@go-to-k/cdkd 0.290.12 → 0.290.14

package/dist/{deploy-engine-e6ZxOr56.js → deploy-engine-v7h1H_Ac.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CEPJTaHl.js";
+import { t as getCdkdVersion } from "./version-CqnAWzcc.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -804,6 +804,96 @@ function isNameCollisionError(message) {
 	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
 }
 /**
+* SDK exception NAMES that mean, on their own, "a resource with this NAME
+* already exists" — nothing else (issue
+* [#3208](https://github.com/go-to-k/cdkd/issues/3208)).
+*
+* This list is the NARROW exception to the paragraph above, not a reversal of
+* it. That paragraph refuses name-based classification because a name like
+* `ResourceConflictException` is AMBIGUOUS — Lambda raises it for a function in
+* a PENDING state too, so crediting it would delete a live function under
+* `--replace`. Every name here is the opposite: the service declares it for the
+* duplicate-name condition and for nothing else, so there is no second reading
+* to be wrong about. A name may join this list only on that test.
+*
+* It exists because ELBv2 states the condition in prose that the message
+* matcher above cannot see, and must not be widened to see. MEASURED against
+* the real API (us-east-1, 2026-09-16, `@aws-sdk/client-elastic-load-balancing-v2`
+* 3.1126.0), creating a second target group under a live name:
+*
+*   name    = 'DuplicateTargetGroupNameException'
+*   message = "A target group with the same name 'x' exists, but with
+*              different settings"
+*   cause   = none
+*
+* The message carries no code and never says "already exists", so
+* `isNameCollisionError` misses it — and the consequence is not cosmetic: the
+* `--replace` delete-first fallback and the rollback executor's
+* delete-new-first arm both gate on that predicate, so BOTH recovery paths went
+* inert and a create-only change to a cdkd-named target group could not be
+* deployed at all. Widening the prose matcher to a bare `exists` was rejected:
+* it is substring-matched against every service's text, and the direction of a
+* false positive here is a DELETE.
+*
+* The SET is complete rather than illustrative: `Duplicate*NameException` over
+* every installed `@aws-sdk/client-*` model yields exactly these three, all
+* ELBv2. Two ELBv2 siblings are deliberately EXCLUDED, and the reasons are the
+* membership test in action — `DuplicateListenerException` reports a listener
+* already bound to that PORT, which is not a name, and
+* `DuplicateTagKeysException` reports repeated keys WITHIN one request, which
+* is not an existence condition at all. Crediting either would hand a
+* destructive path a collision that no delete can clear.
+*/
+const NAME_COLLISION_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"DuplicateTargetGroupNameException",
+	"DuplicateLoadBalancerNameException",
+	"DuplicateTrustStoreNameException"
+]);
+/**
+* {@link isNameCollisionError}, but reading the ERROR rather than a rendered
+* message — which is the only way to see an exception NAME (issue #3208).
+*
+* Providers wrap an AWS failure as `Failed to create X: ${err.message}`, so the
+* name is dropped before any caller could match it. This walks the bounded
+* `cause` chain (the same {@link MAX_CAUSE_CHAIN_DEPTH} as every other
+* classifier in this file), checking each link's `name` against
+* {@link NAME_COLLISION_ERROR_NAMES} and each link's `message` through
+* {@link isNameCollisionError}. A provider is required to thread the caught
+* value as `cause` (`scripts/check-provider-error-cause.ts` enforces it across
+* `src/provisioning/providers/**`), which is what makes the walk reach the SDK
+* error at all.
+*
+* Prefer this at any site holding the error object. The string form stays for
+* callers that genuinely have only text, and its behaviour is unchanged — this
+* is strictly additive, so nothing that matched before stops matching.
+*/
+/**
+* `String(value)` that cannot itself throw — a thrown `Object.create(null)` has
+* no `toString`. Preserves the call sites' pre-#3208 `String(createError)` arm
+* for a non-`Error` throw, which reading `.message` alone would have dropped.
+*/
+function stringifyForMatch(value) {
+	try {
+		return String(value);
+	} catch {
+		return "";
+	}
+}
+function isNameCollisionErrorFrom(error, logicalId) {
+	if (typeof error === "string") return isNameCollisionError(error);
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		const link = current;
+		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
+		if (typeof link.name === "string" && NAME_COLLISION_ERROR_NAMES.has(link.name)) return true;
+		if (depth === 0) {
+			if (isNameCollisionError(error instanceof Error && typeof link.message === "string" ? link.message : stringifyForMatch(error))) return true;
+		}
+		current = link.cause;
+	}
+	return false;
+}
+/**
 * Match a same-name re-creation cooldown — an AWS service still holding a
 * resource's name while its asynchronous delete finishes. Every recognised
 * spelling lives in {@link NAME_COOLDOWN_ERROR_MESSAGE_PATTERNS}; add new ones
@@ -9133,6 +9223,53 @@ function shouldRetainResource(deletionPolicy) {
 	return deletionPolicy === "Retain" || deletionPolicy === "RetainExceptOnCreate";
 }
 /**
+* Can this container be read as the record map its type claims it is?
+*
+* THE single plain-object test behind every malformed-bag guard in the repo.
+* `parseStateBody` validates the root object and the schema version and
+* nothing inside, so a hand-edited or truncated record reaches a consumer with
+* `resources` / `outputs` / `attributes` / `properties` holding a string, a
+* list, a number or `null`. `Object.entries` walks a string or a list as
+* readily as a map, so either FABRICATES entries. `in` and `Object.hasOwn`
+* behave differently per shape and neither is a guard: `in` THROWS on a
+* string, a number and `null`, but ANSWERS on a list (`0 in [1,2]` and
+* `'length' in [1,2]` are both `true`), while `Object.hasOwn` ANSWERS on a
+* string and a list alike (`Object.hasOwn('abcdef', '0')` is `true`) and
+* throws ONLY on `null` / `undefined` — the one pair a `?? {}` upstream has
+* usually already absorbed, which is what makes it look like a guard. Do not
+* read a nearby `in` as already catching the list case. Widened past
+* `null` / `undefined` for
+* exactly that reason: `[]`, `5` and `"ab"` all survive `Object.entries` and
+* yield a bag that is empty or, for the string, absurd.
+*
+* WHY IT LIVES HERE rather than beside the guards that grew out of it. Its
+* first home was `src/state/malformed-resources-bag.ts`, which still re-exports
+* it so no importer moved; it came down to this module when
+* {@link importableOutputKeys} needed it (go-to-k/cdkd#3192). That helper sits
+* in `src/types/**`, the layer every other one imports and which imports
+* nothing itself, so the alternative — `src/types/state.ts` importing from
+* `src/state/**` — inverts the layering AND pulls that module's
+* `error-handler` / `display-safe` / `lock-contention-message` chain into the
+* one module the whole codebase depends on. Same move, same reason, as
+* `DEFAULT_STATE_PREFIX` in `src/state/state-prefix.ts`: home the leaf in the
+* layer that needs it, re-export from where it was.
+*
+* Spelling this test a second time at any call site is what the single export
+* exists to prevent: the copies could then drift, and the one that drifted
+* would fabricate again while looking guarded. Enumerate the consumers with
+* `grep -rn "isReadableBag" src/` rather than from a list here — three
+* successive enumerations of them, written by reasoning, came out incomplete.
+*
+* What it does NOT decide is whether a given container is malformed. That is a
+* per-container call, because ABSENCE means different things: an absent
+* `resources` bag is a defect, while an absent `outputs` bag is an ordinary
+* record `cdkd scrub` round-trips on purpose. Each caller pairs this predicate
+* with its own absence rule.
+*/
+function isReadableBag(container) {
+	return typeof container === "object" && container !== null && !Array.isArray(container);
+}
+/**
 * The keys of `state.outputs` an `Fn::ImportValue` may bind to (issue
 * [#2193](https://github.com/go-to-k/cdkd/issues/2193)) — THE predicate
 * behind "what does this stack export". Four readers used to answer that
@@ -9150,15 +9287,79 @@ function shouldRetainResource(deletionPolicy) {
 *
 * `outputs` is typed required but every consumer treats it as optional (a
 * state file may simply have none), so it is read defensively here too.
+*
+* ## Two FAIL-CLOSED arms for a malformed record (go-to-k/cdkd#3192)
+*
+* Both answer `[]` — "this record exports nothing" — and neither repairs the
+* record or throws. The reasoning is the same for both and is a property of
+* WHERE this function sits: it is a pure predicate with no stack name, no
+* region and no writer of its own, reached from the exports-index rebuild, the
+* deploy-time resolver's state scan, `cdkd diff`'s no-change merge and the
+* local-command loader. Throwing here would be the bare `TypeError`
+* go-to-k/cdkd#3018 set out to remove, renamed; and refusing the whole
+* operation over ONE foreign record would take every OTHER stack's
+* `Fn::ImportValue` down with it. Publishing nothing from a record whose
+* export set cannot be read is the only answer that fabricates nothing and
+* destroys nothing — the damaged record is left exactly as it is, for the
+* write-capable commands (`cdkd orphan` / `import` / `scrub`) to REFUSE by
+* name.
+*
+* 1. `outputs` is not a readable bag. `Object.keys('abcdef')` is
+*    `['0'...'5']`, so the pre-fix code published one fabricated export per
+*    CHARACTER into `cdkd/_index/<region>/exports.json` — the shared index
+*    every consumer's `Fn::ImportValue` binds against. {@link isReadableBag}
+*    is the test, so an ABSENT bag keeps answering `[]` exactly as the old
+*    `?? {}` did; no verdict moves on a healthy or an absent record.
+* 2. `exportNames` is present but not an array. `state.exportNames.filter(...)`
+*    threw `TypeError: state.exportNames.filter is not a function` on a
+*    hand-edited non-array or `null`, from `cdkd diff` among others. Falling
+*    back to the `undefined` arm instead would be fail-OPEN in the one
+*    direction #2193 exists to close — every plain Output name published as an
+*    export — so a corrupt set is read as an EMPTY set, not as an unknown one.
+*    A non-string element is dropped for the same reason: `Object.hasOwn` does
+*    not throw on one, it COERCES, so `exportNames: [0]` would otherwise
+*    publish the bag's `"0"` key. The filter is the identity on every healthy
+*    `string[]`.
 */
 function importableOutputKeys(state) {
-	const outputs = state.outputs ?? {};
+	if (!hasReadableExportSet(state)) return [];
+	const outputs = state.outputs;
 	if (state.exportNames === void 0) return Object.keys(outputs);
-	return state.exportNames.filter((name) => Object.hasOwn(outputs, name));
+	return state.exportNames.filter((name) => typeof name === "string" && Object.hasOwn(outputs, name));
+}
+/**
+* Whether {@link importableOutputKeys} can answer from this record at all —
+* the two fail-closed arms of its own doc, as ONE predicate a caller can ask
+* (issue go-to-k/cdkd#3192).
+*
+* It exists because `[]` is a real answer: a stack that exports nothing and a
+* record whose export set could not be read produce the identical empty list,
+* and a caller that must SAY which one it got cannot re-derive the difference
+* from the list. `ExportIndexStore`'s rebuild is that caller — a silent
+* fail-closed there would leave the next `Fn::ImportValue` miss naming the
+* consumer rather than the damaged producer record.
+*
+* ONE spelling shared with {@link importableOutputKeys}, which calls this
+* rather than repeating the two tests: a second copy could drift, and the copy
+* that drifted would report a record readable while the key list stayed empty,
+* or the reverse.
+*
+* `outputs` absent answers FALSE here, unlike
+* `malformed-resources-bag.ts`'s `hasReadableOutputs`, and the difference is
+* the QUESTION rather than a disagreement: that one asks "is this record
+* damaged" (an absent bag is an ordinary record), this one asks "can an export
+* set be read off it" (it cannot). A caller that must tell absent from damaged
+* tests for absence first, as the exports-index rebuild does.
+*/
+function hasReadableExportSet(state) {
+	if (!isReadableBag(state.outputs)) return false;
+	if (state.exportNames === void 0) return true;
+	if (!Array.isArray(state.exportNames)) return false;
+	return state.exportNames.length === 0 || state.exportNames.some((n) => typeof n === "string");
 }
 /** `state.outputs` narrowed to its {@link importableOutputKeys}. */
 function importableOutputs(state) {
-	const outputs = state.outputs ?? {};
+	const outputs = isReadableBag(state.outputs) ? state.outputs : {};
 	const picked = Object.create(null);
 	for (const name of importableOutputKeys(state)) picked[name] = outputs[name];
 	return picked;
@@ -24506,6 +24707,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* one.
 	*/
 	producerRegionGuest = false;
+	/**
+	* How a producer-region guest PRINTS its own `explicitRegion` (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)): the masked log text
+	* its creator held for that region, which a template can assemble around a
+	* short secret, or `***` once a later spelling of the same region masks
+	* differently. Display only; `undefined` on an ordinary resolver, whose
+	* region its command built (the stack's synthesized or recorded region,
+	* `--region`, or a region read out of a literal token).
+	*/
+	explicitRegionLogText;
 	strictGetAtt;
 	cfnFallback;
 	/**
@@ -24757,18 +24968,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* uppercase spelling would build a second client for the same physical
 	* region — benign, but wasteful and confusing in a debug log.
 	*/
-	clientsForRegion(targetRegion) {
+	clientsForRegion(targetRegion, targetLogText) {
 		const ambient = getAwsClients();
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
-		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(target).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
+		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
+		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
 		this.regionScopedClients.set(target, scoped);
-		this.logger.debug(`Using region-scoped AWS clients for ${target}`);
+		this.logger.debug(`Using region-scoped AWS clients for ${loggedTarget}`);
 		return scoped;
 	}
 	/**
@@ -25358,7 +25570,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.logTextOfLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -25376,8 +25588,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
-			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.maskSecretsForLog(this.outputNameLogText(k, context), context));
+			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.maskSecretsForLog(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
 		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
@@ -26664,7 +26877,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the producer's rather than the caller's — which is exactly what issue #2057
 	* says the other two copies get wrong.
 	*/
-	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput) {
+	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
 		if (carriesSecretMask(value)) {
 			const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
 			if (recovered !== void 0) {
@@ -26680,7 +26893,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (!carriesDynamicReference(value)) return value;
-		const resolver = this.resolverForProducerRegion(producerRegion);
+		const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 		const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
 		const walk = async (v) => {
 			if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, pinnedContext) : v;
@@ -26761,19 +26974,25 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secret) recordedSecretExpressions.add(expression);
 		else recordedSecretExpressions.delete(expression);
 	}
-	resolverForProducerRegion(producerRegion) {
+	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
 		if (target === canonicalizeRegion(this.explicitRegion)) return this;
+		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
+		const guestRegionText = this.maskThenStripThenMask(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
-		if (cached) return cached;
+		if (cached) {
+			if (cached.explicitRegionLogText !== guestRegionText) cached.explicitRegionLogText = "***";
+			return cached;
+		}
 		const scoped = new IntrinsicFunctionResolver(target, {
 			strictGetAtt: this.strictGetAtt,
 			cfnFallback: this.cfnFallback
 		});
 		scoped.producerRegionGuest = true;
+		scoped.explicitRegionLogText = guestRegionText;
 		this.producerRegionResolvers.set(target, scoped);
-		this.logger.debug(`Using a producer-region resolver for ${target}`);
+		this.logger.debug(`Using a producer-region resolver for ${guestRegionText}`);
 		return scoped;
 	}
 	/**
@@ -26798,8 +27017,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${this.maskSecretsForLog(entry.producerRegion, context)}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(entry.producerStack, context)} / ${this.logTextOfLeaf(entry.producerRegion, context)})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
 					outputKey: exportName
@@ -26823,13 +27042,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${lookupRegion})`);
+					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${this.maskSecretsForLog(lookupRegion, context)})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${this.maskSecretsForLog(lookupRegion, context)}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
@@ -26850,7 +27069,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey, {
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(found.refStack, context)} / ${this.logTextOfLeaf(found.lookupRegion, context)})`, sourceKey, {
 			stackName: found.refStack,
 			region: found.lookupRegion,
 			outputKey: exportName
@@ -26915,9 +27134,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `OutputName` is the overwhelmingly common cause, and the list is what makes
 	* the error actionable.
 	*
-	* Residual, stated rather than hidden: the needles belong to the CONSUMER's
-	* resolution, so a plaintext sitting in a PRODUCER key that this consumer
-	* never resolved is not maskable from here. The cap is what bounds that case;
+	* `maskSecretsForLog` reads the consumer pass's log twin first (issue #3150),
+	* so a key equal to a name this pass assembled around a short secret is
+	* masked. Residual, stated rather than hidden: the needles and twins belong to the
+	* CONSUMER's resolution, so a plaintext sitting in a PRODUCER key that this
+	* consumer never resolved is not maskable from here. The cap is what bounds that case;
 	* `cdkd scrub` reporting the producer's own `secretBearingKeys` is the remedy.
 	*/
 	describeAvailableOutputs(keys, context) {
@@ -26949,7 +27170,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* logged for non-not-found failures). Same graceful-degradation
 	* contract as {@link lookupCfnExport}.
 	*/
-	async lookupCfnStackOutputs(stackName, region, context) {
+	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
 		const cacheKey = `${region}\0${stackName}`;
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
@@ -26963,7 +27184,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(region, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(loggedRegionText, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -27068,12 +27289,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const outputName = await this.resolveValue(args["OutputName"], context);
 		if (typeof outputName !== "string" || outputName === "") throw new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`);
 		let region = this.resolverRegion;
+		let loggedRegionText = this.logTextOfLeaf(region, context);
 		if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
+			loggedRegionText = this.regionLogText(resolvedRegion, context);
 		}
 		let roleArn;
 		if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
@@ -27081,15 +27304,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(region, context)}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(loggedRegionText, context)}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		const loggedRegion = this.maskSecretsForLog(region, context);
+		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
-				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context);
+				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context, loggedRegionText);
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
@@ -27111,12 +27334,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
 		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${this.logTextOfLeaf(outputName, context)}' (producer ${this.logTextOfLeaf(stackName, context)} / ${loggedRegionText})`, sourceKey, {
 			stackName,
 			region,
 			outputKey: outputName,
 			...roleArn ? { crossAccount: true } : {}
-		});
+		}, loggedRegionText);
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -27254,7 +27477,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
 		const inputLogText = this.logTextOfLeaf(resolvedValue, context);
-		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskSecretsForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
+		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskNeedlesForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
 		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(inputLogText, context)} -> ${this.maskSecretsForLog(inputLogText !== resolvedValue ? "***" : result, context)}`);
 		return result;
 	}
@@ -27284,21 +27507,23 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		* given explicitly (see {@link explicitRegion}).
 		*/
 		let clientRegion;
+		let loggedRegionText;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
+			loggedRegionText = this.regionLogText(resolvedValue, context);
 		} else {
 			region = (await getAccountInfo(this.resolverRegion)).region;
 			clientRegion = this.explicitRegion;
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
-		const ec2Client = this.clientsForRegion(clientRegion).ec2;
+		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.maskSecretsForLog(loggedRegionText, context)).ec2;
 		let azNames;
 		try {
 			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
@@ -27309,11 +27534,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -27350,8 +27575,37 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Mask any resolved secret value out of a string bound for a log line, using
 	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
 	* recorded no secrets.
+	*
+	* A value with a registered LOG TWIN prints as its twin first (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The needle mask
+	* matches a secret under {@link MIN_NEEDLE_LENGTH} only as the whole text,
+	* so a name an `Fn::Sub` assembled around a 1-3 character secret (a map key,
+	* a stack or output name, an attribute name, the secret id of a dynamic
+	* reference) printed in the clear at every site that handed its RAW value
+	* here, although the pass had registered where the secret sits. Looking the
+	* twin up HERE, rather than at each such site, is what makes the class
+	* closed for raw values: every one of those sites already calls this method.
+	* The twin prints as it is: it is the raw text with masked spans, so it
+	* holds no recorded needle the raw text lacks. When the needle mask ALSO
+	* changes the raw text the whole text is masked instead, the rule
+	* `logTwinText` applies to a Join / Sub line, since the two masks' spans
+	* cannot be merged. What this cannot see is a value TRANSFORMED before it
+	* arrives (a lowercased region, a sliced output name, an assembled
+	* sentence); those sites derive their text from the twin themselves.
 	*/
 	maskSecretsForLog(text, context) {
+		const registered = this.registeredLogTwin(text, context);
+		if (registered === void 0) return this.maskNeedlesForLog(text, context);
+		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
+	}
+	/**
+	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
+	* lookup. For the two DETECTORS that must ask the needle mask apart from the
+	* position mask: `logTwinText`, which asks it of a value that already has a
+	* twin, and `resolveBase64`, whose other operand is the position mask. A
+	* message masks through `maskSecretsForLog`.
+	*/
+	maskNeedlesForLog(text, context) {
 		let masked = text;
 		const inherited = context?.inheritedSecrets;
 		if (inherited && inherited.size > 0) masked = maskSecretsInText(masked, inherited);
@@ -27381,7 +27635,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* resolver's mask-coverage checker sees a masker at the site.
 	*/
 	logTwinText(result, twin, context) {
-		return twin !== result && this.maskSecretsForLog(result, context) !== result ? "***" : twin;
+		return twin !== result && this.maskNeedlesForLog(result, context) !== result ? "***" : twin;
 	}
 	/**
 	* The log twins of `Fn::Split`'s pieces (issue #3100), each registered for
@@ -27429,16 +27683,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the leaf treated as a resolution product — masked whole when it is a
 	* recorded secret, otherwise the masked twin this pass registered for it —
 	* and then `logTwinText`'s whole-line guard. The caller still wraps the
-	* result in `maskSecretsForLog`. Shared by every caller of `maskValueLeaves`
-	* (the `Fn::Select`, `Fn::Split`, `Fn::Equals`, `Fn::FindInMap`,
-	* `Fn::GetAZs` and `Fn::Cidr` lines and the VPC `Ipv6CidrBlocks` line among
-	* them) and by the `Fn::Base64` line, so a string one
-	* write already masked by position is not printed in the clear by the next
-	* intrinsic that logs it. `maskValueLeaves` also masks values interpolated
-	* into THROWN messages (the `Fn::Cidr` argument refusals, for one), so those
-	* messages take the same position mask: a short secret an earlier write put
-	* into the value is `***` there too, the direction the mask at the throw
-	* already takes for a whole secret.
+	* result in `maskSecretsForLog`. Used where the text is needed BEFORE that
+	* masker, or apart from it: the `Fn::Base64` line and its detector, and the
+	* names issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)
+	* transforms or composes before printing (`regionLogText`,
+	* `outputNameLogText`, the invalid-region refusals, the cross-stack `origin`
+	* strings). A leaf printed as it is needs none of it: `maskSecretsForLog`
+	* looks the twin up itself, which is how `maskValueLeaves` gives its lines
+	* and the THROWN messages it masks (the `Fn::Cidr` argument refusals, for
+	* one) the same position mask.
 	*/
 	logTextOfLeaf(value, context) {
 		return this.logTwinText(value, this.logTwinOfProduct({
@@ -27446,6 +27699,85 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			twin: value
 		}, context).twin, context);
 	}
+	/**
+	* The log text of a nested stack's OUTPUT name, the part of `attributeName`
+	* after `Outputs.` (issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)).
+	* The twin registry is keyed by the exact string, so the suffix has no twin
+	* of its own: it is sliced from the twin of the WHOLE attribute name. A twin
+	* that no longer starts with the literal prefix has a mask over part of it
+	* (a secret was written into the prefix), so the slice offset no longer
+	* lines up and the suffix prints as `***`.
+	*/
+	outputNameLogText(attributeName, context) {
+		const twin = this.logTextOfLeaf(attributeName, context);
+		return twin.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) ? twin.slice(8) : "***";
+	}
+	/**
+	* The log text of a template-supplied REGION as the resolver uses it, i.e.
+	* after `canonicalizeRegion` (issue #3150). The twin is taken from the RAW
+	* value, the string a write registered, and lowercased the same way: a
+	* lookup of the canonical form finds no twin once the raw value had an
+	* upper-case part, and lowercasing leaves every `***` span where it was.
+	*/
+	regionLogText(rawRegion, context) {
+		const canonical = canonicalizeRegion(rawRegion);
+		const text = canonicalizeRegion(this.logTextOfLeaf(rawRegion, context));
+		return text !== canonical && this.maskNeedlesForLog(canonical, context) !== canonical ? "***" : text;
+	}
+	/**
+	* The log text of a name or token whose `twin` masks spans of `raw` (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The twin prints
+	* unless the needle mask ALSO changes `raw`; then the two must agree. When
+	* the needle-masked `raw` IS the twin, both masked the same spans and the
+	* twin is safe (`/probe/***` for a 4+ character secret the name holds
+	* whole). When they differ, a recorded secret straddles a masked span
+	* (`q7ab` across `id-***ab`), no text can honour both, and the name prints
+	* as `***`. Coarser `logTwinText` gives up whenever both masks fire.
+	*/
+	straddleSafeTwin(raw, twin, context) {
+		if (twin === raw) return twin;
+		const needled = this.maskNeedlesForLog(raw, context);
+		if (needled === raw) return twin;
+		return needled === twin ? twin : "***";
+	}
+	/**
+	* The log text of a name parsed out of a dynamic-reference token (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). `resolveSub` /
+	* `resolveJoin` re-enter the dynamic-reference loop with the ASSEMBLED string
+	* and its twin, so a secret id, JSON key, version stage or id, SSM parameter
+	* name, service or ARN region assembled around a short secret has its masked
+	* spelling in `tokenTwin` only. Every such name is a run of the token's
+	* `:`-separated pieces, so its log text is the twin's run over the same
+	* pieces. Nothing is registered: the pass's log-twin registry also decides
+	* what `Fn::Base64` persists, so the mapping lives in the returned function.
+	*
+	* `tokenTwin` is the twin's own `{{resolve:...}}` token paired with this one.
+	* Each run's text goes through `straddleSafeTwin`, so a name whose needle
+	* mask disagrees with its twin prints as `***`. A name whose runs carry different
+	* twins, or a token whose pieces do not pair with the twin's (a mask
+	* covering a `:`), prints as `***` too.
+	*
+	* A name that is no run of the token is a default the caller synthesized
+	* (`AWSCURRENT` for an empty version stage, `''` for an absent version id),
+	* printed as it is. Should the token spell such a non-empty name inside a longer
+	* piece, it prints as `***`: the run rule says nothing about that text.
+	*/
+	dynamicReferenceNameLogText(inner, tokenTwin, context) {
+		const twinPieces = tokenTwin.slice(10, -2).split(":");
+		const pieces = inner.split(":");
+		if (twinPieces.length !== pieces.length) return () => "***";
+		return (name) => {
+			let text;
+			for (let start = 0; start < pieces.length; start++) for (let end = start + 1; end <= pieces.length; end++) {
+				if (pieces.slice(start, end).join(":") !== name) continue;
+				const twin = this.straddleSafeTwin(name, twinPieces.slice(start, end).join(":"), context);
+				if (text !== void 0 && text !== twin) return "***";
+				text = twin;
+				break;
+			}
+			return text ?? (name !== "" && inner.includes(name) ? "***" : name);
+		};
+	}
 	/** The bag a pass's log twins are keyed by (issue #3100): the recorded one, else the inherited one. */
 	logTwinBag(context) {
 		return context?.recordedSecretValues ?? context?.inheritedSecrets;
@@ -27581,7 +27913,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(this.logTextOfLeaf(node, context), context);
+			if (typeof node === "string") return this.maskSecretsForLog(node, context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -27593,7 +27925,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(this.logTextOfLeaf(key, context), context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -27620,14 +27952,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* visible. The FIRST mask is demonstrated by a test: deleting it (masking
 	* only after the strip) reds the split-needle case, because the recorded
 	* needle is then the split form and the strip has destroyed it. The SECOND
-	* mask is NOT reached by any test here and is defence in depth: it earns its
-	* place only when the bag holds a needle that is the STRIPPED form of the
-	* value in hand, and every route through THIS resolver records the value it
-	* actually resolved — so the split copy is itself a needle and the first
-	* mask already catches it. The shape was measured against a hand-built bag
-	* during review, not produced by the resolver. Kept anyway: it is one
-	* idempotent call, and the alternative is re-deciding per future caller
-	* whether the bag and the value can disagree.
+	* mask earns its place when the bag holds a needle that is the STRIPPED form
+	* of the text in hand. A value this resolver resolved cannot be that text
+	* (the split copy is itself recorded, so the first mask catches it), but a
+	* template LITERAL can: issue #3150's region-scoped clients refusal prints
+	* a producer-region guest's region through this helper, and a literal ARN
+	* region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is masked only
+	* by the second pass (`intrinsic-resolver-name-argument-log-twin.test.ts`
+	* pins both halves on that route).
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -27661,7 +27993,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* NEEDLE match that straddles a masked span, which is why the log lines go
 	* through `logTwinText` rather than masking the twin alone.
 	*/
-	async resolveDynamicReferencesWithLogTwin(value, logTwin, context) {
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
@@ -27671,14 +28003,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			fullMatch: match[0],
 			inner: match[1]
 		});
-		for (const { fullMatch, inner } of matches) {
+		const twinTokens = dynamicReferenceTokens(logTwin);
+		const tokensAligned = twinTokens.length === matches.length;
+		for (const [index, { fullMatch, inner }] of matches.entries()) {
 			const service = inner.split(":")[0];
+			const pairedTwin = tokensAligned ? twinTokens[index] : void 0;
+			const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
+			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
-				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context));
+				const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
+					tokenLogText,
+					nameLogText
+				});
 				result = result.replace(fullMatch, () => foreign.result);
 				twin = twin.replace(fullMatch, () => foreign.twin);
 				continue;
@@ -27709,10 +28049,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			* which caches nothing (issue #1933).
 			*/
 			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context);
+			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
 				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
 				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
 				else cacheable = false;
@@ -27722,12 +28062,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(fullMatch, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
-				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${service}`, context));
+				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
 				continue;
 			}
 			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -27763,7 +28103,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
 	* forms are unaffected.)
 	*/
-	async resolveSecretsManagerReference(inner, context) {
+	async resolveSecretsManagerReference(inner, context, nameLogText) {
 		const afterService = inner.substring(15);
 		let secretId;
 		let jsonKey = "";
@@ -27792,9 +28132,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		const loggedSecretId = this.maskSecretsForLog(secretId, context);
-		const loggedJsonKey = this.maskSecretsForLog(jsonKey, context);
-		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(versionStage, context)}:${this.maskSecretsForLog(versionId, context)}`);
+		const loggedSecretId = this.maskSecretsForLog(nameLogText(secretId), context);
+		const loggedJsonKey = this.maskSecretsForLog(nameLogText(jsonKey), context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(nameLogText(versionStage), context)}:${this.maskSecretsForLog(nameLogText(versionId), context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
@@ -27955,10 +28295,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
+	async resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		const loggedParameterName = this.maskSecretsForLog(parameterName, context);
+		const loggedParameterName = this.maskSecretsForLog(nameLogText(parameterName), context);
 		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
@@ -29310,7 +29650,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Daqr0Ygq.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BAYjqZuM.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -38011,7 +38351,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					});
 				} catch (createError) {
 					const msg = createError instanceof Error ? createError.message : String(createError);
-					if (!isNameCollisionError(msg)) throw createError;
+					if (!isNameCollisionErrorFrom(createError, op.logicalId)) throw createError;
 					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create of the old resource (${safe(prev.physicalId)}) collided with the name still held by the new one (${safe(current.physicalId)}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with ` + (typeof op.logicalId === "string" && PASTEABLE_LOGICAL_ID.test(op.logicalId) ? `\`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the ` : "`cdkd rollback --orphan <id>` (the id is withheld: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource -- read it from `cdkd events`): one op failure stops the ") + `segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${displaySafe(msg)}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(current.physicalId)}) first...`);
 					{
@@ -41148,7 +41488,7 @@ var DeployEngine = class DeployEngine {
 							createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 						} catch (createError) {
 							const createMsg = createError instanceof Error ? createError.message : String(createError);
-							if (!isNameCollisionError(createMsg)) throw createError;
+							if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 							const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
@@ -41284,8 +41624,7 @@ var DeployEngine = class DeployEngine {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
 								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
-								const createMsg = createError instanceof Error ? createError.message : String(createError);
-								if (!isNameCollisionError(createMsg)) throw createError;
+								if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 							}
@@ -41569,7 +41908,7 @@ var DeployEngine = class DeployEngine {
 		if (!(error instanceof ProvisioningError)) return void 0;
 		const physicalId = error.physicalId;
 		if (!physicalId) return void 0;
-		if (!isNameCollisionError(error.message)) return void 0;
+		if (!isNameCollisionErrorFrom(error, logicalId)) return void 0;
 		const stackName = getCurrentStackName();
 		if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
 		if (!stackName) return void 0;
@@ -42039,5 +42378,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, ensureAssetStorage as $n, setAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, retryClassificationText as Ai, buildForceUnlockCommand as An, resolveSkipPrefix as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, orphansAfterRollback as Bn, uploadCfnTemplate as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, withErrorHandling as Ci, recordMaskOnlyValue as Cn, Synthesizer as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isTransientServerError as Di, LockManager as Dn, resolveApp as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isThrottlingError as Ei, scrubResourceRecord as En, getLegacyStateBucketName as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, warnDeprecatedNoPrefixCliFlag as Fr, resolveExplicitPhysicalId as Ft, gray as G, WorkGraph as Gn, derivePartitionAndUrlSuffix as Gr, requireConfigObject as Gt, formatResourceLine as H, shouldRetainResource as Hn, expectedOwnerParam as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, CFN_TEMPLATE_BODY_LIMIT as Ir, assertRegionMatch as It, yellow as J, loadPublishableAssetManifest as Jn, clearBucketRegionCache as Jr, producerRegionsFromState as Jt, green as K, buildAssetRedirectMap as Kn, AssemblyReader as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, CFN_TEMPLATE_URL_LIMIT as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, forceQuitRecoveryClause as Mn, resolveStateBucketWithDefaultAndSource as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, formatLockExpiry as Nn, resolveUseCdkBootstrapAssets as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, markNonRetryable as Oi, S3StateBackend as On, resolveAutoAssetStorage as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, stateBucketExistenceConfirmed as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, assertAssetBucketRegion as Qn, resetAwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, importableOutputKeys as Rn, MIGRATE_TMP_PREFIX as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, normalizeAwsError as Si, maskSecretsInText as Sn, getDockerImageBySourceHash as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, isRetryableTransientError as Ti, redactSecretsForState as Tn, getDefaultStateBucketName as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, AssetPublisher as Un, PARTITION_TABLE as Ur, replayWarn as Ut, toFiniteNumber as V, orphansCarriedFrom as Vn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vr, configStringRefusal as Vt, cyan as W, stringifyValue as Wn, canonicalizeRegion as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, AssetModeResolver as Xn, AwsClients as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, rewriteTemplateAssetReferences as Yn, resolveBucketRegion as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, BOOTSTRAP_MARKER_PREFIX as Zn, getAwsClients as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, StackTerminationProtectionError as _i, errorCauseChain as _n, runDockerForeground as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, DeployCancelledError as ai, findSilentDropProperties as an, validateContainerRepoName as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, formatError as bi, markSameGenerationBag as bn, stripControlChars as br, deleteSkipReason as bt, replayFailedOperations as c, LocalInvokeBuildError as ci, DagBuilder as cn, buildDockerImage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, NestedStackChildDirectDestroyError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerFailure as dr, beginCommandInterruptScope as dt, AssetError as ei, s3BucketWebsiteUrl as en, getBootstrapMarkerKey as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, PartialFailureError as fi, STATE_SOURCED_READBACK_RULES as fn, dockerSpawnEnvWithSensitive as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, StackHasActiveImportsError as gi, dynamicReferenceTokens as gn, redactDockerArgvValues as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ResourceUpdateNotSupportedError as hi, createSecretMasker as hn, partitionSensitiveEnv as hr, startInterruptWatch as ht, DeploymentEventsReader as i, DependencyError as ii, findActionableSilentDrops as in, validateAssetBucketName as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, __exportAll as ji, buildLockContentionMessage as jn, resolveStateBucketWithDefault as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, markRedactedCause as ki, rebuildClientForBucketRegion as kn, resolveCaptureObservedState as kr, isUnboundTemplateParameter as kt, replayRollback as l, LocalStartServiceError as li, TemplateParser as ln, describeDockerCapturedOutput as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, ResourceTimeoutError as mi, carriesSecretMask as mn, getDockerCmd as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConfigError as ni, DiffCalculator as nn, parseBootstrapMarker as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DynamicReferenceRegionAmbiguousError as oi, describeTypeWithThrottleRetry as on, buildDenyExternalAccessPolicy as or, ProviderRegistry as ot, maskingRetryLogger as p, ProvisioningError as pi, TEMPLATE_SOURCED_RULES as pn, formatDockerLoginError as pr, interruptWatchListenerCount as pt, red as q, createAssetRedirectResolver as qn, processStackMessages as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CrossAccountSecretRefusalError as ri, INTRINSIC_KEYS as rn, readBootstrapMarkerBody as rr, IAMRoleProvider as rt, planRollback as s, IntrinsicResolutionRefusalError as si, withRetry as sn, describeAwsFailure as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CdkdError as ti, applyRoleArnIfSet as tn, isCrossRegionRedirect as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LockError as ui, STATE_SOURCED_BASELINE_RULES as un, describeDockerExecFailure as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StateError as vi, identityKeyFor as vn, runDockerStreaming as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, isMarkedNonRetryable as wi, recoverMaskedOutput as wn, synthesisStatusMessage as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, isCdkdError as xi, maskSecretsInError as xn, AssetManifestLoader as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, SynthesisError as yi, isSingleDynamicReferenceToken as yn, escapeRegExp$1 as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputs as zn, findLargeInlineResources as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-e6ZxOr56.js.map
+export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
+//# sourceMappingURL=deploy-engine-v7h1H_Ac.js.map