@go-to-k/cdkd 0.290.13 → 0.290.15

package/dist/{deploy-engine-omGpC16W.js → deploy-engine-C2qLzc-5.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version--dVnQSTI.js";
+import { t as getCdkdVersion } from "./version-BnegtHzZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -804,6 +804,96 @@ function isNameCollisionError(message) {
 	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
 }
 /**
+* SDK exception NAMES that mean, on their own, "a resource with this NAME
+* already exists" — nothing else (issue
+* [#3208](https://github.com/go-to-k/cdkd/issues/3208)).
+*
+* This list is the NARROW exception to the paragraph above, not a reversal of
+* it. That paragraph refuses name-based classification because a name like
+* `ResourceConflictException` is AMBIGUOUS — Lambda raises it for a function in
+* a PENDING state too, so crediting it would delete a live function under
+* `--replace`. Every name here is the opposite: the service declares it for the
+* duplicate-name condition and for nothing else, so there is no second reading
+* to be wrong about. A name may join this list only on that test.
+*
+* It exists because ELBv2 states the condition in prose that the message
+* matcher above cannot see, and must not be widened to see. MEASURED against
+* the real API (us-east-1, 2026-09-16, `@aws-sdk/client-elastic-load-balancing-v2`
+* 3.1126.0), creating a second target group under a live name:
+*
+*   name    = 'DuplicateTargetGroupNameException'
+*   message = "A target group with the same name 'x' exists, but with
+*              different settings"
+*   cause   = none
+*
+* The message carries no code and never says "already exists", so
+* `isNameCollisionError` misses it — and the consequence is not cosmetic: the
+* `--replace` delete-first fallback and the rollback executor's
+* delete-new-first arm both gate on that predicate, so BOTH recovery paths went
+* inert and a create-only change to a cdkd-named target group could not be
+* deployed at all. Widening the prose matcher to a bare `exists` was rejected:
+* it is substring-matched against every service's text, and the direction of a
+* false positive here is a DELETE.
+*
+* The SET is complete rather than illustrative: `Duplicate*NameException` over
+* every installed `@aws-sdk/client-*` model yields exactly these three, all
+* ELBv2. Two ELBv2 siblings are deliberately EXCLUDED, and the reasons are the
+* membership test in action — `DuplicateListenerException` reports a listener
+* already bound to that PORT, which is not a name, and
+* `DuplicateTagKeysException` reports repeated keys WITHIN one request, which
+* is not an existence condition at all. Crediting either would hand a
+* destructive path a collision that no delete can clear.
+*/
+const NAME_COLLISION_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"DuplicateTargetGroupNameException",
+	"DuplicateLoadBalancerNameException",
+	"DuplicateTrustStoreNameException"
+]);
+/**
+* {@link isNameCollisionError}, but reading the ERROR rather than a rendered
+* message — which is the only way to see an exception NAME (issue #3208).
+*
+* Providers wrap an AWS failure as `Failed to create X: ${err.message}`, so the
+* name is dropped before any caller could match it. This walks the bounded
+* `cause` chain (the same {@link MAX_CAUSE_CHAIN_DEPTH} as every other
+* classifier in this file), checking each link's `name` against
+* {@link NAME_COLLISION_ERROR_NAMES} and each link's `message` through
+* {@link isNameCollisionError}. A provider is required to thread the caught
+* value as `cause` (`scripts/check-provider-error-cause.ts` enforces it across
+* `src/provisioning/providers/**`), which is what makes the walk reach the SDK
+* error at all.
+*
+* Prefer this at any site holding the error object. The string form stays for
+* callers that genuinely have only text, and its behaviour is unchanged — this
+* is strictly additive, so nothing that matched before stops matching.
+*/
+/**
+* `String(value)` that cannot itself throw — a thrown `Object.create(null)` has
+* no `toString`. Preserves the call sites' pre-#3208 `String(createError)` arm
+* for a non-`Error` throw, which reading `.message` alone would have dropped.
+*/
+function stringifyForMatch(value) {
+	try {
+		return String(value);
+	} catch {
+		return "";
+	}
+}
+function isNameCollisionErrorFrom(error, logicalId) {
+	if (typeof error === "string") return isNameCollisionError(error);
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		const link = current;
+		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
+		if (typeof link.name === "string" && NAME_COLLISION_ERROR_NAMES.has(link.name)) return true;
+		if (depth === 0) {
+			if (isNameCollisionError(error instanceof Error && typeof link.message === "string" ? link.message : stringifyForMatch(error))) return true;
+		}
+		current = link.cause;
+	}
+	return false;
+}
+/**
 * Match a same-name re-creation cooldown — an AWS service still holding a
 * resource's name while its asynchronous delete finishes. Every recognised
 * spelling lives in {@link NAME_COOLDOWN_ERROR_MESSAGE_PATTERNS}; add new ones
@@ -24617,6 +24707,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* one.
 	*/
 	producerRegionGuest = false;
+	/**
+	* How a producer-region guest PRINTS its own `explicitRegion` (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)): the masked log text
+	* its creator held for that region, which a template can assemble around a
+	* short secret, or `***` once a later spelling of the same region masks
+	* differently. Display only; `undefined` on an ordinary resolver, whose
+	* region its command built (the stack's synthesized or recorded region,
+	* `--region`, or a region read out of a literal token).
+	*/
+	explicitRegionLogText;
 	strictGetAtt;
 	cfnFallback;
 	/**
@@ -24868,18 +24968,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* uppercase spelling would build a second client for the same physical
 	* region — benign, but wasteful and confusing in a debug log.
 	*/
-	clientsForRegion(targetRegion) {
+	clientsForRegion(targetRegion, targetLogText) {
 		const ambient = getAwsClients();
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
-		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(target).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
+		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
+		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
 		this.regionScopedClients.set(target, scoped);
-		this.logger.debug(`Using region-scoped AWS clients for ${target}`);
+		this.logger.debug(`Using region-scoped AWS clients for ${loggedTarget}`);
 		return scoped;
 	}
 	/**
@@ -25469,7 +25570,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.logTextOfLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -25487,8 +25588,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
-			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.maskSecretsForLog(this.outputNameLogText(k, context), context));
+			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.maskSecretsForLog(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
 		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
@@ -26775,7 +26877,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the producer's rather than the caller's — which is exactly what issue #2057
 	* says the other two copies get wrong.
 	*/
-	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput) {
+	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
 		if (carriesSecretMask(value)) {
 			const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
 			if (recovered !== void 0) {
@@ -26791,7 +26893,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (!carriesDynamicReference(value)) return value;
-		const resolver = this.resolverForProducerRegion(producerRegion);
+		const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 		const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
 		const walk = async (v) => {
 			if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, pinnedContext) : v;
@@ -26872,19 +26974,25 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secret) recordedSecretExpressions.add(expression);
 		else recordedSecretExpressions.delete(expression);
 	}
-	resolverForProducerRegion(producerRegion) {
+	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
 		if (target === canonicalizeRegion(this.explicitRegion)) return this;
+		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
+		const guestRegionText = this.maskThenStripThenMask(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
-		if (cached) return cached;
+		if (cached) {
+			if (cached.explicitRegionLogText !== guestRegionText) cached.explicitRegionLogText = "***";
+			return cached;
+		}
 		const scoped = new IntrinsicFunctionResolver(target, {
 			strictGetAtt: this.strictGetAtt,
 			cfnFallback: this.cfnFallback
 		});
 		scoped.producerRegionGuest = true;
+		scoped.explicitRegionLogText = guestRegionText;
 		this.producerRegionResolvers.set(target, scoped);
-		this.logger.debug(`Using a producer-region resolver for ${target}`);
+		this.logger.debug(`Using a producer-region resolver for ${guestRegionText}`);
 		return scoped;
 	}
 	/**
@@ -26909,8 +27017,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${this.maskSecretsForLog(entry.producerRegion, context)}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(entry.producerStack, context)} / ${this.logTextOfLeaf(entry.producerRegion, context)})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
 					outputKey: exportName
@@ -26934,13 +27042,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${lookupRegion})`);
+					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${this.maskSecretsForLog(lookupRegion, context)})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${this.maskSecretsForLog(lookupRegion, context)}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
@@ -26961,7 +27069,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey, {
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(found.refStack, context)} / ${this.logTextOfLeaf(found.lookupRegion, context)})`, sourceKey, {
 			stackName: found.refStack,
 			region: found.lookupRegion,
 			outputKey: exportName
@@ -27026,9 +27134,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `OutputName` is the overwhelmingly common cause, and the list is what makes
 	* the error actionable.
 	*
-	* Residual, stated rather than hidden: the needles belong to the CONSUMER's
-	* resolution, so a plaintext sitting in a PRODUCER key that this consumer
-	* never resolved is not maskable from here. The cap is what bounds that case;
+	* `maskSecretsForLog` reads the consumer pass's log twin first (issue #3150),
+	* so a key equal to a name this pass assembled around a short secret is
+	* masked. Residual, stated rather than hidden: the needles and twins belong to the
+	* CONSUMER's resolution, so a plaintext sitting in a PRODUCER key that this
+	* consumer never resolved is not maskable from here. The cap is what bounds that case;
 	* `cdkd scrub` reporting the producer's own `secretBearingKeys` is the remedy.
 	*/
 	describeAvailableOutputs(keys, context) {
@@ -27060,7 +27170,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* logged for non-not-found failures). Same graceful-degradation
 	* contract as {@link lookupCfnExport}.
 	*/
-	async lookupCfnStackOutputs(stackName, region, context) {
+	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
 		const cacheKey = `${region}\0${stackName}`;
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
@@ -27074,7 +27184,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(region, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(loggedRegionText, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -27179,12 +27289,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const outputName = await this.resolveValue(args["OutputName"], context);
 		if (typeof outputName !== "string" || outputName === "") throw new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`);
 		let region = this.resolverRegion;
+		let loggedRegionText = this.logTextOfLeaf(region, context);
 		if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
+			loggedRegionText = this.regionLogText(resolvedRegion, context);
 		}
 		let roleArn;
 		if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
@@ -27192,15 +27304,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(region, context)}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(loggedRegionText, context)}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		const loggedRegion = this.maskSecretsForLog(region, context);
+		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
-				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context);
+				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context, loggedRegionText);
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
@@ -27222,12 +27334,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
 		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${this.logTextOfLeaf(outputName, context)}' (producer ${this.logTextOfLeaf(stackName, context)} / ${loggedRegionText})`, sourceKey, {
 			stackName,
 			region,
 			outputKey: outputName,
 			...roleArn ? { crossAccount: true } : {}
-		});
+		}, loggedRegionText);
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -27365,7 +27477,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
 		const inputLogText = this.logTextOfLeaf(resolvedValue, context);
-		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskSecretsForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
+		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskNeedlesForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
 		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(inputLogText, context)} -> ${this.maskSecretsForLog(inputLogText !== resolvedValue ? "***" : result, context)}`);
 		return result;
 	}
@@ -27395,21 +27507,23 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		* given explicitly (see {@link explicitRegion}).
 		*/
 		let clientRegion;
+		let loggedRegionText;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
+			loggedRegionText = this.regionLogText(resolvedValue, context);
 		} else {
 			region = (await getAccountInfo(this.resolverRegion)).region;
 			clientRegion = this.explicitRegion;
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
-		const ec2Client = this.clientsForRegion(clientRegion).ec2;
+		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.maskSecretsForLog(loggedRegionText, context)).ec2;
 		let azNames;
 		try {
 			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
@@ -27420,11 +27534,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -27461,8 +27575,37 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Mask any resolved secret value out of a string bound for a log line, using
 	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
 	* recorded no secrets.
+	*
+	* A value with a registered LOG TWIN prints as its twin first (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The needle mask
+	* matches a secret under {@link MIN_NEEDLE_LENGTH} only as the whole text,
+	* so a name an `Fn::Sub` assembled around a 1-3 character secret (a map key,
+	* a stack or output name, an attribute name, the secret id of a dynamic
+	* reference) printed in the clear at every site that handed its RAW value
+	* here, although the pass had registered where the secret sits. Looking the
+	* twin up HERE, rather than at each such site, is what makes the class
+	* closed for raw values: every one of those sites already calls this method.
+	* The twin prints as it is: it is the raw text with masked spans, so it
+	* holds no recorded needle the raw text lacks. When the needle mask ALSO
+	* changes the raw text the whole text is masked instead, the rule
+	* `logTwinText` applies to a Join / Sub line, since the two masks' spans
+	* cannot be merged. What this cannot see is a value TRANSFORMED before it
+	* arrives (a lowercased region, a sliced output name, an assembled
+	* sentence); those sites derive their text from the twin themselves.
 	*/
 	maskSecretsForLog(text, context) {
+		const registered = this.registeredLogTwin(text, context);
+		if (registered === void 0) return this.maskNeedlesForLog(text, context);
+		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
+	}
+	/**
+	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
+	* lookup. For the two DETECTORS that must ask the needle mask apart from the
+	* position mask: `logTwinText`, which asks it of a value that already has a
+	* twin, and `resolveBase64`, whose other operand is the position mask. A
+	* message masks through `maskSecretsForLog`.
+	*/
+	maskNeedlesForLog(text, context) {
 		let masked = text;
 		const inherited = context?.inheritedSecrets;
 		if (inherited && inherited.size > 0) masked = maskSecretsInText(masked, inherited);
@@ -27492,7 +27635,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* resolver's mask-coverage checker sees a masker at the site.
 	*/
 	logTwinText(result, twin, context) {
-		return twin !== result && this.maskSecretsForLog(result, context) !== result ? "***" : twin;
+		return twin !== result && this.maskNeedlesForLog(result, context) !== result ? "***" : twin;
 	}
 	/**
 	* The log twins of `Fn::Split`'s pieces (issue #3100), each registered for
@@ -27540,16 +27683,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the leaf treated as a resolution product — masked whole when it is a
 	* recorded secret, otherwise the masked twin this pass registered for it —
 	* and then `logTwinText`'s whole-line guard. The caller still wraps the
-	* result in `maskSecretsForLog`. Shared by every caller of `maskValueLeaves`
-	* (the `Fn::Select`, `Fn::Split`, `Fn::Equals`, `Fn::FindInMap`,
-	* `Fn::GetAZs` and `Fn::Cidr` lines and the VPC `Ipv6CidrBlocks` line among
-	* them) and by the `Fn::Base64` line, so a string one
-	* write already masked by position is not printed in the clear by the next
-	* intrinsic that logs it. `maskValueLeaves` also masks values interpolated
-	* into THROWN messages (the `Fn::Cidr` argument refusals, for one), so those
-	* messages take the same position mask: a short secret an earlier write put
-	* into the value is `***` there too, the direction the mask at the throw
-	* already takes for a whole secret.
+	* result in `maskSecretsForLog`. Used where the text is needed BEFORE that
+	* masker, or apart from it: the `Fn::Base64` line and its detector, and the
+	* names issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)
+	* transforms or composes before printing (`regionLogText`,
+	* `outputNameLogText`, the invalid-region refusals, the cross-stack `origin`
+	* strings). A leaf printed as it is needs none of it: `maskSecretsForLog`
+	* looks the twin up itself, which is how `maskValueLeaves` gives its lines
+	* and the THROWN messages it masks (the `Fn::Cidr` argument refusals, for
+	* one) the same position mask.
 	*/
 	logTextOfLeaf(value, context) {
 		return this.logTwinText(value, this.logTwinOfProduct({
@@ -27557,6 +27699,85 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			twin: value
 		}, context).twin, context);
 	}
+	/**
+	* The log text of a nested stack's OUTPUT name, the part of `attributeName`
+	* after `Outputs.` (issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)).
+	* The twin registry is keyed by the exact string, so the suffix has no twin
+	* of its own: it is sliced from the twin of the WHOLE attribute name. A twin
+	* that no longer starts with the literal prefix has a mask over part of it
+	* (a secret was written into the prefix), so the slice offset no longer
+	* lines up and the suffix prints as `***`.
+	*/
+	outputNameLogText(attributeName, context) {
+		const twin = this.logTextOfLeaf(attributeName, context);
+		return twin.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) ? twin.slice(8) : "***";
+	}
+	/**
+	* The log text of a template-supplied REGION as the resolver uses it, i.e.
+	* after `canonicalizeRegion` (issue #3150). The twin is taken from the RAW
+	* value, the string a write registered, and lowercased the same way: a
+	* lookup of the canonical form finds no twin once the raw value had an
+	* upper-case part, and lowercasing leaves every `***` span where it was.
+	*/
+	regionLogText(rawRegion, context) {
+		const canonical = canonicalizeRegion(rawRegion);
+		const text = canonicalizeRegion(this.logTextOfLeaf(rawRegion, context));
+		return text !== canonical && this.maskNeedlesForLog(canonical, context) !== canonical ? "***" : text;
+	}
+	/**
+	* The log text of a name or token whose `twin` masks spans of `raw` (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The twin prints
+	* unless the needle mask ALSO changes `raw`; then the two must agree. When
+	* the needle-masked `raw` IS the twin, both masked the same spans and the
+	* twin is safe (`/probe/***` for a 4+ character secret the name holds
+	* whole). When they differ, a recorded secret straddles a masked span
+	* (`q7ab` across `id-***ab`), no text can honour both, and the name prints
+	* as `***`. Coarser `logTwinText` gives up whenever both masks fire.
+	*/
+	straddleSafeTwin(raw, twin, context) {
+		if (twin === raw) return twin;
+		const needled = this.maskNeedlesForLog(raw, context);
+		if (needled === raw) return twin;
+		return needled === twin ? twin : "***";
+	}
+	/**
+	* The log text of a name parsed out of a dynamic-reference token (issue
+	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). `resolveSub` /
+	* `resolveJoin` re-enter the dynamic-reference loop with the ASSEMBLED string
+	* and its twin, so a secret id, JSON key, version stage or id, SSM parameter
+	* name, service or ARN region assembled around a short secret has its masked
+	* spelling in `tokenTwin` only. Every such name is a run of the token's
+	* `:`-separated pieces, so its log text is the twin's run over the same
+	* pieces. Nothing is registered: the pass's log-twin registry also decides
+	* what `Fn::Base64` persists, so the mapping lives in the returned function.
+	*
+	* `tokenTwin` is the twin's own `{{resolve:...}}` token paired with this one.
+	* Each run's text goes through `straddleSafeTwin`, so a name whose needle
+	* mask disagrees with its twin prints as `***`. A name whose runs carry different
+	* twins, or a token whose pieces do not pair with the twin's (a mask
+	* covering a `:`), prints as `***` too.
+	*
+	* A name that is no run of the token is a default the caller synthesized
+	* (`AWSCURRENT` for an empty version stage, `''` for an absent version id),
+	* printed as it is. Should the token spell such a non-empty name inside a longer
+	* piece, it prints as `***`: the run rule says nothing about that text.
+	*/
+	dynamicReferenceNameLogText(inner, tokenTwin, context) {
+		const twinPieces = tokenTwin.slice(10, -2).split(":");
+		const pieces = inner.split(":");
+		if (twinPieces.length !== pieces.length) return () => "***";
+		return (name) => {
+			let text;
+			for (let start = 0; start < pieces.length; start++) for (let end = start + 1; end <= pieces.length; end++) {
+				if (pieces.slice(start, end).join(":") !== name) continue;
+				const twin = this.straddleSafeTwin(name, twinPieces.slice(start, end).join(":"), context);
+				if (text !== void 0 && text !== twin) return "***";
+				text = twin;
+				break;
+			}
+			return text ?? (name !== "" && inner.includes(name) ? "***" : name);
+		};
+	}
 	/** The bag a pass's log twins are keyed by (issue #3100): the recorded one, else the inherited one. */
 	logTwinBag(context) {
 		return context?.recordedSecretValues ?? context?.inheritedSecrets;
@@ -27692,7 +27913,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(this.logTextOfLeaf(node, context), context);
+			if (typeof node === "string") return this.maskSecretsForLog(node, context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -27704,7 +27925,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(this.logTextOfLeaf(key, context), context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -27731,14 +27952,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* visible. The FIRST mask is demonstrated by a test: deleting it (masking
 	* only after the strip) reds the split-needle case, because the recorded
 	* needle is then the split form and the strip has destroyed it. The SECOND
-	* mask is NOT reached by any test here and is defence in depth: it earns its
-	* place only when the bag holds a needle that is the STRIPPED form of the
-	* value in hand, and every route through THIS resolver records the value it
-	* actually resolved — so the split copy is itself a needle and the first
-	* mask already catches it. The shape was measured against a hand-built bag
-	* during review, not produced by the resolver. Kept anyway: it is one
-	* idempotent call, and the alternative is re-deciding per future caller
-	* whether the bag and the value can disagree.
+	* mask earns its place when the bag holds a needle that is the STRIPPED form
+	* of the text in hand. A value this resolver resolved cannot be that text
+	* (the split copy is itself recorded, so the first mask catches it), but a
+	* template LITERAL can: issue #3150's region-scoped clients refusal prints
+	* a producer-region guest's region through this helper, and a literal ARN
+	* region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is masked only
+	* by the second pass (`intrinsic-resolver-name-argument-log-twin.test.ts`
+	* pins both halves on that route).
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -27772,7 +27993,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* NEEDLE match that straddles a masked span, which is why the log lines go
 	* through `logTwinText` rather than masking the twin alone.
 	*/
-	async resolveDynamicReferencesWithLogTwin(value, logTwin, context) {
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
@@ -27782,14 +28003,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			fullMatch: match[0],
 			inner: match[1]
 		});
-		for (const { fullMatch, inner } of matches) {
+		const twinTokens = dynamicReferenceTokens(logTwin);
+		const tokensAligned = twinTokens.length === matches.length;
+		for (const [index, { fullMatch, inner }] of matches.entries()) {
 			const service = inner.split(":")[0];
+			const pairedTwin = tokensAligned ? twinTokens[index] : void 0;
+			const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
+			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
-				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context));
+				const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
+					tokenLogText,
+					nameLogText
+				});
 				result = result.replace(fullMatch, () => foreign.result);
 				twin = twin.replace(fullMatch, () => foreign.twin);
 				continue;
@@ -27820,10 +28049,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			* which caches nothing (issue #1933).
 			*/
 			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context);
+			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
 				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
 				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
 				else cacheable = false;
@@ -27833,12 +28062,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(fullMatch, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
-				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${service}`, context));
+				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
 				continue;
 			}
 			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -27874,7 +28103,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
 	* forms are unaffected.)
 	*/
-	async resolveSecretsManagerReference(inner, context) {
+	async resolveSecretsManagerReference(inner, context, nameLogText) {
 		const afterService = inner.substring(15);
 		let secretId;
 		let jsonKey = "";
@@ -27903,9 +28132,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		const loggedSecretId = this.maskSecretsForLog(secretId, context);
-		const loggedJsonKey = this.maskSecretsForLog(jsonKey, context);
-		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(versionStage, context)}:${this.maskSecretsForLog(versionId, context)}`);
+		const loggedSecretId = this.maskSecretsForLog(nameLogText(secretId), context);
+		const loggedJsonKey = this.maskSecretsForLog(nameLogText(jsonKey), context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(nameLogText(versionStage), context)}:${this.maskSecretsForLog(nameLogText(versionId), context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
@@ -28066,10 +28295,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
+	async resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		const loggedParameterName = this.maskSecretsForLog(parameterName, context);
+		const loggedParameterName = this.maskSecretsForLog(nameLogText(parameterName), context);
 		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
@@ -29421,7 +29650,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CpUSth0q.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D5-3SGmd.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -36996,12 +37225,18 @@ const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 * `update()` (`this.create(...)` in ACM certificate / IAM managed policy / IAM
 * role / Lambda permission / SNS subscription). Those are NOT template-driven
 * — this executor's `revert` arm calls `provider.update(...)` with
-* `previousState.properties`, so they forward a STATE record on a replay — but
-* they CANNOT receive a `CreateContext`: `update()`'s own context is an
-* `UpdateContext`, which carries no `replayingState` to forward.
-* The constraint that follows is on providers, not on this constant: a
-* provider with a create-side pre-flight refusal must not re-create inside
-* `update()`. See `CreateContext` in `src/types/resource.ts`.
+* `previousState.properties`, so they forward a STATE record on a replay — and
+* they still pass NO `CreateContext`, so a create-side pre-flight refusal
+* would still fire there. The constraint that follows is on providers, not on
+* this constant: a provider with a create-side pre-flight refusal must not
+* re-create inside `update()`. See `CreateContext` in `src/types/resource.ts`.
+*
+* What issue [#3141](https://github.com/go-to-k/cdkd/issues/3141) changed is
+* that the INFORMATION now exists on that path — `UpdateContext` carries its
+* own `replayingState`, set by both revert arms below — so such a provider
+* could build a `CreateContext` from it instead of relying on the constraint.
+* None does today; the five sites are untouched. Read that as a route that
+* opened, not as a constraint that lifted.
 */
 const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
 /**
@@ -38122,7 +38357,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					});
 				} catch (createError) {
 					const msg = createError instanceof Error ? createError.message : String(createError);
-					if (!isNameCollisionError(msg)) throw createError;
+					if (!isNameCollisionErrorFrom(createError, op.logicalId)) throw createError;
 					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create of the old resource (${safe(prev.physicalId)}) collided with the name still held by the new one (${safe(current.physicalId)}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with ` + (typeof op.logicalId === "string" && PASTEABLE_LOGICAL_ID.test(op.logicalId) ? `\`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the ` : "`cdkd rollback --orphan <id>` (the id is withheld: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource -- read it from `cdkd events`): one op failure stops the ") + `segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${displaySafe(msg)}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(current.physicalId)}) first...`);
 					{
@@ -38221,7 +38456,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					currentProps ?? {},
 					{
 						maskSecrets: createSecretMasker(secrets),
-						expectedRegion: ctx.region
+						expectedRegion: ctx.region,
+						replayingState: true
 					}
 				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
@@ -38389,7 +38625,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						attemptedProps ?? {},
 						{
 							maskSecrets: createSecretMasker(secrets),
-							expectedRegion: ctx.region
+							expectedRegion: ctx.region,
+							replayingState: true
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
@@ -41259,7 +41496,7 @@ var DeployEngine = class DeployEngine {
 							createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 						} catch (createError) {
 							const createMsg = createError instanceof Error ? createError.message : String(createError);
-							if (!isNameCollisionError(createMsg)) throw createError;
+							if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 							const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
@@ -41395,8 +41632,7 @@ var DeployEngine = class DeployEngine {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
 								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
-								const createMsg = createError instanceof Error ? createError.message : String(createError);
-								if (!isNameCollisionError(createMsg)) throw createError;
+								if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 							}
@@ -41680,7 +41916,7 @@ var DeployEngine = class DeployEngine {
 		if (!(error instanceof ProvisioningError)) return void 0;
 		const physicalId = error.physicalId;
 		if (!physicalId) return void 0;
-		if (!isNameCollisionError(error.message)) return void 0;
+		if (!isNameCollisionErrorFrom(error, logicalId)) return void 0;
 		const stackName = getCurrentStackName();
 		if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
 		if (!stackName) return void 0;
@@ -42151,4 +42387,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-omGpC16W.js.map
+//# sourceMappingURL=deploy-engine-C2qLzc-5.js.map