("errorAnns", sum3(stacksRecursively.map((s2) => s2.messages.filter((m4) => m4.level === import_cloud_assembly_api14.SynthesisMessageLevel.ERROR).length)));
   span.incCounter("warnings", sum3(stacksRecursively.map((s2) => s2.messages.filter((m4) => m4.level === import_cloud_assembly_api14.SynthesisMessageLevel.WARNING).length)));
-  const annotationErrorCodes = stacksRecursively.flatMap((s2) => Object.values(s2.metadata).flatMap((ms) => ms.filter((m4) => m4.type === ANNOTATION_ERROR_CODE_TYPE)));
+  const annotationErrorCodes = stacksRecursively.flatMap((s2) => Object.values(s2.metadata ?? {}).flatMap((ms) => ms.filter((m4) => m4.type === ANNOTATION_ERROR_CODE_TYPE)));
   for (const annotationErrorCode of annotationErrorCodes) {
     span.incCounter(`errorAnn:${annotationErrorCode.data}`);
   }
@@ -300035,33 +300220,7 @@ var init_toolkit = __esm({
         try {
           const ioHelper = asIoHelper(this.ioHost, "synth");
           const assembly = __using(_stack, new AsyncDisposableBox(await synthAndMeasure(ioHelper, cx, stacksOpt(options))), true);
-          const stacks = await assembly.value.selectStacks(stacksOpt(options));
-          const autoValidateStacks = options.validateStacks ? [assembly.value.selectStacksForValidation()] : [];
-          await throwIfValidationFailures(assembly.value, stacks.concat(...autoValidateStacks), this.assemblyFailureAt, ioHelper);
-          const message2 = `Successfully synthesized to ${import_chalk29.default.blue(path35.resolve(stacks.assembly.directory))}`;
-          const assemblyData = {
-            assemblyDirectory: stacks.assembly.directory,
-            stacksCount: stacks.stackCount,
-            stackIds: stacks.hierarchicalIds
-          };
-          if (stacks.stackCount === 1) {
-            const firstStack = stacks.firstStack;
-            const template = firstStack.template;
-            const obscuredTemplate = obscureTemplate(template);
-            await ioHelper.notify(IO.CDK_TOOLKIT_I1901.msg(message2, {
-              ...assemblyData,
-              stack: {
-                stackName: firstStack.stackName,
-                hierarchicalId: firstStack.hierarchicalId,
-                template,
-                stringifiedJson: serializeStructure(obscuredTemplate, true),
-                stringifiedYaml: serializeStructure(obscuredTemplate, false)
-              }
-            }));
-          } else {
-            await ioHelper.notify(IO.CDK_TOOLKIT_I1902.msg(import_chalk29.default.green(message2), assemblyData));
-            await ioHelper.defaults.info(`Supply a stack id (${stacks.stackArtifacts.map((s2) => import_chalk29.default.green(s2.hierarchicalId)).join(", ")}) to display its template.`);
-          }
+          await this._synth(assembly.value, options);
           return new CachedCloudAssembly(assembly.take());
         } catch (_) {
           var _error = _, _hasError = true;
@@ -300070,6 +300229,40 @@ var init_toolkit = __esm({
           _promise && await _promise;
         }
       }
+      /**
+       * Helper to allow synth being called with an already-produced assembly,
+       * e.g. as part of the watch action which reuses the startup assembly.
+       */
+      async _synth(assembly, options = {}) {
+        const ioHelper = asIoHelper(this.ioHost, "synth");
+        const stacks = await assembly.selectStacks(stacksOpt(options));
+        const autoValidateStacks = options.validateStacks ? [assembly.selectStacksForValidation()] : [];
+        await throwIfValidationFailures(assembly, stacks.concat(...autoValidateStacks), this.assemblyFailureAt, ioHelper);
+        const message2 = `Successfully synthesized to ${import_chalk29.default.blue(path35.resolve(stacks.assembly.directory))}`;
+        const assemblyData = {
+          assemblyDirectory: stacks.assembly.directory,
+          stacksCount: stacks.stackCount,
+          stackIds: stacks.hierarchicalIds
+        };
+        if (stacks.stackCount === 1) {
+          const firstStack = stacks.firstStack;
+          const template = firstStack.template;
+          const obscuredTemplate = obscureTemplate(template);
+          await ioHelper.notify(IO.CDK_TOOLKIT_I1901.msg(message2, {
+            ...assemblyData,
+            stack: {
+              stackName: firstStack.stackName,
+              hierarchicalId: firstStack.hierarchicalId,
+              template,
+              stringifiedJson: serializeStructure(obscuredTemplate, true),
+              stringifiedYaml: serializeStructure(obscuredTemplate, false)
+            }
+          }));
+        } else {
+          await ioHelper.notify(IO.CDK_TOOLKIT_I1902.msg(import_chalk29.default.green(message2), assemblyData));
+          await ioHelper.defaults.info(`Supply a stack id (${stacks.stackArtifacts.map((s2) => import_chalk29.default.green(s2.hierarchicalId)).join(", ")}) to display its template.`);
+        }
+      }
       /**
        * Diff Action
        */
@@ -300766,6 +300959,40 @@ ${deployResult.stackArn}`));
           onDispose: /* @__PURE__ */ __name(async () => cloudWatchLogMonitor?.deactivate(), "onDispose")
         });
       }
+      /**
+       * Continuously observe project files and re-synthesize the selected stacks
+       * automatically when changes are detected.
+       *
+       * Never deploys: each iteration re-synthesizes the app to the cloud assembly
+       * output directory and runs the same checks as the `synth` action.
+       *
+       * This function returns immediately, starting a watcher in the background.
+       */
+      async watchSynth(cx, options = {}) {
+        const ioHelper = asIoHelper(this.ioHost, "synth");
+        return this._watch(cx, options, {
+          command: "cdk synth",
+          activity: "synthesis",
+          // `_watch` runs this inside `invokeSafe`, which reports (and swallows)
+          // failures so the loop survives synth errors while the user is mid-edit.
+          invoke: /* @__PURE__ */ __name(async (initialAssembly) => {
+            var _stack = [];
+            try {
+              if (initialAssembly) {
+                await this._synth(initialAssembly, options);
+                return;
+              }
+              const assembly = __using(_stack, await synthAndMeasure(ioHelper, cx, stacksOpt(options)), true);
+              await this._synth(assembly, options);
+            } catch (_) {
+              var _error = _, _hasError = true;
+            } finally {
+              var _promise = __callDispose(_stack, _error, _hasError);
+              _promise && await _promise;
+            }
+          }, "invoke")
+        });
+      }
       /**
        * Continuously observe project files and validate the selected stacks
        * automatically when changes are detected.
@@ -302743,6 +302970,10 @@ var require_cli_type_registry = __commonJS({
               alias: "q",
               desc: "Do not output CloudFormation Template to stdout",
               default: false
+            },
+            watch: {
+              type: "boolean",
+              desc: "Continuously observe the project files, and synthesize the given stack(s) automatically when changes are detected. Never deploys, and never prints templates to stdout (--quiet and --json have no effect)"
             }
           }
         },
@@ -309404,7 +309635,7 @@ async function execProgram(aws, ioHelper, config2) {
     ...config2.context.all,
     ...params.context
   };
-  await debugFn((0, import_util77.format)("context:", context));
+  await debugFn((0, import_util75.format)("context:", context));
   if (params.env.CDK_DEBUG === "true") {
     await ioHelper.defaults.info("\u{1F50D} Synthesizing with debug information. This may take a bit longer.");
   }
@@ -309454,7 +309685,7 @@ async function execProgram(aws, ioHelper, config2) {
   const perfCountersFile = path44.join(outdir, "performance-counters.json");
   await fs47.promises.rm(perfCountersFile, { force: true });
   env3.CDK_PERF_COUNTERS_FILE = perfCountersFile;
-  await debugFn((0, import_util77.format)("env:", env3));
+  await debugFn((0, import_util75.format)("env:", env3));
   const cleanupTemp = writeContextToEnv(env3, context, "add-process-env-later");
   try {
     await exec2(commandLine);
@@ -309507,12 +309738,12 @@ function createAssembly(appDir) {
 function noUndefined2(xs) {
   return Object.fromEntries(Object.entries(xs).filter(([_, v]) => v !== void 0));
 }
-var path44, import_util77, import_cloud_assembly_api16, cxschema11, cxapi12, import_toolkit_lib15, fs47;
+var path44, import_util75, import_cloud_assembly_api16, cxschema11, cxapi12, import_toolkit_lib15, fs47;
 var init_exec2 = __esm({
   "lib/cxapp/exec.ts"() {
     "use strict";
     path44 = __toESM(require("path"));
-    import_util77 = require("util");
+    import_util75 = require("util");
     import_cloud_assembly_api16 = __toESM(require_lib3());
     cxschema11 = __toESM(require_lib2());
     cxapi12 = __toESM(require_lib11());
@@ -311408,6 +311639,38 @@ Do you wish to deploy these changes?`;
         await displayFlagsMessage(this.ioHost.asIoHelper(), this.toolkit, this.props.cloudExecutable);
         return void 0;
       }
+      /**
+       * Continuously synthesize the project, re-synthesizing on every file change.
+       * Never deploys, and never prints templates to stdout.
+       *
+       * The files to observe are configured with the "watch" key of `cdk.json`,
+       * exactly like `cdk deploy --watch`.
+       */
+      async synthWatch(options) {
+        const rootDir = path46.dirname(path46.resolve(PROJECT_CONFIG));
+        const watchSettings = this.props.configuration.settings.get(["watch"]);
+        if (!watchSettings) {
+          throw new import_toolkit_lib17.ToolkitError(
+            "WatchConfigMissing",
+            `Cannot use '--watch' without specifying at least one directory to monitor. Make sure to add a "watch" key to your cdk.json`
+          );
+        }
+        const include = this.patternsArrayForWatch(watchSettings.include, {
+          defaultPattern: "**",
+          returnDefaultIfEmpty: true
+        });
+        const exclude = this.patternsArrayForWatch(watchSettings.exclude, {
+          defaultPattern: "",
+          returnDefaultIfEmpty: false
+        });
+        const watcher = await this.toolkit.watchSynth(this.props.cloudExecutable.uncachedSource(), {
+          ...options,
+          watchDir: rootDir,
+          include,
+          exclude
+        });
+        return watcher.waitForEnd();
+      }
       /**
        * Bootstrap the CDK Toolkit stack in the accounts used by the specified stack(s).
        *
@@ -317213,6 +317476,10 @@ function parseCommandLineArguments(args) {
       type: "boolean",
       alias: "q",
       desc: "Do not output CloudFormation Template to stdout"
+    }).option("watch", {
+      default: void 0,
+      type: "boolean",
+      desc: "Continuously observe the project files, and synthesize the given stack(s) automatically when changes are detected. Never deploys, and never prints templates to stdout (--quiet and --json have no effect)"
     })
   ).command(
     "bootstrap [ENVIRONMENTS..]",
@@ -339576,7 +339843,7 @@ var require_types2 = __commonJS({
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
     var Op = Object.prototype;
     var objToStr = Op.toString;
-    var hasOwn2 = Op.hasOwnProperty;
+    var hasOwn3 = Op.hasOwnProperty;
     var BaseType = (
       /** @class */
       (function() {
@@ -339735,7 +340002,7 @@ var require_types2 = __commonJS({
             if (this.finalized !== true || that.finalized !== true) {
               throw new Error("");
             }
-            return hasOwn2.call(that.allSupertypes, this.typeName);
+            return hasOwn3.call(that.allSupertypes, this.typeName);
           } else {
             throw new Error(that + " is not a Def");
           }
@@ -339867,10 +340134,10 @@ var require_types2 = __commonJS({
         // The Def object d returned from Type.def may be used to configure the
         // type d.type by calling methods such as d.bases, d.build, and d.field.
         def: /* @__PURE__ */ __name(function(typeName) {
-          return hasOwn2.call(defCache, typeName) ? defCache[typeName] : defCache[typeName] = new DefImpl(typeName);
+          return hasOwn3.call(defCache, typeName) ? defCache[typeName] : defCache[typeName] = new DefImpl(typeName);
         }, "def"),
         hasDef: /* @__PURE__ */ __name(function(typeName) {
-          return hasOwn2.call(defCache, typeName);
+          return hasOwn3.call(defCache, typeName);
         }, "hasDef")
       };
       var builtInCtorFns = [];
@@ -339914,7 +340181,7 @@ var require_types2 = __commonJS({
       function defFromValue(value2) {
         if (value2 && typeof value2 === "object") {
           var type = value2.type;
-          if (typeof type === "string" && hasOwn2.call(defCache, type)) {
+          if (typeof type === "string" && hasOwn3.call(defCache, type)) {
             var d6 = defCache[type];
             if (d6.finalized) {
               return d6;
@@ -339975,10 +340242,10 @@ var require_types2 = __commonJS({
             });
             this.buildable = true;
             var addParam = /* @__PURE__ */ __name(function(built, param, arg, isArgAvailable) {
-              if (hasOwn2.call(built, param))
+              if (hasOwn3.call(built, param))
                 return;
               var all = _this.allFields;
-              if (!hasOwn2.call(all, param)) {
+              if (!hasOwn3.call(all, param)) {
                 throw new Error("" + param);
               }
               var field = all[param];
@@ -340030,7 +340297,7 @@ var require_types2 = __commonJS({
               }
               var built = Object.create(nodePrototype);
               Object.keys(_this.allFields).forEach(function(param) {
-                if (hasOwn2.call(obj, param)) {
+                if (hasOwn3.call(obj, param)) {
                   addParam(built, param, obj[param], true);
                 } else {
                   addParam(built, param, null, false);
@@ -340075,7 +340342,7 @@ var require_types2 = __commonJS({
               allSupertypes[this.typeName] = this;
               this.fieldNames.length = 0;
               for (var fieldName in allFields) {
-                if (hasOwn2.call(allFields, fieldName) && !allFields[fieldName].hidden) {
+                if (hasOwn3.call(allFields, fieldName) && !allFields[fieldName].hidden) {
                   this.fieldNames.push(fieldName);
                 }
               }
@@ -340094,7 +340361,7 @@ var require_types2 = __commonJS({
         })(Def)
       );
       function getSupertypeNames(typeName) {
-        if (!hasOwn2.call(defCache, typeName)) {
+        if (!hasOwn3.call(defCache, typeName)) {
           throw new Error("");
         }
         var d6 = defCache[typeName];
@@ -340116,7 +340383,7 @@ var require_types2 = __commonJS({
           }
           for (var j6 = 0; j6 < d6.supertypeList.length; ++j6) {
             var superTypeName = d6.supertypeList[j6];
-            if (hasOwn2.call(candidates, superTypeName)) {
+            if (hasOwn3.call(candidates, superTypeName)) {
               table3[typeName] = superTypeName;
               break;
             }
@@ -340231,14 +340498,14 @@ var require_types2 = __commonJS({
           if (d6.finalized !== true) {
             throw new Error("");
           }
-          if (hasOwn2.call(lastSeen, typeName)) {
+          if (hasOwn3.call(lastSeen, typeName)) {
             delete list2[lastSeen[typeName]];
           }
           lastSeen[typeName] = pos2;
           list2.push.apply(list2, d6.baseNames);
         }
         for (var to = 0, from = to, len = list2.length; from < len; ++from) {
-          if (hasOwn2.call(list2, from)) {
+          if (hasOwn3.call(list2, from)) {
             list2[to++] = list2[from];
           }
         }
@@ -340288,7 +340555,7 @@ var require_path2 = __commonJS({
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
     var types_1 = tslib_1.__importDefault(require_types2());
     var Op = Object.prototype;
-    var hasOwn2 = Op.hasOwnProperty;
+    var hasOwn3 = Op.hasOwnProperty;
     function pathPlugin(fork) {
       var types2 = fork.use(types_1.default);
       var isArray2 = types2.builtInTypes.array;
@@ -340319,7 +340586,7 @@ var require_path2 = __commonJS({
         var cache6 = getChildCache(path54);
         var actualChildValue = path54.getValueProperty(name);
         var childPath = cache6[name];
-        if (!hasOwn2.call(cache6, name) || // Ensure consistency between cache and reality.
+        if (!hasOwn3.call(cache6, name) || // Ensure consistency between cache and reality.
         childPath.value !== actualChildValue) {
           childPath = cache6[name] = new path54.constructor(actualChildValue, path54, name);
         }
@@ -340346,13 +340613,13 @@ var require_path2 = __commonJS({
         var len = this.value.length;
         var i6 = 0;
         for (var i6 = 0; i6 < len; ++i6) {
-          if (hasOwn2.call(this.value, i6)) {
+          if (hasOwn3.call(this.value, i6)) {
             childPaths[i6] = this.get(i6);
           }
         }
         context = context || this;
         for (i6 = 0; i6 < len; ++i6) {
-          if (hasOwn2.call(childPaths, i6)) {
+          if (hasOwn3.call(childPaths, i6)) {
             callback.call(context, childPaths[i6]);
           }
         }
@@ -340401,7 +340668,7 @@ var require_path2 = __commonJS({
         var moves = /* @__PURE__ */ Object.create(null);
         var cache6 = getChildCache(path54);
         for (var i6 = start; i6 < end2; ++i6) {
-          if (hasOwn2.call(path54.value, i6)) {
+          if (hasOwn3.call(path54.value, i6)) {
             var childPath = path54.get(i6);
             if (childPath.name !== i6) {
               throw new Error("");
@@ -340596,7 +340863,7 @@ var require_scope = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
     var types_1 = tslib_1.__importDefault(require_types2());
-    var hasOwn2 = Object.prototype.hasOwnProperty;
+    var hasOwn3 = Object.prototype.hasOwnProperty;
     function scopePlugin(fork) {
       var types2 = fork.use(types_1.default);
       var Type = types2.Type;
@@ -340648,11 +340915,11 @@ var require_scope = __commonJS({
       Sp.didScan = false;
       Sp.declares = function(name) {
         this.scan();
-        return hasOwn2.call(this.bindings, name);
+        return hasOwn3.call(this.bindings, name);
       };
       Sp.declaresType = function(name) {
         this.scan();
-        return hasOwn2.call(this.types, name);
+        return hasOwn3.call(this.types, name);
       };
       Sp.declareTemporary = function(prefix) {
         if (prefix) {
@@ -340771,7 +341038,7 @@ var require_scope = __commonJS({
           if (namedTypes.CatchClause.check(node) && // TODO Broaden this to accept any pattern.
           namedTypes.Identifier.check(node.param)) {
             var catchParamName = node.param.name;
-            var hadBinding = hasOwn2.call(bindings, catchParamName);
+            var hadBinding = hasOwn3.call(bindings, catchParamName);
             recursiveScanScope(path54.get("body"), bindings, scopeTypes2);
             if (!hadBinding) {
               delete bindings[catchParamName];
@@ -340786,7 +341053,7 @@ var require_scope = __commonJS({
         var pattern = patternPath.value;
         namedTypes.Pattern.assert(pattern);
         if (namedTypes.Identifier.check(pattern)) {
-          if (hasOwn2.call(bindings, pattern.name)) {
+          if (hasOwn3.call(bindings, pattern.name)) {
             bindings[pattern.name].push(patternPath);
           } else {
             bindings[pattern.name] = [patternPath];
@@ -340824,7 +341091,7 @@ var require_scope = __commonJS({
         var pattern = patternPath.value;
         namedTypes.Pattern.assert(pattern);
         if (namedTypes.Identifier.check(pattern)) {
-          if (hasOwn2.call(types3, pattern.name)) {
+          if (hasOwn3.call(types3, pattern.name)) {
             types3[pattern.name].push(patternPath);
           } else {
             types3[pattern.name] = [patternPath];
@@ -341228,7 +341495,7 @@ var require_path_visitor = __commonJS({
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
     var types_1 = tslib_1.__importDefault(require_types2());
     var node_path_1 = tslib_1.__importDefault(require_node_path());
-    var hasOwn2 = Object.prototype.hasOwnProperty;
+    var hasOwn3 = Object.prototype.hasOwnProperty;
     function pathVisitorPlugin(fork) {
       var types2 = fork.use(types_1.default);
       var NodePath = fork.use(node_path_1.default);
@@ -341242,7 +341509,7 @@ var require_path_visitor = __commonJS({
         }
         this._reusableContextStack = [];
         this._methodNameTable = computeMethodNameTable(this);
-        this._shouldVisitComments = hasOwn2.call(this._methodNameTable, "Block") || hasOwn2.call(this._methodNameTable, "Line");
+        this._shouldVisitComments = hasOwn3.call(this._methodNameTable, "Block") || hasOwn3.call(this._methodNameTable, "Line");
         this.Context = makeContextConstructor(this);
         this._visiting = false;
         this._changeReported = false;
@@ -341291,7 +341558,7 @@ var require_path_visitor = __commonJS({
       }, "fromMethodsObject");
       function extend(target, source) {
         for (var property in source) {
-          if (hasOwn2.call(source, property)) {
+          if (hasOwn3.call(source, property)) {
             target[property] = source[property];
           }
         }
@@ -341383,7 +341650,7 @@ var require_path_visitor = __commonJS({
           var childPaths = [];
           for (var i6 = 0; i6 < childCount; ++i6) {
             var childName = childNames[i6];
-            if (!hasOwn2.call(value2, childName)) {
+            if (!hasOwn3.call(value2, childName)) {
               value2[childName] = types2.getFieldValue(value2, childName);
             }
             childPaths.push(path54.get(childName));
@@ -341535,7 +341802,7 @@ var require_equiv = __commonJS({
       var isObject3 = types2.builtInTypes.object;
       var isDate = types2.builtInTypes.Date;
       var isRegExp = types2.builtInTypes.RegExp;
-      var hasOwn2 = Object.prototype.hasOwnProperty;
+      var hasOwn3 = Object.prototype.hasOwnProperty;
       function astNodesAreEquivalent(a6, b6, problemPath) {
         if (isArray2.check(problemPath)) {
           problemPath.length = 0;
@@ -341656,7 +341923,7 @@ var require_equiv = __commonJS({
         }
         for (i6 = 0; i6 < bNameCount; ++i6) {
           name = bNames[i6];
-          if (!hasOwn2.call(seenNames, name)) {
+          if (!hasOwn3.call(seenNames, name)) {
             problemPath.push(name);
             return false;
           }
@@ -368389,7 +368656,8 @@ async function exec(args, synthesizer) {
   );
   if (guessAgent() && !argv.verbose && configuration.settings.get(["progress"]) === void 0) {
     ioHost.stackProgress = "errors-only" /* ERRORS_ONLY */;
-    await ioHost.defaults.info('AI agent detected, using --progress "errors-only" (set --progress or the "progress" key in cdk.json to change)');
+    await ioHost.defaults.info("AI agent detected");
+    await ioHost.defaults.debug('Using --progress "errors-only" (set --progress or the "progress" key in cdk.json to change)');
   }
   const proxyAgent = await new ProxyAgentProvider(ioHelper).create({
     proxyAddress: configuration.settings.get(["proxy"]),
@@ -368786,6 +369054,12 @@ async function exec(args, synthesizer) {
       case "synthesize":
       case "synth":
         ioHost.currentAction = "synth";
+        if (args2.watch) {
+          return cli2.synthWatch({
+            stacks: specificStacksOrAllRecursively(args2.STACKS),
+            validateStacks: args2.validation
+          });
+        }
         const quiet = configuration.settings.get(["quiet"]) ?? args2.quiet;
         return cli2.synth({
           stackNames: args2.STACKS,