@go-to-k/cdkd 0.289.6 → 0.289.8

package/dist/{program-B3I46yaG.js → program-BJxsQ7qM.js}

@@ -1,8 +1,8 @@
-import { $ as collectInlinePolicyNamesManagedBySiblings, $n as buildDenyExternalAccessPolicy, $r as DynamicReferenceRegionAmbiguousError, $t as describeTypeWithThrottleRetry, A as isStatefulRecreateTargetForReplace, An as exportNamesCarriedFrom, Ar as CFN_TEMPLATE_URL_LIMIT, At as coerceCfnBoolean, B as gray, Bn as createAssetRedirectResolver, Br as processStackMessages, Bt as classifyReplaySecretRegion, C as refusesFinalSnapshot, Ci as retryClassificationText, Cn as UNRENDERABLE, Cr as resolveSkipPrefix, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as shellQuote, Dr as stateBucketExistenceConfirmed, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as forceQuitRecoveryClause, Er as resolveUseCdkBootstrapAssets, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as shouldRetainResource, Fr as expectedOwnerParam, Ft as readConfigString, G as collectPublishedOutputNames, Gn as assertAssetBucketRegion, Gr as resetAwsClients, Gt as s3BucketDualStackDomainName, H as red, Hn as rewriteTemplateAssetReferences, Hr as resolveBucketRegion, Ht as withSharedDrainBudget, I as toFiniteNumber, In as AssetPublisher, Ir as PARTITION_TABLE, It as replayWarn, J as secretBearing, Jn as isCrossRegionRedirect, Jr as CdkdError, Jt as applyRoleArnIfSet, K as exportAliasCollisionScrubWarning, Kn as ensureAssetStorage, Kr as setAwsClients, Kt as s3BucketRegionalDomainName, L as formatResourceLine, Ln as stringifyValue, Lr as canonicalizeRegion, Lt as requireConfigArray, M as renderStatefulReason, Mn as importableOutputs, Mr as findLargeInlineResources, Mt as configBooleanRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as orphansAfterRollback, Nr as uploadCfnTemplate, Nt as configIntegerRefusal, O as planOrphanAdoption, On as CUSTOM_RESOURCE_RESPONSE_PREFIX, Or as warnDeprecatedNoPrefixCliFlag, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as orphansCarriedFrom, Pr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Pt as configStringRefusal, Q as IAMRoleProvider, Qn as validateContainerRepoName, Qr as DeployCancelledError, Qt as findSilentDropProperties, R as bold, Rn as WorkGraph, Rr as derivePartitionAndUrlSuffix, Rt as requireConfigObject, S as isFinalSnapshotError, Si as markRedactedCause, Sn as rebuildClientForBucketRegion, Sr as resolveCaptureObservedState, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as buildLockContentionMessage, Tr as resolveStateBucketWithDefaultAndSource, Tt as refStateLookupFromResource, U as yellow, Un as AssetModeResolver, Ur as AwsClients, Ut as s3BucketArn, V as green, Vn as loadPublishableAssetManifest, Vt as producerRegionsFromState, W as collectDeclaredOutputNames, Wn as BOOTSTRAP_MARKER_PREFIX, Wr as getAwsClients, Wt as s3BucketDomainName, X as secretSafeKeyDisplay, Xn as readBootstrapMarkerBody, Xr as CrossAccountSecretRefusalError, Xt as INTRINSIC_KEYS, Y as secretBearingStateKeyWarning, Yn as parseBootstrapMarker, Yt as DiffCalculator, Z as getCurrentResourceSecrets, Zn as validateAssetBucketName, Zt as findActionableSilentDrops, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isMarkedNonRetryable, _n as recoverMaskedOutput, _r as synthesisStatusMessage, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as PartialFailureError, an as STATE_SOURCED_READBACK_RULES, ar as dockerSpawnEnvWithSensitive, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as isTransientServerError, bn as LockManager, br as resolveApp, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as ResourceUpdateNotSupportedError, cn as createSecretMasker, cr as partitionSensitiveEnv, ct as interruptWatchListenerCount, d as updatePartialReason, dn as identityKeyFor, dr as runDockerStreaming, dt as CloudControlProvider, ei as IntrinsicResolutionRefusalError, en as withRetry, er as describeAwsFailure, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as isSingleDynamicReferenceToken, fr as escapeRegExp, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as withErrorHandling, gn as recordMaskOnlyValue, gr as Synthesizer, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as normalizeAwsError, hn as maskSecretsInText, hr as getDockerImageBySourceHash, ht as deleteSkipReason, i as DeploymentEventsReader, ii as NestedStackChildDirectDestroyError, in as STATE_SOURCED_CROSS_GENERATION_RULES, ir as describeDockerFailure, it as maskDeep, j as isStatefulRecreateTargetSync, jn as importableOutputKeys, jr as MIGRATE_TMP_PREFIX, jt as coerceCfnInteger, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as DEFAULT_STATE_PREFIX, kr as CFN_TEMPLATE_BODY_LIMIT, kt as assertRegionMatch, l as replayRollback, li as StackHasActiveImportsError, ln as dynamicReferenceTokens, lr as redactDockerArgvValues, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mn as maskSecretsInError, mr as AssetManifestLoader, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as LocalStartServiceError, nn as TemplateParser, nr as describeDockerCapturedOutput, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ProvisioningError, on as TEMPLATE_SOURCED_RULES, or as formatDockerLoginError, ot as beginCommandInterruptScope, p as maskingRetryLogger, pn as markSameGenerationBag, pr as stripControlChars, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as getBootstrapMarkerKey, qt as s3BucketWebsiteUrl, r as DeployEngine, rn as STATE_SOURCED_BASELINE_RULES, rr as describeDockerExecFailure, rt as createMaskedRetryLogger, s as planRollback, si as ResourceTimeoutError, sn as carriesSecretMask, sr as getDockerCmd, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as LocalInvokeBuildError$1, tn as DagBuilder, tr as buildDockerImage, tt as ProviderRegistry, u as updatePartialMessage, ui as StackTerminationProtectionError, un as errorCauseChain, ur as runDockerForeground, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isRetryableTransientError, vn as redactSecretsForState, vr as getDefaultStateBucketName, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as buildForceUnlockCommand, wr as resolveStateBucketWithDefault, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as markNonRetryable, xn as S3StateBackend, xr as resolveAutoAssetStorage, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as isThrottlingError, yn as scrubResourceRecord, yr as getLegacyStateBucketName, yt as carriesDynamicReference, z as cyan, zn as buildAssetRedirectMap, zr as AssemblyReader, zt as requireConfigString } from "./deploy-engine-CpmvgRtm.js";
-import { _ as withSkipPrefix, b as truncateCodePoints, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, y as displaySafe } from "./logger-BK-B0slT.js";
+import { $ as collectInlinePolicyNamesManagedBySiblings, $n as buildDenyExternalAccessPolicy, $r as DynamicReferenceRegionAmbiguousError, $t as describeTypeWithThrottleRetry, A as isStatefulRecreateTargetForReplace, An as exportNamesCarriedFrom, Ar as CFN_TEMPLATE_URL_LIMIT, At as coerceCfnBoolean, B as gray, Bn as createAssetRedirectResolver, Br as processStackMessages, Bt as classifyReplaySecretRegion, C as refusesFinalSnapshot, Ci as retryClassificationText, Cn as buildForceUnlockCommand, Cr as resolveSkipPrefix, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as shellQuote, Dr as stateBucketExistenceConfirmed, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as formatLockExpiry, Er as resolveUseCdkBootstrapAssets, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as shouldRetainResource, Fr as expectedOwnerParam, Ft as readConfigString, G as collectPublishedOutputNames, Gn as assertAssetBucketRegion, Gr as resetAwsClients, Gt as s3BucketDualStackDomainName, H as red, Hn as rewriteTemplateAssetReferences, Hr as resolveBucketRegion, Ht as withSharedDrainBudget, I as toFiniteNumber, In as AssetPublisher, Ir as PARTITION_TABLE, It as replayWarn, J as secretBearing, Jn as isCrossRegionRedirect, Jr as CdkdError, Jt as applyRoleArnIfSet, K as exportAliasCollisionScrubWarning, Kn as ensureAssetStorage, Kr as setAwsClients, Kt as s3BucketRegionalDomainName, L as formatResourceLine, Ln as stringifyValue, Lr as canonicalizeRegion, Lt as requireConfigArray, M as renderStatefulReason, Mn as importableOutputs, Mr as findLargeInlineResources, Mt as configBooleanRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as orphansAfterRollback, Nr as uploadCfnTemplate, Nt as configIntegerRefusal, O as planOrphanAdoption, On as CUSTOM_RESOURCE_RESPONSE_PREFIX, Or as warnDeprecatedNoPrefixCliFlag, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as orphansCarriedFrom, Pr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Pt as configStringRefusal, Q as IAMRoleProvider, Qn as validateContainerRepoName, Qr as DeployCancelledError, Qt as findSilentDropProperties, R as bold, Rn as WorkGraph, Rr as derivePartitionAndUrlSuffix, Rt as requireConfigObject, S as isFinalSnapshotError, Si as markRedactedCause, Sn as rebuildClientForBucketRegion, Sr as resolveCaptureObservedState, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as forceQuitRecoveryClause, Tr as resolveStateBucketWithDefaultAndSource, Tt as refStateLookupFromResource, U as yellow, Un as AssetModeResolver, Ur as AwsClients, Ut as s3BucketArn, V as green, Vn as loadPublishableAssetManifest, Vt as producerRegionsFromState, W as collectDeclaredOutputNames, Wn as BOOTSTRAP_MARKER_PREFIX, Wr as getAwsClients, Wt as s3BucketDomainName, X as secretSafeKeyDisplay, Xn as readBootstrapMarkerBody, Xr as CrossAccountSecretRefusalError, Xt as INTRINSIC_KEYS, Y as secretBearingStateKeyWarning, Yn as parseBootstrapMarker, Yt as DiffCalculator, Z as getCurrentResourceSecrets, Zn as validateAssetBucketName, Zt as findActionableSilentDrops, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isMarkedNonRetryable, _n as recoverMaskedOutput, _r as synthesisStatusMessage, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as PartialFailureError, an as STATE_SOURCED_READBACK_RULES, ar as dockerSpawnEnvWithSensitive, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as isTransientServerError, bn as LockManager, br as resolveApp, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as ResourceUpdateNotSupportedError, cn as createSecretMasker, cr as partitionSensitiveEnv, ct as interruptWatchListenerCount, d as updatePartialReason, dn as identityKeyFor, dr as runDockerStreaming, dt as CloudControlProvider, ei as IntrinsicResolutionRefusalError, en as withRetry, er as describeAwsFailure, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as isSingleDynamicReferenceToken, fr as escapeRegExp, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as withErrorHandling, gn as recordMaskOnlyValue, gr as Synthesizer, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as normalizeAwsError, hn as maskSecretsInText, hr as getDockerImageBySourceHash, ht as deleteSkipReason, i as DeploymentEventsReader, ii as NestedStackChildDirectDestroyError, in as STATE_SOURCED_CROSS_GENERATION_RULES, ir as describeDockerFailure, it as maskDeep, j as isStatefulRecreateTargetSync, jn as importableOutputKeys, jr as MIGRATE_TMP_PREFIX, jt as coerceCfnInteger, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as DEFAULT_STATE_PREFIX, kr as CFN_TEMPLATE_BODY_LIMIT, kt as assertRegionMatch, l as replayRollback, li as StackHasActiveImportsError, ln as dynamicReferenceTokens, lr as redactDockerArgvValues, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mn as maskSecretsInError, mr as AssetManifestLoader, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as LocalStartServiceError, nn as TemplateParser, nr as describeDockerCapturedOutput, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ProvisioningError, on as TEMPLATE_SOURCED_RULES, or as formatDockerLoginError, ot as beginCommandInterruptScope, p as maskingRetryLogger, pn as markSameGenerationBag, pr as stripControlChars, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as getBootstrapMarkerKey, qt as s3BucketWebsiteUrl, r as DeployEngine, rn as STATE_SOURCED_BASELINE_RULES, rr as describeDockerExecFailure, rt as createMaskedRetryLogger, s as planRollback, si as ResourceTimeoutError, sn as carriesSecretMask, sr as getDockerCmd, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as LocalInvokeBuildError$1, tn as DagBuilder, tr as buildDockerImage, tt as ProviderRegistry, u as updatePartialMessage, ui as StackTerminationProtectionError, un as errorCauseChain, ur as runDockerForeground, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isRetryableTransientError, vn as redactSecretsForState, vr as getDefaultStateBucketName, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as buildLockContentionMessage, wr as resolveStateBucketWithDefault, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as markNonRetryable, xn as S3StateBackend, xr as resolveAutoAssetStorage, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as isThrottlingError, yn as scrubResourceRecord, yr as getLegacyStateBucketName, yt as carriesDynamicReference, z as cyan, zn as buildAssetRedirectMap, zr as AssemblyReader, zt as requireConfigString } from "./deploy-engine-zEwQVCh8.js";
+import { _ as withSkipPrefix, b as displaySafe, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as truncateCodePoints, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DCxqZhgp.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-eIVYMrmW.js";
+import { t as getCdkdVersion } from "./version-DWnjHtUC.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-D2lf-Qdo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -24300,6 +24300,109 @@ function requireSecretStringShape(literal) {
 	throw new Error(`SecretString must be a string, got ${literal === null ? "null" : Array.isArray(literal) ? "array" : typeof literal}`);
 }
 /**
+* The character classes a `GenerateSecretString` block leaves available,
+* after the `Exclude*` switches and `ExcludeCharacters` (issue #3068), or the
+* refusal that says why no password can be minted from it. ONE function for
+* the predicate and the generator, so the shapes the predicate refuses are
+* exactly the shapes the generator cannot serve.
+*
+* The caller has already run the member SHAPE predicates (`ExcludeCharacters`
+* is a string or absent, the booleans coerce, `PasswordLength` is an integer
+* in range) — this function reads the block by cast on that precondition.
+*
+* Three refusals, each MEASURED on CloudFormation (us-east-1, 2026-09-14): the
+* docs give the default (`RequireEachIncludedType` on) and the four-type
+* wording, but none of the refusal shapes or their messages:
+*
+* - `RequireEachIncludedType` defaults to TRUE and covers the four classes
+*   (upper, lower, number, punctuation) that are not switched off; a space is
+*   never required, only admitted. With it on, a class the `Exclude*` switch
+*   keeps but `ExcludeCharacters` empties is refused: `All characters of the
+*   desired type have been excluded`. With it OFF the same template CREATES
+*   (measured), so the refusal is scoped to REQUIRED classes.
+* - With it on, `PasswordLength` below the number of required classes is
+*   refused: `Password length is too short based on the required types`.
+* - A pool with no character at all is refused: `All characters have been
+*   excluded from selection`. The old local fallback to lowercase invented a
+*   charset the template had excluded.
+*/
+function generateCharset(config) {
+	const PUNCTUATION = "!\"#$%&'()*+,-./:;<=>?@[\\]^_" + String.fromCharCode(96) + "{|}~";
+	const off = (key) => coerceCfnBoolean(config[key]) ?? false;
+	const excluded = new Set(config["ExcludeCharacters"] ?? "");
+	const strip = (chars) => [...chars].filter((c) => !excluded.has(c)).join("");
+	const classes = [
+		[
+			"uppercase",
+			strip("ABCDEFGHIJKLMNOPQRSTUVWXYZ"),
+			"ExcludeUppercase"
+		],
+		[
+			"lowercase",
+			strip("abcdefghijklmnopqrstuvwxyz"),
+			"ExcludeLowercase"
+		],
+		[
+			"number",
+			strip("0123456789"),
+			"ExcludeNumbers"
+		],
+		[
+			"punctuation",
+			strip(PUNCTUATION),
+			"ExcludePunctuation"
+		]
+	];
+	const requireEach = coerceCfnBoolean(config["RequireEachIncludedType"]) ?? true;
+	const included = classes.filter(([, , switchKey]) => !off(switchKey));
+	const required = [];
+	if (requireEach) for (const [name, chars, switchKey] of included) {
+		if (chars.length === 0) return {
+			required: [],
+			pool: "",
+			refusal: `all characters of the ${name} type have been excluded while RequireEachIncludedType requires one (exclude the type with ${switchKey} instead)`
+		};
+		required.push(chars);
+	}
+	const space = (coerceCfnBoolean(config["IncludeSpace"]) ?? false) && !excluded.has(" ") ? " " : "";
+	const pool = included.map(([, chars]) => chars).join("") + space;
+	if (pool.length === 0) return {
+		required: [],
+		pool: "",
+		refusal: "all characters have been excluded from selection, so no password can be generated"
+	};
+	const length = coerceCfnInteger(config["PasswordLength"]) ?? 32;
+	if (required.length > length) return {
+		required: [],
+		pool: "",
+		refusal: `PasswordLength ${length} is too short for the ${required.length} character types RequireEachIncludedType requires`
+	};
+	return {
+		required,
+		pool
+	};
+}
+/**
+* A uniformly distributed index below `n`, by rejection: a raw draw taken
+* modulo `n` biases toward the low indexes whenever the draw's range is not
+* a multiple of `n` (2^32 never is for a 26- or 32-character class), and a
+* password generator should not.
+* The rejection IS fenced, deterministically: the unit suite stubs
+* `crypto.getRandomValues` to hand back a draw at or above `limit` and then
+* one below it, and asserts the first is thrown away (a `% n` shortcut would
+* mint from it). The bias itself is about 1 part in 2^32 / n per index at
+* this width — negligible either way; the rejection makes it zero.
+*/
+function randomIndex(n) {
+	if (!Number.isInteger(n) || n <= 0) throw new Error(`randomIndex: range must be a positive integer (got ${n})`);
+	const limit = Math.floor(4294967296 / n) * n;
+	const draw = /* @__PURE__ */ new Uint32Array(1);
+	for (;;) {
+		crypto.getRandomValues(draw);
+		if (draw[0] < limit) return draw[0] % n;
+	}
+}
+/**
 * The refusal for the MEMBERS of a `GenerateSecretString` block whose container
 * has already passed `requireConfigObject` (issue #3056), or `undefined` when
 * every member is usable. ONE predicate for two readers — the generator, which
@@ -24328,8 +24431,10 @@ function requireSecretStringShape(literal) {
 */
 function generateMemberRefusal(config) {
 	const P = "AWS::SecretsManager::Secret GenerateSecretString";
-	const shape = configIntegerRefusal(config, "PasswordLength", P, 1, 4096) ?? configBooleanRefusal(config, "ExcludeUppercase", P) ?? configBooleanRefusal(config, "ExcludeLowercase", P) ?? configBooleanRefusal(config, "ExcludeNumbers", P) ?? configBooleanRefusal(config, "ExcludePunctuation", P) ?? configStringRefusal(config, "ExcludeCharacters", "", P) ?? configStringRefusal(config, "GenerateStringKey", "required", P) ?? configStringRefusal(config, "SecretStringTemplate", "required", P);
+	const shape = configIntegerRefusal(config, "PasswordLength", P, 1, 4096) ?? configBooleanRefusal(config, "ExcludeUppercase", P) ?? configBooleanRefusal(config, "ExcludeLowercase", P) ?? configBooleanRefusal(config, "ExcludeNumbers", P) ?? configBooleanRefusal(config, "ExcludePunctuation", P) ?? configBooleanRefusal(config, "IncludeSpace", P) ?? configBooleanRefusal(config, "RequireEachIncludedType", P) ?? configStringRefusal(config, "ExcludeCharacters", "", P) ?? configStringRefusal(config, "GenerateStringKey", "required", P) ?? configStringRefusal(config, "SecretStringTemplate", "required", P);
 	if (shape !== void 0) return shape;
+	const charset = generateCharset(config);
+	if (charset.refusal !== void 0) return `${P}: ${charset.refusal}`;
 	const key = config["GenerateStringKey"];
 	const template = config["SecretStringTemplate"];
 	if (key === void 0 && template === void 0) return void 0;
@@ -24685,10 +24790,11 @@ var SecretsManagerSecretProvider = class {
 	* With no `onUnusable` a refusal THROWS (the create path, where the block
 	* is template-borne). With one, the message is handed over and `undefined`
 	* is returned — the update path's SKIP, decided by the caller, so that this
-	* function never mints from a block it could not read. The two members the
-	* schema declares that this recipe does not implement, `IncludeSpace` and
-	* `RequireEachIncludedType`, are a separate fidelity gap (issue #3068), not
-	* a shape question.
+	* function never mints from a block it could not read. The recipe itself —
+	* the four classes, the service's punctuation set, `IncludeSpace`, and the
+	* `RequireEachIncludedType` guarantee — lives in `generateCharset` (issue
+	* #3068), shared with the predicate so the block it refuses and the block
+	* it mints from cannot disagree.
 	*/
 	generateSecretString(config, options) {
 		const refusal = generateMemberRefusal(config);
@@ -24700,22 +24806,15 @@ var SecretsManagerSecretProvider = class {
 			throw new Error(refusal);
 		}
 		const length = coerceCfnInteger(config["PasswordLength"]) ?? 32;
-		const excludeUppercase = coerceCfnBoolean(config["ExcludeUppercase"]) ?? false;
-		const excludeLowercase = coerceCfnBoolean(config["ExcludeLowercase"]) ?? false;
-		const excludeNumbers = coerceCfnBoolean(config["ExcludeNumbers"]) ?? false;
-		const excludePunctuation = coerceCfnBoolean(config["ExcludePunctuation"]) ?? false;
-		const excludeCharacters = config["ExcludeCharacters"] ?? "";
-		let chars = "";
-		if (!excludeUppercase) chars += "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-		if (!excludeLowercase) chars += "abcdefghijklmnopqrstuvwxyz";
-		if (!excludeNumbers) chars += "0123456789";
-		if (!excludePunctuation) chars += "!@#$%^&*()_+-=[]{}|;:,.<>?";
-		if (excludeCharacters) for (const c of excludeCharacters) chars = chars.replaceAll(c, "");
-		if (chars.length === 0) chars = "abcdefghijklmnopqrstuvwxyz";
-		const bytes = new Uint8Array(length);
-		crypto.getRandomValues(bytes);
-		let password = "";
-		for (let i = 0; i < length; i++) password += chars[bytes[i] % chars.length];
+		const { required, pool } = generateCharset(config);
+		const out = [];
+		for (let i = 0; i < length; i++) out.push(pool[randomIndex(pool.length)]);
+		const positions = Array.from({ length }, (_, i) => i);
+		for (const classChars of required) {
+			const slot = positions.splice(randomIndex(positions.length), 1)[0];
+			out[slot] = classChars[randomIndex(classChars.length)];
+		}
+		const password = out.join("");
 		const generateStringKey = config["GenerateStringKey"];
 		const secretStringTemplate = config["SecretStringTemplate"];
 		if (generateStringKey === void 0 || secretStringTemplate === void 0) return password;
@@ -76659,7 +76758,7 @@ function formatStackRef(ref) {
 * `()` would read as "no region" rather than "a region cdkd will not print".
 */
 function formatStackRefSafe(ref) {
-	return ref.region ? `${safe(ref.stackName)} (${safe(ref.region)})` : safe(ref.stackName);
+	return ref.region ? `${safe$1(ref.stackName)} (${safe$1(ref.region)})` : safe$1(ref.stackName);
 }
 /**
 * One spelling of "this value came from an S3 key or a state record, and is
@@ -76685,7 +76784,7 @@ function formatStackRefSafe(ref) {
 * text (a parser's own message, an AWS error) takes the denylist class
 * instead; `display-safe.ts`'s header draws that line.
 */
-function safe(value) {
+function safe$1(value) {
 	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
 }
 /**
@@ -76696,18 +76795,18 @@ function safe(value) {
 */
 function resolveSingleRegion(stackName, refs, requestedRegion) {
 	const matches = refs.filter((r) => r.stackName === stackName);
-	if (matches.length === 0) throw new Error(`No state found for stack '${safe(stackName)}'. Run 'cdkd state list' to see available stacks.`);
+	if (matches.length === 0) throw new Error(`No state found for stack '${safe$1(stackName)}'. Run 'cdkd state list' to see available stacks.`);
 	if (requestedRegion) {
 		const ref = matches.find((r) => r.region === requestedRegion);
 		if (!ref) {
-			const seen = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
-			throw new Error(`No state found for stack '${safe(stackName)}' in region '${safe(requestedRegion)}'. Available regions: ${seen.join(", ")}.`);
+			const seen = matches.map((r) => r.region === void 0 ? "(legacy)" : safe$1(r.region));
+			throw new Error(`No state found for stack '${safe$1(stackName)}' in region '${safe$1(requestedRegion)}'. Available regions: ${seen.join(", ")}.`);
 		}
 		return ref;
 	}
 	if (matches.length === 1) return matches[0];
-	const regions = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
-	throw new Error(`Stack '${safe(stackName)}' has state in multiple regions: ${regions.join(", ")}. Re-run with --stack-region <region> to disambiguate.`);
+	const regions = matches.map((r) => r.region === void 0 ? "(legacy)" : safe$1(r.region));
+	throw new Error(`Stack '${safe$1(stackName)}' has state in multiple regions: ${regions.join(", ")}. Re-run with --stack-region <region> to disambiguate.`);
 }
 /**
 * Shared bootstrap for every `state` subcommand: build the AWS clients,
@@ -76928,9 +77027,9 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
-		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		const resources = stateResult.state.resources ?? {};
 		const details = Object.entries(resources).map(([logicalId, entry]) => {
 			const resource = entry ?? {};
@@ -77025,14 +77124,6 @@ function formatAttributeValue(value) {
 	return json === void 0 ? UNSERIALIZABLE : stripControlChars(json);
 }
 /**
-* Render a duration in milliseconds as `1m23s` / `45s`.
-*/
-function formatDuration(ms) {
-	const seconds = Math.floor(ms / 1e3);
-	if (seconds < 60) return `${seconds}s`;
-	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
-}
-/**
 * Render a whole `Dependencies` row from a list that is an unchecked cast.
 *
 * It owns the `(none)` case as well as the values, so that no caller touches
@@ -77089,17 +77180,19 @@ function formatLastModified(value) {
 * falls back to `Object.prototype.toString` (go-to-k/cdkd#2947).
 *
 * `expiresAt` is declared a number and is not guaranteed to be one, but it
-* reaches the row only through subtraction and `formatDuration`, so no character
-* the record carries can survive into the output either. One that cannot be
-* coerced arrives as `NaN` (`getLockRecord`), so the row reads as expired
-* rather than the read throwing.
+* reaches the row only through `formatLockExpiry`, which tests the raw value
+* with `Number.isFinite` and renders a fixed phrase or a duration, so no
+* character the record carries can survive into the output either. A
+* non-finite value — absent, `{}`, `"soon"`, or the `NaN` that `getLockRecord`
+* substitutes for a coercion that throws (go-to-k/cdkd#2947) — reads as an
+* unknown deadline rather than `expired NaNmNaNs ago` (issue #3083); the
+* helper is shared with the contention refusal and `LockManager` (issue
+* #3085) so the row cannot drift from them.
 */
 function formatLockSummary(lockInfo) {
 	if (!lockInfo) return "unlocked";
 	const opStr = lockInfo.operation ? ` (operation: ${lockInfo.operation})` : "";
-	const expiresInMs = lockInfo.expiresAt - Date.now();
-	const expiresStr = expiresInMs > 0 ? `expires in ${formatDuration(expiresInMs)}` : `expired ${formatDuration(-expiresInMs)} ago`;
-	return `locked by ${lockInfo.owner}${opStr}, ${expiresStr}`;
+	return `locked by ${lockInfo.owner}${opStr}, ${formatLockExpiry(lockInfo.expiresAt)}`;
 }
 /**
 * Create the `state resources` subcommand.
@@ -77139,9 +77232,9 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
-		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
@@ -78306,6 +78399,35 @@ function snapshotNote(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
 	return "DeletionPolicy Snapshot — final snapshot, then delete";
 }
 /**
+* One spelling of "this value came from an S3 key or a rollback-journal record,
+* and is about to be interpolated into a message a terminal will render"
+* (issue #3064).
+*
+* `rollback-journal.json` is a sibling of `state.json` in the same bucket, so
+* anyone with `s3:PutObject` writes it, and cdkd's output is line-oriented --
+* an injected newline invents a line that reads like a real one. Here that is
+* worse than a forged diagnostic: the plan preview below is what the user
+* CONFIRMS against, so a planted journal could forge the plan rows themselves.
+*
+* The ASCII allowlist, because every value it guards has a known charset: a
+* logical id, a CFn resource type, a change type, a run id, a segment reason,
+* a stack name, an AWS region. Call it for those; `grep safe(` answers the
+* scope and this comment does not.
+*
+* NOT for a value that is about to be USED rather than shown -- the preview
+* indexes `previewState` by the RAW `op.logicalId`, and sanitising a lookup
+* key silently mismatches the record it is meant to find.
+*
+* NOT for free-form error text either. An SDK or provider message legitimately
+* carries non-ASCII (a resource name, AWS's own wording), so a site that renders
+* one calls `displaySafe()` directly and takes the DENYLIST -- the same class
+* `formatError` picks for a `cause`, and for the same reason. `grep displaySafe(`
+* answers how many; a count written here was wrong on its first revision.
+*/
+function safe(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -78315,17 +78437,17 @@ function actionLabel(item, skipFinalSnapshot) {
 	const { op, action, replacement } = item;
 	const rep = replacement ? " [replacement occurred, best-effort revert]" : "";
 	switch (action) {
-		case "delete": return `  - delete   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "delete-with-final-snapshot": return `  - delete   ${op.logicalId} (${op.resourceType}) [${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
-		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain — left in AWS]`;
-		case "orphan-flag": return `  - orphan   ${op.logicalId} (${op.resourceType}) [--orphan]`;
-		case "revert": return `  - revert   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
-		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [delete new, re-adopt retained old resource]`;
-		case "unrecoverable-delete": return `  - (cannot restore) ${op.logicalId} (${op.resourceType}) — was DELETED, unrecoverable`;
-		case "skip-mismatch": return `  - skip     ${op.logicalId} (${op.resourceType}) — physical id changed, needs manual attention`;
-		case "skip-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no longer in state`;
-		case "skip-already-done": return `  - skip     ${op.logicalId} (${op.resourceType}) — already reverted`;
+		case "delete": return `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
+		case "delete-with-final-snapshot": return `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
+		case "orphan-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [DeletionPolicy Retain — left in AWS]`;
+		case "orphan-flag": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [--orphan]`;
+		case "revert": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
+		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource, delete new]`;
+		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [delete new, re-adopt retained old resource]`;
+		case "unrecoverable-delete": return `  - (cannot restore) ${safe(op.logicalId)} (${safe(op.resourceType)}) — was DELETED, unrecoverable`;
+		case "skip-mismatch": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — physical id changed, needs manual attention`;
+		case "skip-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no longer in state`;
+		case "skip-already-done": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — already reverted`;
 	}
 }
 /**
@@ -78337,13 +78459,13 @@ function actionLabel(item, skipFinalSnapshot) {
 function failedActionLabel(item, skipFinalSnapshot) {
 	const { op, action } = item;
 	switch (action) {
-		case "revert-failed-update": return `  - revert   ${op.logicalId} (${op.resourceType}) [FAILED update — remote state unknown, force-applying previous properties]`;
-		case "delete-failed-create": return `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create]`;
-		case "delete-failed-create-with-final-snapshot": return `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, ${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
-		case "orphan-failed-create-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
-		case "skip-failed-unknown": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed CREATE recorded no physical id`;
-		case "skip-failed-noop": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed ${op.changeType} left nothing to revert`;
-		case "skip-failed-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no previous state available`;
+		case "revert-failed-update": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED update — remote state unknown, force-applying previous properties]`;
+		case "delete-failed-create": return `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create]`;
+		case "delete-failed-create-with-final-snapshot": return `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create, ${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
+		case "orphan-failed-create-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
+		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
+		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
+		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
 	}
 }
 /**
@@ -78384,7 +78506,7 @@ async function rollbackCommand(stackArg, options) {
 				return;
 			}
 			if (scoped.length > 1) {
-				const list = scoped.map((c) => `  - ${c.stackName} (${c.region})`).join("\n");
+				const list = scoped.map((c) => `  - ${safe(c.stackName)} (${safe(c.region)})`).join("\n");
 				throw new Error(`Multiple stacks have a rollback journal. Pick one:\n${list}\nRe-run 'cdkd rollback <stack>' (add --stack-region if the same name spans regions).`);
 			}
 			ref = scoped[0];
@@ -78417,25 +78539,25 @@ async function rollbackCommand(stackArg, options) {
 		try {
 			const stateData = await setup.stateBackend.getState(stackName, region);
 			const journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
-			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${stackName}' (${region}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
-			if (!stateData) throw new Error(`Rollback journal exists for '${stackName}' (${region}) but its state.json is missing (keys: ${setup.prefix}/${stackName}/${region}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
+			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safe(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+			if (!stateData) throw new Error(`Rollback journal exists for '${safe(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(`${setup.prefix}/${stackName}/${region}`)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
 			const newestSegment = journal.segments[journal.segments.length - 1];
-			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${newestSegment.roleArn}; this rollback is running with ambient credentials (pass --role-arn to match).`);
-			logger.info(`\nRollback plan for '${stackName}' (${region}):`);
+			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safe(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
+			logger.info(`\nRollback plan for '${safe(stackName)}' (${safe(region)}):`);
 			const planStateView = { ...stateResources };
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
 				const segment = journal.segments[s];
-				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${segment.reason}${segment.runId ? `, run ${segment.runId}` : ""}):`);
+				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${safe(segment.reason)}${segment.runId ? `, run ${safe(segment.runId)}` : ""}):`);
 				if (segment.failedOperations && segment.failedOperations.length > 0) {
 					if (options.revertFailed) {
 						const failedPlan = planFailedOps(segment.failedOperations, planStateView);
 						for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
 						applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
-					} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+					} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${safe(fop.logicalId)} (${safe(fop.resourceType)}) — its ${safe(fop.changeType)} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 				}
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
 				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
@@ -78443,7 +78565,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			logger.info("");
 			if (!skipConfirmation) {
-				if (!await confirm(`Roll back '${stackName}' (${region})?`)) {
+				if (!await confirm(`Roll back '${safe(stackName)}' (${safe(region)})?`)) {
 					logger.info("Rollback cancelled");
 					return;
 				}
@@ -78481,7 +78603,7 @@ async function rollbackCommand(stackArg, options) {
 						const fresh = await setup.stateBackend.getState(stackName, region);
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
-						logger.warn(`Failed to persist state after a rollback operation: ${retryError instanceof Error ? retryError.message : String(retryError)}. The resource was reverted in AWS; re-run 'cdkd rollback ${stackName}' to reconcile state.`);
+						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run 'cdkd rollback ${safe(stackName)}' to reconcile state.`);
 					}
 				}
 			};
@@ -78524,7 +78646,7 @@ async function rollbackCommand(stackArg, options) {
 								if (remaining.length === 0) delete segment.failedOperations;
 								else segment.failedOperations = remaining;
 							} catch (stripError) {
-								logger.warn(`Failed to strip replayed failed-ops from the journal: ${stripError instanceof Error ? stripError.message : String(stripError)}`);
+								logger.warn(`Failed to strip replayed failed-ops from the journal: ${displaySafe(stripError instanceof Error ? stripError.message : String(stripError))}`);
 							}
 							if (failedResult.interrupted) return {
 								failures: failedOpFailures,
@@ -78560,16 +78682,16 @@ async function rollbackCommand(stackArg, options) {
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
-				logger.info(`State for '${stackName}' (${region}) removed (stack fully rolled back).`);
+				logger.info(`State for '${safe(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
-			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${stackName}' to finish.`);
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${stackName}' to retry.`);
+			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${safe(stackName)}' to finish.`);
+			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${safe(stackName)}' to retry.`);
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
-			logger.info(`\nRollback of '${stackName}' (${region}) complete.`);
+			logger.info(`\nRollback of '${safe(stackName)}' (${safe(region)}) complete.`);
 		} finally {
 			try {
 				await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-					logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
+					logger.warn(`Failed to release lock for '${safe(stackName)}' (${safe(region)}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 				});
 			} finally {
 				process.removeListener("SIGINT", sigintHandler);
@@ -91942,4 +92064,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-B3I46yaG.js.map
+//# sourceMappingURL=program-BJxsQ7qM.js.map