@go-to-k/cdkd 0.290.2 → 0.290.4

package/dist/{deploy-engine-Nn9j2GPK.js → deploy-engine-DD7JE_Ic.js}

@@ -1,6 +1,6 @@
-import { b as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
+import { b as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-7XwrjRzX.js";
+import { t as getCdkdVersion } from "./version-BUcQz4SU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17,7 +17,7 @@ import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway
 import { DescribeApiDestinationCommand, DescribeConnectionCommand, EventBridgeClient } from "@aws-sdk/client-eventbridge";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, GetCloudFrontOriginAccessIdentityCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
 import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
@@ -1148,7 +1148,15 @@ function formatDuration$1(ms) {
 *    `Outputs.<Key>` the child does not declare rather than letting
 *    `guardedPhysicalIdFallback` serve the synthetic
 *    `arn:cdkd-local:...` physical id — that id starts with `arn:`, so the
-*    #1103 ARN-shape guard passes it.
+*    #1103 ARN-shape guard passes it; and the LIVE-READ refusals of issue
+*    [#3096](https://github.com/go-to-k/cdkd/issues/3096)
+*    (`refuseUnservedAttribute`, raised by the `AWS::EC2::Instance` address /
+*    DNS / zone arm, the `AWS::EC2::VPC` `DefaultSecurityGroup` arm and the
+*    `AWS::CloudFront::Distribution` `DomainName` arm when the record omits
+*    the attribute and the live read finds nothing or fails), plus the
+*    read-less `AWS::RDS::DBProxy` / `DBProxyEndpoint` `VpcId` refusal beside
+*    them — each replacing a physical id the attribute's value type can never
+*    accept.
 * 2. NOT reachable from it, and thrown as this class only so that "deliberate
 *    refusal" is a property of the THROW rather than of the one catch that
 *    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874),
@@ -1177,11 +1185,17 @@ function formatDuration$1(ms) {
 *    subclass, never on this class.
 *
 * The class is deliberately NOT `markNonRetryable` at construction, unlike
-* {@link ResourceUpdateNotSupportedError}: EXACTLY ONE of its throw sites is
+* {@link ResourceUpdateNotSupportedError}: two kinds of throw site are
 * genuinely time-dependent — the fabricated-account guard, where
 * `getAccountInfo` caches a fabricated answer for only 10s precisely so a
-* later attempt can heal — so a constructor-level marker would wrongly make
-* that one terminal. Every OTHER site marks at its own `throw`: each
+* later attempt can heal, and since issue #3096 the LIVE-READ refusals
+* (`refuseUnservedAttribute`), where a `pending` instance settles seconds
+* later and a failed describe can succeed on the next attempt — so a
+* constructor-level marker would wrongly DECLARE those terminal (whether
+* `withRetry` then retries one is the classifiers' call, and that helper's
+* doc comment says what they actually see). Every OTHER
+* site marks at its own `throw` (the #3096 `DBProxy` `VpcId` refusal
+* included — it has no live read, so it decides from the record alone): each
 * decides from inputs a retry cannot change (a persisted state record, an
 * attribute-name suffix, a CLI flag, an already-resolved value's type, a
 * template's literal `RoleArn`, a child stack's declared output names), and
@@ -12731,7 +12745,13 @@ const STATE_SOURCED_READBACK_RULES = {
 * `observedProperties`, where a mask is a REGRESSION rather than a refusal
 * (`cdkd export` blocks such a record and the rollback replay refuses the
 * operation). A caller declares this constant when it knows its bag becomes a
-* drift baseline and nothing else.
+* drift baseline and nothing else — and since issue
+* [#2939](https://github.com/go-to-k/cdkd/issues/2939) the two `cdkd drift`
+* writers make that call per record: `--accept`'s new baseline and
+* `--revert`'s narrowed delta take THIS constant when the record carries
+* `observedProperties` (the bag lands there) and
+* {@link STATE_SOURCED_READBACK_RULES} otherwise (the bag lands in
+* `properties`), the *** rows of the write-site table above.
 */
 const STATE_SOURCED_BASELINE_RULES = {
 	descendArrays: false,
@@ -12944,7 +12964,8 @@ function isPlainObject$2(value) {
 }
 /**
 * Stands in for a source part the skeleton cannot know — an `Fn::Join` element
-* that is itself an intrinsic, or an `Fn::Sub` `${...}` variable.
+* that is itself an intrinsic or any other non-scalar or `null` part (see
+* {@link joinPartLiteralText}), or an `Fn::Sub` `${...}` variable.
 *
 * Built from {@link DYNAMIC_REFERENCE_INNER_CHAR} rather than `.` because a
 * recorded expression's INNER text never contains `}`: the resolver matches
@@ -13013,7 +13034,7 @@ const MAX_SKELETON_CANDIDATE_LENGTH = 512;
 * between them. Measured on a ~120-char candidate, before the collapse:
 * 4 adjacent wildcards 39ms, 5 ~1s, 6 20s, 8 did not finish in two minutes. Two
 * legal CFn shapes CDK can emit produce ADJACENT ones — an `Fn::Join` with an
-* EMPTY delimiter and consecutive non-string parts, and an `Fn::Sub` with
+* EMPTY delimiter and consecutive intrinsic (or `null`) parts, and an `Fn::Sub` with
 * adjacent `${a}${b}` variables — and the collapse takes both to a single
 * wildcard. It does NOT close the class, which is why the cap exists beside it.
 *
@@ -13095,7 +13116,8 @@ function anchoredSkeletonPattern(segments) {
 }
 /**
 * A source part the skeleton cannot know — an `Fn::Join` element that is
-* itself an intrinsic, or an `Fn::Sub` `${...}` variable. The segment form of
+* itself an intrinsic or any other non-scalar or `null` part (see
+* {@link joinPartLiteralText}), or an `Fn::Sub` `${...}` variable. The segment form of
 * {@link SKELETON_WILDCARD}: what a part IS, before {@link anchoredSkeletonPattern}
 * — the one speller — turns it into the wildcard.
 */
@@ -13112,13 +13134,51 @@ const UNKNOWN_PART = Symbol("unknown intrinsic part");
 */
 const UNKNOWN_PART_PLACEHOLDER = "\0";
 /**
+* The literal text an `Fn::Join` PART contributes, or `undefined` when the
+* part is not knowable from the template (issue #3055).
+*
+* The resolver joins every part as `String(await resolveValue(part))`, and
+* `resolveValue` returns a NUMBER or BOOLEAN unchanged, so such a part
+* contributes exactly `String(part)` -- `8080` joins as `8080`, `true` as
+* `true`. A string part is its raw text here as it always was (a
+* `{{resolve:` inside it is the token the readers look for, not text this
+* function resolves). Reading only strings as literal made the other two a
+* wildcard for the skeleton arm (a candidate differing at that position could
+* match) and a placeholder for the frame arm (whose rendered frame then no
+* longer equals the leaf's text around the middle, so the arm refuses) -- and,
+* through the frame arm's rewrite, for the nested-stack parameter recorder's
+* `frameSpellingOf`, which carries a framed parameter to the child only when
+* that arm wrote it. The recorder's own rendering of such a part does not
+* decide the case: a part outside the token leaves its one span and service
+* prefix the same either way.
+*
+* `null` stays unknowable although the resolver would join it as `null`, as it
+* was before this function existed: it is not a part a CloudFormation template
+* can carry meaningfully. Being a wildcard, it can still let the skeleton arm
+* match a lone candidate spelling something else at that position -- the
+* arm's existing wrong-reference residual, not narrowed here. The literal
+* reading reaches that same residual in a few more places: a source that left
+* two candidates matching as a wildcard can now leave ONE, which the arm
+* accepts even when the leaf's own reference was never recorded (a public
+* `ssm` parameter). An object or array part (an intrinsic, a list, or any
+* other object) stays {@link UNKNOWN_PART}.
+*/
+function joinPartLiteralText(part) {
+	if (typeof part === "string") return part;
+	if (typeof part === "number" || typeof part === "boolean") return String(part);
+}
+/**
 * The text of an `Fn::Join` / `Fn::Sub` source in order: a literal part as its
-* RAW text, an unknowable part as {@link UNKNOWN_PART}. ONE parser for the two
+* RAW text (a number or boolean `Fn::Join` part as the text the resolver joins
+* it as, {@link joinPartLiteralText}), an unknowable part as
+* {@link UNKNOWN_PART}. ONE parser for the three
 * readers of that shape — {@link intrinsicSkeletonPattern}, which hands every
-* segment to {@link anchoredSkeletonPattern} to spell as a regex, and
+* segment to {@link anchoredSkeletonPattern} to spell as a regex,
 * {@link positionByIntrinsicFrame}, which needs the
-* literal text VERBATIM to know where a token's frame begins and ends — so
-* the two cannot disagree about what a source says (issue #2745).
+* literal text VERBATIM to know where a token's frame begins and ends, and
+* `frameSpellingOf` in {@link recordNestedStackParameterExpressions}, which
+* renders the same text to find the token a carried frame spells — so
+* they cannot disagree about what a source says (issues #2745, #3062).
 *
 * `undefined` for any source this cannot describe, per the pattern reader's
 * doc: a delimiter that is itself an intrinsic, a non-array `Fn::Join`, a
@@ -13136,7 +13196,7 @@ function intrinsicSkeletonSegments(source) {
 		const segments = [];
 		parts.forEach((part, index) => {
 			if (index > 0) segments.push(delimiter);
-			segments.push(typeof part === "string" ? part : UNKNOWN_PART);
+			segments.push(joinPartLiteralText(part) ?? UNKNOWN_PART);
 		});
 		return segments;
 	}
@@ -13390,9 +13450,10 @@ function positionByCrossStackSource(bag, source, secrets) {
 *
 * One residual is worth naming rather than leaving to be rediscovered: a single
 * WRONG candidate can win only when this leaf's own expression is in NEITHER
-* store — which is exactly an `ssm` reference whose `Type` came back
-* unclassifiable (deliberately unpinned per #1901) and which then lost the
-* value collapse. `recordedSecretExpressions` is process-wide, so the winner
+* store — an `ssm` reference whose `Type` came back unclassifiable
+* (deliberately unpinned per #1901) and which then lost the value collapse, or
+* a PUBLIC `ssm` reference (stored resolved, #1901) whose value coincides with
+* a recorded secret's plaintext. `recordedSecretExpressions` is process-wide, so the winner
 * could in principle come from another resource, and condition 3 cannot refuse
 * one the pass never recorded.
 *
@@ -13401,7 +13462,7 @@ function positionByCrossStackSource(bag, source, secrets) {
 * `resolveReplayProps` RE-RESOLVES the persisted expression against AWS and
 * hands the result to `provider.update`, so a rollback replays the wrong secret
 * — immediately, if the two references already resolve to different values. It
-* is narrow (unclassifiable-`ssm` leaves only) but it is not cosmetic, and an
+* is narrow (unclassifiable or public `ssm` leaves only) but it is not cosmetic, and an
 * earlier draft of this paragraph called it "a spurious UPDATE rather than a
 * disclosure", which understated it.
 *
@@ -16981,6 +17042,7 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * releases. Neither counter feeds a control decision; they are reporting only.
 */
 async function withRetry(operation, logicalId, opts = {}) {
+	const shownId = displaySafe(logicalId, { asciiOnly: true }) || "<unrenderable>";
 	const maxRetries = opts.maxRetries ?? 8;
 	const initialDelayMs = opts.initialDelayMs ?? 1e3;
 	const maxDelayMs = opts.maxDelayMs ?? 8e3;
@@ -17014,7 +17076,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 				if (propagationRetries > 0) spent.push(`${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""}`);
 				if (nameCooldownRetries > 0) spent.push(`${nameCooldownRetries} name-cooldown ${nameCooldownRetries === 1 ? "retry" : "retries"} over ${(nameCooldownSleptMs / 1e3).toFixed(2)}s waiting for the name to be released${nameCooldownBudgetExhausted ? " (the full name-cooldown budget)" : ""}`);
 				if (serverErrorRetries > 0) spent.push(`${serverErrorRetries} transient server-error ${serverErrorRetries === 1 ? "retry" : "retries"} (HTTP 5xx)`);
-				const summary = () => `${logicalId}: gave up after ${spent.join(" and ")} - ${message}` + formatRetryClassificationSignals(error);
+				const summary = () => `${shownId}: gave up after ${spent.join(" and ")} - ${message}` + formatRetryClassificationSignals(error);
 				try {
 					opts.logger?.warn?.(summary());
 				} catch {}
@@ -17023,7 +17085,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 		}
 		const delay = propagation ? Math.min(250 * Math.pow(2, attempt), IAM_PROPAGATION_MAX_DELAY_MS) : nameCooldown ? Math.min(NAME_COOLDOWN_INITIAL_DELAY_MS * Math.pow(2, attempt), NAME_COOLDOWN_MAX_DELAY_MS) : Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
 		const backoffThroughThisAttemptMs = propagation ? propagationSleptMs + delay : propagationSleptMs;
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}${propagation ? `, ${(backoffThroughThisAttemptMs / 1e3).toFixed(2)}s backoff through this attempt` : ""}) - ${message}`);
+		opts.logger?.debug(`  ⏳ Retrying ${shownId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}${propagation ? `, ${(backoffThroughThisAttemptMs / 1e3).toFixed(2)}s backoff through this attempt` : ""}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
 			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
 			await sleep(Math.min(1e3, delay - waited));
@@ -20675,14 +20737,17 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 * up the assumed-role credentials automatically without touching the
 * client construction sites.
 *
-* **Why cdkd needs admin-equivalent on the assumed role.** Unlike `cdk
-* deploy`, cdkd does NOT route through CloudFormation. There is no
-* cfn-exec-role to delegate to. Every IAM / EC2 / Lambda / etc. API
-* call is issued from the cdkd process directly. The role you pass to
-* `--role-arn` (or set in `CDKD_ROLE_ARN`) MUST therefore have
-* admin-equivalent permissions on the resources being deployed; CDK
-* CLI's `cdk-hnb659fds-deploy-role-*` is NOT sufficient — that role
-* only carries CFn + asset-publish permissions.
+* **What the assumed role must carry.** Unlike `cdk deploy`, cdkd does
+* NOT route through CloudFormation. There is no cfn-exec-role to
+* delegate to. Every IAM / EC2 / Lambda / etc. API call is issued from
+* the cdkd process directly. The role you pass to `--role-arn` (or set
+* in `CDKD_ROLE_ARN`) must therefore carry the actions for the resource
+* types being deployed plus cdkd's own bookkeeping set (Cloud Control,
+* `cloudformation:DescribeType` / `ListExports` / `DescribeStacks`,
+* `sts:GetCallerIdentity`, the state and asset storage) — i.e. exactly what the
+* caller's own principal would otherwise have needed, not
+* `AdministratorAccess`. CDK CLI's `cdk-hnb659fds-deploy-role-*` is NOT
+* sufficient — that role only carries CFn + asset-publish permissions.
 *
 * Default session duration is 1 hour. For longer-running deploys, the
 * caller should re-issue the cdkd command (the in-flight credentials
@@ -22663,6 +22728,36 @@ var WAFv2WebACLProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/ec2-instance-state.ts
+/**
+* The ONE spelling of "has this EC2 instance SETTLED?" (issue
+* [#3096](https://github.com/go-to-k/cdkd/issues/3096) review).
+*
+* Two readers must agree on it or a record and a resolution disagree about
+* the same instance: `EC2Provider`'s `describedInstanceAttributes` decides
+* whether a missing public member is RECORDED as the known `''` (settled) or
+* OMITTED (still `pending`, issue #3077), and the resolver's
+* `AWS::EC2::Instance` live arm decides, for an omitted member, whether to
+* SERVE that same `''` or REFUSE. Each carried the comparison inline; this
+* module is the shared predicate so a change to one side cannot leave the
+* other on the old rule.
+*
+* `pending` is the only state in which EC2 has not finished assigning the
+* launch-time members; every other reported state — `running`, `stopping`,
+* `stopped`, `shutting-down`, `terminated` — is a settled one whose public
+* pair, when absent, is genuinely absent (a private-subnet instance, or a
+* stopped one whose address was released). NO state at all is treated like
+* `pending`: a read-back that returned no instance, or a shape without one,
+* says nothing about having settled.
+*
+* A LEAF: no imports, so both `src/provisioning/**` and `src/deployment/**`
+* can take it without adding an edge between the two layers.
+*/
+function isSettledInstanceState(stateName) {
+	return stateName !== void 0 && stateName !== "pending";
+}
+
 //#endregion
 //#region src/deployment/intrinsic-function-resolver.ts
 /**
@@ -23195,6 +23290,19 @@ function withoutProducerRegions(context) {
 	return rest;
 }
 /**
+* Masked log twins registered this pass, per pass bag (issue #3100;
+* `rememberLogTwin` / `logTwinOfProduct`). Log-only: nothing that resolves or
+* persists a value reads it.
+*
+* MODULE scope, not instance scope: a region-pinned sibling resolver
+* (`resolverForProducerRegion`) resolves on behalf of the consumer with the
+* consumer's bag, so an instance-local registry left the sibling's twin where
+* the consumer's `Fn::Join` / `Fn::Sub` never looked. The key is still the
+* pass's own bag object, so scope does not widen: another pass holds another
+* bag and cannot reach these entries, and they die with the bag.
+*/
+const LOG_TWINS_BY_PASS = /* @__PURE__ */ new WeakMap();
+/**
 * Does `value` carry a CloudFormation dynamic reference anywhere inside it?
 *
 * Used as the identity fast path of {@link
@@ -23313,10 +23421,37 @@ const recordedSecretExpressions = {
 * lookup (PrivateIp / PublicIp / PrivateDnsName / PublicDnsName /
 * AvailabilityZone). Keyed by `${physicalId}#${attributeName}`. The IP /
 * DNS attributes are not derivable from the instance id, so they are read
-* back from AWS once per (instance, attribute) and memoized for the deploy
-* lifetime.
-*/
-const cachedEc2InstanceAttributes = {};
+* back from AWS once per (instance, attribute) and memoized for the PROCESS
+* lifetime — one `cdkd deploy` per CLI process, so "the deploy" in practice;
+* nothing in `src/` calls `resetAccountInfoCache`, tests do. Only a VALUE is cached — a settled instance's address, or the
+* known-empty `''` a settled instance reports for a public member it has
+* none of — never a refusal: a `pending` instance is re-described on the
+* next resolution, when it may have settled (issue #3096).
+*/
+const cachedEc2InstanceAttributes = Object.create(null);
+/**
+* The two sibling caches of {@link cachedEc2InstanceAttributes} (issue
+* #3096), each holding a value the resolver read LIVE because the state
+* record omitted it — `definedAttributes` drops a member the provider could
+* not read back (issue #3077), so the `Fn::GetAtt` falls out of the flat
+* lookup and into `constructAttribute`'s per-type arm. Keyed by physical id
+* (AWS-minted, unique across accounts and regions, and the value — a default
+* security group id, a distribution hostname — never changes); like the
+* instance cache, a refusal caches nothing. Same process lifetime, cleared
+* together with it by {@link resetAccountInfoCache}. The RDS `DBProxy` / `DBProxyEndpoint`
+* `VpcId` arms have no cache because they have no live read: `AwsClients`
+* exposes no RDS client and this file imports none, so those two arms refuse
+* outright (see `refuseUnservedAttribute`'s callers).
+*
+* All three are NULL-PROTOTYPE objects (#3096 delta review, measured): the
+* key is a state-record physical id, and on a plain `{}` a record holding
+* `constructor` / `__proto__` / `hasOwnProperty` read a FUNCTION out of
+* `Object.prototype` as the cached value — served with zero AWS calls, ahead
+* of every shape guard below. `Object.create(null)` has nothing to read; the
+* `delete`-based clears in `resetAccountInfoCache` keep the prototype.
+*/
+const cachedVpcDefaultSecurityGroups = Object.create(null);
+const cachedCloudFrontDomainNames = Object.create(null);
 /**
 * The region this call answers for: the caller's override, else the ambient one.
 *
@@ -25228,7 +25363,44 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return [];
 			}
-			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
+			case "DefaultSecurityGroup": {
+				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
+				const cachedGroupId = cachedVpcDefaultSecurityGroups[physicalId];
+				if (cachedGroupId !== void 0) return cachedGroupId;
+				let groupId;
+				try {
+					groupId = (await this.clientsForRegion(this.explicitRegion).ec2.send(new DescribeSecurityGroupsCommand({ Filters: [{
+						Name: "vpc-id",
+						Values: [physicalId]
+					}, {
+						Name: "group-name",
+						Values: ["default"]
+					}] }))).SecurityGroups?.[0]?.GroupId;
+				} catch (err) {
+					this.refuseUnservedAttribute({
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: this.describeFailureObserved("DescribeSecurityGroups", err, context),
+						remedy: "Fix the read (the vpc-id / group-name filtered DescribeSecurityGroups permission, or the region) and deploy again."
+					});
+				}
+				if (groupId) {
+					cachedVpcDefaultSecurityGroups[physicalId] = groupId;
+					return groupId;
+				}
+				this.refuseUnservedAttribute({
+					logicalId,
+					attributeName,
+					resourceType,
+					physicalId,
+					context,
+					observed: "DescribeSecurityGroups found no group named \"default\" in the VPC",
+					remedy: "Check the VPC in the console, or reference the attribute from a later deploy."
+				});
+			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
@@ -25423,9 +25595,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const cacheKey = `${physicalId}#${attributeName}`;
 				const cached = cachedEc2InstanceAttributes[cacheKey];
 				if (cached !== void 0) return cached;
+				let value;
+				let stateName;
 				try {
 					const instance = (await this.clientsForRegion(this.explicitRegion).ec2.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
-					let value;
+					stateName = instance?.State?.Name;
 					switch (attributeName) {
 						case "PrivateIp":
 							value = instance?.PrivateIpAddress;
@@ -25441,15 +25615,36 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 							break;
 						case "AvailabilityZone": value = instance?.Placement?.AvailabilityZone;
 					}
-					if (value !== void 0 && value !== null && value !== "") {
-						cachedEc2InstanceAttributes[cacheKey] = value;
-						return value;
-					}
-					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${this.maskSecretsForLog(attributeName, context)}; returning physical ID`);
 				} catch (err) {
-					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
+					this.refuseUnservedAttribute({
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: this.describeFailureObserved("DescribeInstances", err, context),
+						remedy: "Fix the read (the ec2:DescribeInstances permission, or the region) and deploy again."
+					});
 				}
-				return physicalId;
+				if (value !== void 0 && value !== null && value !== "") {
+					cachedEc2InstanceAttributes[cacheKey] = value;
+					return value;
+				}
+				const settled = isSettledInstanceState(stateName);
+				if (settled && (attributeName === "PublicIp" || attributeName === "PublicDnsName")) {
+					cachedEc2InstanceAttributes[cacheKey] = "";
+					return "";
+				}
+				const observedState = stateName === void 0 ? "no instance state" : `state ${stateName}`;
+				this.refuseUnservedAttribute({
+					logicalId,
+					attributeName,
+					resourceType,
+					physicalId,
+					context,
+					observed: `DescribeInstances reports no ${this.maskSecretsForLog(attributeName, context)} yet (${observedState})`,
+					remedy: settled ? "Check the instance in the console; a terminated or stopped instance has no such attribute to serve." : "Deploy without --no-wait so the instance is running before its attributes are read, or reference the attribute from a later deploy once it is."
+				});
 			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
@@ -25467,9 +25662,115 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (attributeName === "LaunchTemplateId") return physicalId;
 			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
+		if (resourceType === "AWS::CloudFront::Distribution") switch (attributeName) {
+			case "Id": return physicalId;
+			case "DomainName": {
+				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
+				const cachedDomainName = cachedCloudFrontDomainNames[physicalId];
+				if (cachedDomainName !== void 0) return cachedDomainName;
+				let domainName;
+				try {
+					domainName = (await this.clientsForRegion(this.explicitRegion).cloudFront.send(new GetDistributionCommand({ Id: physicalId }))).Distribution?.DomainName;
+				} catch (err) {
+					this.refuseUnservedAttribute({
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: this.describeFailureObserved("GetDistribution", err, context),
+						remedy: "Fix the read (the cloudfront:GetDistribution permission) and deploy again."
+					});
+				}
+				if (domainName) {
+					cachedCloudFrontDomainNames[physicalId] = domainName;
+					return domainName;
+				}
+				this.refuseUnservedAttribute({
+					logicalId,
+					attributeName,
+					resourceType,
+					physicalId,
+					context,
+					observed: "GetDistribution reports no DomainName",
+					remedy: "Check the distribution in the console, or reference the attribute from a later deploy."
+				});
+			}
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
+		}
+		if (resourceType === "AWS::RDS::DBProxy" || resourceType === "AWS::RDS::DBProxyEndpoint") {
+			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
+		}
 		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 	}
 	/**
+	* Refuse an attribute the state record omits and a live read could not
+	* serve (issue [#3096](https://github.com/go-to-k/cdkd/issues/3096)).
+	*
+	* The arms that call this all share one shape: the provider recorded no
+	* value because AWS had not assigned one yet or the read-back failed (issue
+	* #3077 made the key ABSENT rather than `''`), the resolver re-reads it
+	* live, and the read finds nothing — or fails. Before #3096 every such arm
+	* answered the PHYSICAL ID: an `i-...` where an IP address or a DNS name
+	* belongs, a `vpc-...` in a security-group slot, a distribution id where a
+	* hostname belongs, a proxy name in a `VpcId` position. Loud only where AWS
+	* rejects the shape; an Output, an export or a free-text property carried it
+	* silently. The physical id can never be the value for these attributes,
+	* so the honest answer is a refusal naming the resource, the attribute, what
+	* was observed and the remedy.
+	*
+	* DELIBERATELY NOT `markNonRetryable`, unlike every other refusal in this
+	* file but the fabricated-account guard: the verdict is TIME-DEPENDENT. A
+	* `pending` instance settles seconds later, and a failed describe can
+	* succeed on the next attempt, so cdkd must not DECLARE it terminal — the
+	* marker is that declaration, and `withRetry` honours it ahead of every
+	* classifier. Leaving it off promises no retry: `isRetryableTransientError`
+	* reads throttle names and HTTP statuses off the `cause` chain — which this
+	* refusal deliberately does not carry, see below — and everything else by
+	* message substring, and this message matches nothing on its own. So the
+	* nested-stack replay (`NestedStackProvider.create` runs the child deploy
+	* inside the parent's `withRetry`) re-runs the child only when an
+	* interpolated hole happens to carry a pattern — the `logicalId` (the #1838
+	* hazard: `DependencyViolation` and two other bare words), or the error
+	* CLASS name `describeFailureObserved` puts in `observed`, which none of
+	* these three reads raises — and then re-describes and can heal.
+	* Measured, not designed: the fabricated-account guard sits in exactly the
+	* same place. Threading a sanitized SDK error as `cause` so a throttled
+	* describe classifies as transient was considered and left out — a
+	* `CdkdError`'s `cause` is rendered at default verbosity by `formatError`
+	* (`Caused by:`), so the clone would need its own fence. What the
+	* refusal does at each consumer: a resource property fails the resource; a
+	* stack Output is caught per-output by `DeployEngine.
+	* handleOutputResolutionFailure`, skipped and recorded in `skippedOutputs`
+	* (#2740), then re-resolved on the next deploy; an `Fn::Sub` re-raises it
+	* (#1740); a `Conditions` entry still absorbs it to `false`
+	* (`evaluateConditions`).
+	*
+	* `observed` and `remedy` are cdkd-authored sentences built by the caller
+	* from an instance STATE name, an error CLASS name or a fixed phrase — never
+	* AWS's raw message, which `describeFailureObserved` keeps at debug (the
+	* per-reader rule in `.claude/rules/provider-resource-identity.md`: a
+	* denied describe quotes the caller's account, role and session).
+	*/
+	refuseUnservedAttribute(site) {
+		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is not a usable ${this.maskSecretsForLog(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+	}
+	/**
+	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
+	* that THREW: names the read and the error's CLASS at default verbosity and
+	* puts AWS's own text behind `--verbose`, since a denied describe quotes the
+	* caller's account, role and session into its message.
+	*/
+	describeFailureObserved(read, err, context) {
+		const name = displaySafe(err instanceof Error && err.name ? err.name : "Error", { asciiOnly: true }).slice(0, 64).trim() || "Error";
+		const status = err?.$metadata?.httpStatusCode;
+		const errorClass = typeof status === "number" && Number.isInteger(status) ? `${name}, HTTP ${status}` : name;
+		this.logger.debug(`${read} failed (${errorClass}): ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
+		return `${read} failed (${errorClass}); re-run with --verbose for the AWS error text`;
+	}
+	/**
 	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
 	*
 	* Applied by BOTH the final unknown-type fallback of
@@ -25501,9 +25802,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${this.maskSecretsForLog(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
@@ -25518,12 +25819,36 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
-		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
-			const resolved = await this.resolveValue(v, context);
-			return String(resolved);
-		}), (pending) => this.warnAbandonedParts(pending))).join(delimiter);
-		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
-		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(result, context)}`);
+		const literalList = Array.isArray(rawValues);
+		const parts = (await allSettledKeepingFirstRejection(values.map(async (v) => {
+			if (typeof v === "string") return {
+				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, v, context) : {
+					result: v,
+					twin: v
+				},
+				product: !literalList
+			};
+			const raw = await this.resolveValue(v, context);
+			const resolved = String(raw);
+			return {
+				result: resolved,
+				twin: resolved,
+				product: true,
+				raw: { value: raw }
+			};
+		}), (pending) => this.warnAbandonedParts(pending))).map((part) => {
+			if (!part.product) return part;
+			if (part.raw) return {
+				result: part.result,
+				twin: this.productLogTwin(part.raw.value, context)
+			};
+			return this.logTwinOfProduct(part, context);
+		});
+		let result = parts.map((part) => part.result).join(delimiter);
+		let twin = parts.map((part) => part.twin).join(delimiter);
+		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		this.rememberLogTwin(context, result, twin);
+		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
 	}
 	/**
@@ -25666,11 +25991,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSub(subArgs, context) {
 		let template;
 		const variables = Object.create(null);
+		const variableTwins = Object.create(null);
 		if (Array.isArray(subArgs)) {
 			const [templateString, variableMap] = subArgs;
 			template = templateString;
 			if (typeof variableMap !== "object" || variableMap === null) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Sub: the second element must be a variable map, got ${variableMap === null ? "null" : typeof variableMap}`));
-			for (const [key, val] of Object.entries(variableMap)) variables[key] = await this.resolveValue(val, context);
+			for (const [key, val] of Object.entries(variableMap)) if (typeof val === "string") {
+				const resolved = val.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(val, val, context) : {
+					result: val,
+					twin: val
+				};
+				variables[key] = resolved.result;
+				variableTwins[key] = resolved.twin;
+			} else variables[key] = await this.resolveValue(val, context);
 		} else template = subArgs;
 		const replacements = [];
 		const matches = template.matchAll(/\$\{(!)?([^}]*)\}/g);
@@ -25678,31 +26011,39 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const isEscaped = match[1] === "!";
 			const varNameStr = match[2];
 			if (isEscaped) {
+				const escapedLiteral = `\${${varNameStr ?? ""}}`;
 				replacements.push({
 					match: match[0],
-					replacement: `\${${varNameStr ?? ""}}`
+					replacement: escapedLiteral,
+					twin: escapedLiteral
 				});
 				continue;
 			}
 			if (!varNameStr) {
 				replacements.push({
 					match: match[0],
-					replacement: match[0]
+					replacement: match[0],
+					twin: match[0]
 				});
 				continue;
 			}
 			let replacement;
-			if (varNameStr in variables) replacement = String(variables[varNameStr]);
-			else {
+			let twinReplacement;
+			if (varNameStr in variables) {
+				replacement = String(variables[varNameStr]);
+				twinReplacement = varNameStr in variableTwins ? variableTwins[varNameStr] : this.productLogTwin(variables[varNameStr], context);
+			} else {
 				const pseudoValue = await this.resolvePseudoParameter(varNameStr, context);
 				if (pseudoValue !== void 0) replacement = String(pseudoValue);
 				else try {
 					const value = await this.resolveRef(varNameStr, context);
 					replacement = String(value);
+					twinReplacement = this.productLogTwin(value, context);
 				} catch (refError) {
 					if (varNameStr.includes(".")) try {
 						const value = await this.resolveGetAtt(varNameStr, context);
 						replacement = String(value);
+						twinReplacement = this.productLogTwin(value, context);
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
@@ -25719,7 +26060,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			replacements.push({
 				match: match[0],
-				replacement
+				replacement,
+				twin: twinReplacement ?? replacement
 			});
 		}
 		let cursor = 0;
@@ -25727,8 +26069,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const entry = replacements[cursor++];
 			return entry ? entry.replacement : whole;
 		});
-		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
-		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(result, context)}`);
+		let twinCursor = 0;
+		let twin = template.replace(/\$\{(!)?([^}]*)\}/g, (whole) => {
+			const entry = replacements[twinCursor++];
+			return entry ? entry.twin : whole;
+		});
+		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		this.rememberLogTwin(context, result, twin);
+		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
 	}
 	/**
@@ -25890,7 +26238,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 		}
 		const result = resolvedValue.split(delimiter);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
+		const pieceTwins = this.splitLogTwins(resolvedValue, delimiter, result, context);
+		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(pieceTwins, context))}`);
 		return result;
 	}
 	/**
@@ -26651,8 +27000,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
-		if (context.recordedSecretValues && this.maskSecretsForLog(resolvedValue, context) !== resolvedValue) recordMaskOnlyValue(context.recordedSecretValues, result);
-		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(resolvedValue, context)} -> ${this.maskSecretsForLog(result, context)}`);
+		const inputLogText = this.logTextOfLeaf(resolvedValue, context);
+		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskSecretsForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
+		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(inputLogText, context)} -> ${this.maskSecretsForLog(inputLogText !== resolvedValue ? "***" : result, context)}`);
 		return result;
 	}
 	/**
@@ -26757,6 +27107,155 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return masked;
 	}
 	/**
+	* Is `value` WHOLE a secret either bag holds (issue #3100)? Asked of a
+	* resolution PRODUCT only — never of a template literal — so an exact match
+	* at any length is a verdict about what was written, not a floorless needle.
+	*/
+	isRecordedSecretForLog(value, context) {
+		return context?.recordedSecretValues?.has(value) === true || context?.inheritedSecrets?.has(value) === true;
+	}
+	/**
+	* The text a `Resolved Fn::Join:` / `Resolved Fn::Sub:` line prints (issue
+	* #3100): the twin through the needle mask — unless the needle mask ALSO
+	* fires on the value itself, in which case the whole line is masked. The
+	* twin splits the text at the spans it masked, so a 4+ character recorded
+	* secret that overlaps one of them (or IS the whole value) is no longer a
+	* contiguous needle in the twin, and masking the twin alone would print the
+	* part of it outside the span. The value's own needle mask cannot be merged
+	* with the twin's positions, so the line gives both up for `***`: never
+	* more text than either mask alone would print. Returns the text BEFORE the
+	* needle mask; each log line wraps it in `maskSecretsForLog` itself, so the
+	* resolver's mask-coverage checker sees a masker at the site.
+	*/
+	logTwinText(result, twin, context) {
+		return twin !== result && this.maskSecretsForLog(result, context) !== result ? "***" : twin;
+	}
+	/**
+	* The log twins of `Fn::Split`'s pieces (issue #3100), each registered for
+	* the pass so an outer `Fn::Join` over the pieces keeps the mask. A source
+	* that is itself a recorded or inherited secret counts as a twin of `***`;
+	* a source with neither is its pieces' own twin.
+	*
+	* The source's twin is split by the same delimiter. When both splits give
+	* the same number of pieces they are paired by position; when they do not —
+	* a secret carrying the delimiter, or a delimiter that occurs in the mask
+	* itself — no pairing can be trusted, so every piece is masked whole. Every
+	* masked piece is registered by VALUE, so an equal string elsewhere in the
+	* pass is masked too: the over-masking direction `logTwinOfProduct` accepts.
+	*/
+	splitLogTwins(value, delimiter, pieces, context) {
+		const bag = this.logTwinBag(context);
+		const sourceTwin = this.isRecordedSecretForLog(value, context) ? "***" : bag ? LOG_TWINS_BY_PASS.get(bag)?.get(value) : void 0;
+		if (sourceTwin === void 0) return pieces;
+		const twinPieces = sourceTwin.split(delimiter);
+		const aligned = twinPieces.length === pieces.length && !"***".includes(delimiter);
+		return pieces.map((piece, index) => {
+			const twin = this.logTwinText(piece, aligned ? twinPieces[index] ?? "***" : "***", context);
+			this.rememberLogTwin(context, piece, twin);
+			return twin;
+		});
+	}
+	/**
+	* The log twin of a resolution product as `String(value)` renders it (issue
+	* #3100). A LIST is stringified element by element exactly as
+	* `Array.prototype.join` does (`null` / `undefined` as the empty string,
+	* nested lists recursively, comma-separated), so each element keeps its own
+	* twin: `String()` over the whole list produced a string no registered twin
+	* matched. No cycle guard: a product is JSON-sourced state or a fresh
+	* resolution result, and neither can hold a self-referencing list.
+	*/
+	productLogTwin(value, context) {
+		if (Array.isArray(value)) return value.map((element) => element === null || element === void 0 ? "" : this.productLogTwin(element, context)).join(",");
+		const text = String(value);
+		return this.logTwinOfProduct({
+			result: text,
+			twin: text
+		}, context).twin;
+	}
+	/**
+	* The pre-mask log text of a string LEAF a debug line prints (issue #3100):
+	* the leaf treated as a resolution product — masked whole when it is a
+	* recorded secret, otherwise the masked twin this pass registered for it —
+	* and then `logTwinText`'s whole-line guard. The caller still wraps the
+	* result in `maskSecretsForLog`. Shared by every caller of `maskValueLeaves`
+	* (the `Fn::Select`, `Fn::Split`, `Fn::Equals`, `Fn::FindInMap`,
+	* `Fn::GetAZs` and `Fn::Cidr` lines and the VPC `Ipv6CidrBlocks` line among
+	* them) and by the `Fn::Base64` line, so a string one
+	* write already masked by position is not printed in the clear by the next
+	* intrinsic that logs it. `maskValueLeaves` also masks values interpolated
+	* into THROWN messages (the `Fn::Cidr` argument refusals, for one), so those
+	* messages take the same position mask: a short secret an earlier write put
+	* into the value is `***` there too, the direction the mask at the throw
+	* already takes for a whole secret.
+	*/
+	logTextOfLeaf(value, context) {
+		return this.logTwinText(value, this.logTwinOfProduct({
+			result: value,
+			twin: value
+		}, context).twin, context);
+	}
+	/** The bag a pass's log twins are keyed by (issue #3100): the recorded one, else the inherited one. */
+	logTwinBag(context) {
+		return context?.recordedSecretValues ?? context?.inheritedSecrets;
+	}
+	/**
+	* The log twin of a RESOLUTION PRODUCT — an intrinsic part, variable or
+	* placeholder — for issue #3100. Masked whole when its value is a recorded
+	* secret. Otherwise a part that carries no mask of its own takes the masked
+	* twin an earlier write of this pass registered for that exact string
+	* (`rememberLogTwin`) — how a Join part that is itself an `Fn::Sub`, or a
+	* `Fn::Select` over a reference-bearing string, keeps the inner mask. A part
+	* whose OWN masked twin disagrees with the registered one (a list element
+	* still spelling a reference) is masked whole, since the two span sets
+	* cannot be merged; one that agrees keeps its twin.
+	*
+	* The registry is keyed by VALUE, so a product equal to a registered string
+	* from another provenance takes its mask too. That over-masks a line whose
+	* text holds a recorded secret at a position some write in this pass put
+	* one. The registry holds masked twins only, so a lookup never unmasks.
+	*
+	* The whole-secret check reads the bags as they stand when the product is
+	* placed, before the enclosing Join / Sub runs its final substitution. A
+	* secret that substitution records is therefore not matched against an
+	* earlier product equal to it. Such a product did not come from that secret:
+	* a parameter holding one arrives in the inherited bag before its `Ref`
+	* resolves, so what stays printed is a public value that coincides with it.
+	*/
+	logTwinOfProduct(part, context) {
+		if (this.isRecordedSecretForLog(part.result, context)) return {
+			result: part.result,
+			twin: "***"
+		};
+		const bag = this.logTwinBag(context);
+		const registered = bag ? LOG_TWINS_BY_PASS.get(bag)?.get(part.result) : void 0;
+		if (registered === void 0 || registered === part.twin) return part;
+		return {
+			result: part.result,
+			twin: part.twin === part.result ? registered : "***"
+		};
+	}
+	/**
+	* Register a MASKED `twin` as the log twin of `result` for this pass (issue
+	* #3100). An unmasked twin is not registered, so a later literal that
+	* resolves to the same string cannot replace an earlier write's mask, and
+	* two DIFFERENT masked twins for one string register `***` for the whole
+	* string, since their spans cannot be merged. Scoped to the pass's bag
+	* through a `WeakMap`, like the cross-stack associations, so it dies with
+	* the bag and another pass's strings cannot be reached.
+	*/
+	rememberLogTwin(context, result, twin) {
+		if (twin === result) return;
+		const bag = this.logTwinBag(context);
+		if (!bag) return;
+		let twins = LOG_TWINS_BY_PASS.get(bag);
+		if (!twins) {
+			twins = /* @__PURE__ */ new Map();
+			LOG_TWINS_BY_PASS.set(bag, twins);
+		}
+		const existing = twins.get(result);
+		twins.set(result, existing === void 0 || existing === twin ? twin : "***");
+	}
+	/**
 	* A copy of `value` with every string LEAF (and every object KEY) masked, for
 	* a caller about to ENCODE it into a message (issue
 	* [#2759](https://github.com/go-to-k/cdkd/issues/2759)).
@@ -26788,7 +27287,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (typeof node === "string") return this.maskSecretsForLog(this.logTextOfLeaf(node, context), context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -26800,7 +27299,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(this.logTextOfLeaf(key, context), context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -26846,8 +27345,32 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
 	}
 	async resolveDynamicReferences(value, context) {
+		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
+	}
+	/**
+	* {@link resolveDynamicReferences}, also returning the LOG TWIN of the result
+	* (issue [#3100](https://github.com/go-to-k/cdkd/issues/3100), see
+	* `LogTwin`). `logTwin` is the caller's twin of `value`, which may already
+	* mask spans an earlier write put there.
+	*
+	* Every arm that writes into `result` writes into the twin too, replacing
+	* the SAME token: a secret verdict writes {@link SECRET_MASK}, anything else
+	* the value itself. The verdict is the one each arm already holds — the
+	* fresh lookup's `isSecret`, the cache entry's own `secret` (never the
+	* process-wide store, for the #1933 reason the cache-hit arm states), and
+	* for a region-pinned sibling the twin the sibling itself returns. An arm
+	* that `continue`s without writing leaves the token in both.
+	*
+	* A token whose text an earlier write masked (`{{resolve:${Pw}}}` over a
+	* secret `Pw`) is not found in the twin, so the twin keeps the masked token
+	* where the value holds its resolution. What the twin cannot carry is a
+	* NEEDLE match that straddles a masked span, which is why the log lines go
+	* through `logTwinText` rather than masking the twin alone.
+	*/
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
+		let twin = logTwin;
 		let match;
 		const matches = [];
 		while ((match = pattern.exec(value)) !== null) matches.push({
@@ -26861,8 +27384,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
 			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
-				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferences(fullMatch, withoutProducerRegions(context));
-				result = result.replace(fullMatch, () => foreign);
+				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context));
+				result = result.replace(fullMatch, () => foreign.result);
+				twin = twin.replace(fullMatch, () => foreign.twin);
 				continue;
 			}
 			const cached = this.cachedDynamicReferences.get(fullMatch);
@@ -26872,6 +27396,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
 				}
 				result = result.replace(fullMatch, () => cached.value);
+				twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
 				continue;
 			}
 			const parts = inner.split(":");
@@ -26921,8 +27446,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
 			}
 			result = result.replace(fullMatch, () => resolved);
+			twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
 		}
-		return result;
+		if (context) this.rememberLogTwin(context, result, twin);
+		return {
+			result,
+			twin
+		};
 	}
 	/**
 	* Resolve a Secrets Manager dynamic reference
@@ -28486,7 +29016,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BsC_XndT.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-NffO_bpL.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -33684,12 +34214,20 @@ const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
 *
 * The accepted STRING set is `Number()`'s, which is WIDER than a decimal
 * integer: `'0x1e'`, `'0o36'`, `'1e3'`, `'30.5'` and `' 30 '` all coerce.
-* Whether CloudFormation accepts those for an `Integer`-typed property is
-* unmeasured, and issue [#2698](https://github.com/go-to-k/cdkd/issues/2698)
-* holds the live A/B that would settle it. It matters at the CALLERS that
-* FORWARD the result to AWS rather than merely compare it — narrowing this
-* shared helper would change the DynamoDB capacity readers too, so read that
-* issue before tightening anything here.
+* CloudFormation accepts only the LAST of those for an `Integer`-typed
+* property — measured on `AWS::Logs::LogGroup.RetentionInDays`, issue
+* [#2698](https://github.com/go-to-k/cdkd/issues/2698) — and
+* {@link toCfnInteger} is the reader that matches that measurement. It matters
+* at the CALLERS that FORWARD the result to AWS rather than merely compare it:
+* the log-group provider switched; the DynamoDB capacity / throughput
+* forwarders (`coerceWarmThroughput` below, and the `GlobalTable` provider's
+* `ProvisionedThroughput` / `OnDemandThroughput` readers) still read through
+* THIS helper, because the measurement covers one resource handler and
+* DynamoDB's has not been A/B'd — issue
+* [#3135](https://github.com/go-to-k/cdkd/issues/3135) holds that pass. A
+* GUARD caller (`stateful-types.ts`'s `has-retention`, the DynamoDB
+* already-matches / decrease tests) is safe on the wider set: over-acceptance
+* there can only produce MORE refusals or skip fewer calls.
 *
 * EXPORTED, and not because warm throughput needs it exported. This exact rule
 * was hand-written three times — here, as `dynamodb-table-provider.ts`'s
@@ -33710,6 +34248,59 @@ function toFiniteNumber(value) {
 	}
 }
 /**
+* A CloudFormation-borne `Integer` property, read the way CloudFormation reads
+* it, or `undefined` when CloudFormation would REJECT the value.
+*
+* The sibling of {@link toFiniteNumber} for the callers that FORWARD the number
+* to AWS. That helper is `Number()`, which accepts hex, octal, binary,
+* exponent and decimal-point spellings; CloudFormation does not, and a
+* provider forwarding `Number('0x1e')` sends `30` for a template CloudFormation
+* would have refused outright. Measured live on
+* `AWS::Logs::LogGroup.RetentionInDays` (us-east-1, 2026-09-14, issue
+* [#2698](https://github.com/go-to-k/cdkd/issues/2698); a one-resource stack
+* updated per spelling, live value read back with `logs describe-log-groups`):
+*
+* ```
+* template spelling        CloudFormation                   live retention after
+* 30 (JSON number)         accepted                         30
+* "60"                     accepted                         60
+* "+30"                    accepted                         30
+* " 30 " (padded)          accepted                         30
+* "  " (whitespace only)   accepted, treated as ABSENT      none (policy REMOVED)
+* "" (empty string)        accepted, treated as ABSENT      none (policy REMOVED)
+* property absent          accepted                         none (policy REMOVED)
+* "0x1e"                   REJECTED (handler)               unchanged
+* "1e3"                    REJECTED (handler)               unchanged
+* "30.5"                   REJECTED (handler)               unchanged
+* "30.0"                   REJECTED (handler)               unchanged
+* "abc"                    REJECTED (handler)               unchanged
+* true / false             REJECTED (handler)               unchanged
+* 0 / "0"                  REJECTED (handler: enum)         unchanged
+* null                     REJECTED at update-stack         unchanged
+* ```
+*
+* So the accepted string grammar is `optional sign + decimal digits`, with
+* surrounding whitespace TRIMMED — `/^\s*[+-]?\d+\s*$/`, then `Number()`. The
+* digits grammar is `config-shape.ts`'s {@link coerceCfnInteger}, reused rather
+* than respelled so the two cannot drift on it; the ONE difference is the
+* trim, and it is a measured difference, not a relaxation: that helper's own
+* measurement (a NESTED `GenerateSecretString.PasswordLength`, 2026-09-13)
+* saw `" 12 "` REJECTED where this one saw `" 30 "` accepted. Per-handler
+* behaviour varies on padding, so each helper carries its own measurement and
+* a caller picks by the property it forwards.
+*
+* What this helper does NOT decide: the empty / whitespace-only strings above
+* are CloudFormation's spelling of "property absent", which is a statement
+* about the PROPERTY, not about the number — they answer `undefined` here, and
+* the caller decides whether `undefined` means "absent" or "unusable" from the
+* raw value (`logs-loggroup-provider.ts`'s `assertUsableRetention` is the
+* reference). `0` / `'0'` parse to `0` here; whether zero is usable is again the
+* property's question (the log-group handler rejects it by enum).
+*/
+function toCfnInteger(value) {
+	return coerceCfnInteger(typeof value === "string" ? value.trim() : value);
+}
+/**
 * Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
 * fields accept, PER MEMBER.
 *
@@ -36008,6 +36599,45 @@ function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
 /**
+* One spelling of "this value came from a rollback-journal record, and is
+* about to be interpolated into a message a terminal will render" (issue
+* #3092). The journal is a sibling of `state.json` in the same bucket,
+* writable by anyone with `s3:PutObject` and validated no more than an
+* unchecked cast; cdkd's output is line-oriented, so an injected newline
+* invents a line that reads like a real one. This executor runs under the
+* standalone `cdkd rollback` AND under the deploy engine's automatic
+* rollback, so its lines print on every failed deploy.
+*
+* `displayIdent`: the ASCII allowlist with `UNRENDERABLE` for a value that
+* sanitizes to nothing, a length cap, and a visible boundary (a JSON-quoted
+* rendering) for a value that is not a plain identifier -- the all-ASCII
+* `X (AWS::RDS::DBInstance) -- already reverted` the allowlist lets through.
+* A logical id, a CFn resource type and a change type all have known
+* charsets. Call it for those; `grep safe(` answers the scope.
+*
+* NOT for a value that is USED rather than shown -- the ids passed to a
+* provider call, the keys into `stateResources`, the `msg` a classifier reads.
+* NOT for the `reason` / `survivorReason` strings handed to `ctx.recordEvent`:
+* those are PERSISTED into `deployments/*.jsonl` raw and `cdkd events`
+* sanitizes them on the way out, so sanitizing here would put a display
+* transform on a stored value and double it at render (the go-to-k/cdkd#2170
+* direction). NOT for free-form error text either: an SDK message legitimately
+* carries non-ASCII, so a site rendering one calls `displaySafe()` directly and
+* takes the DENYLIST, as `formatError` does for a `cause`.
+*/
+function safe(value) {
+	return displayIdent(value);
+}
+/**
+* The one shape of `op.logicalId` this executor will print INSIDE a command it
+* invites the user to paste (`cdkd rollback --orphan <id>`): CloudFormation's
+* own logical-id charset and length. Stricter than "`safe()` is the identity
+* on it" on purpose -- `~user` and `=x` are plain identifiers the shell
+* expands before cdkd sees them (issue #3092 review). Not a display rule: a
+* legitimate id the executor merely SHOWS still goes through `safe()`.
+*/
+const PASTEABLE_LOGICAL_ID = /^[A-Za-z0-9]{1,255}$/;
+/**
 * `UpdateReplacePolicy: Snapshot` on a rollback's delete-of-the-NEW-resource
 * (issue #1354): honor it where it costs nothing — an atomic-final-snapshot
 * type on the SDK route gets a generated identifier threaded into the delete
@@ -36104,7 +36734,7 @@ function rollbackRetainsNewResource(record) {
 */
 function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause) {
 	return {
-		warn: `  ⚠ ${logicalId} (${resourceType}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${survivorPhysicalId}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need it. ${stateClause}`,
+		warn: `  ⚠ ${safe(logicalId)} (${safe(resourceType)}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${displaySafe(survivorPhysicalId)}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need it. ${displaySafe(stateClause)}`,
 		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorPhysicalId}); it is live, still billing, and no longer tracked by cdkd. ${stateClause}`
 	};
 }
@@ -36655,7 +37285,7 @@ function redactRollbackRecord(record, secrets, journaledProps) {
 }
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
 	if (provider.disableOuterRetry) return await withCurrentResourceSecrets(secrets, () => provider.update(...args));
-	return await withRetry(() => withCurrentResourceSecrets(secrets, () => provider.update(...args)), logicalId, {
+	return await withRetry(() => withCurrentResourceSecrets(secrets, () => provider.update(...args)), safe(logicalId), {
 		logger: maskingRetryLogger(logger, secrets),
 		...isInterrupted && {
 			isInterrupted,
@@ -36747,13 +37377,14 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 async function createWithRollbackRetry(provider, create, logicalId, logger, isInterrupted, secrets, outer) {
 	if (provider.disableOuterRetry) return await create();
 	const maskedLogger = maskingRetryLogger(logger, secrets);
-	return await withRetry(() => withRetry(create, logicalId, {
+	const shownId = safe(logicalId);
+	return await withRetry(() => withRetry(create, shownId, {
 		logger: maskedLogger,
 		...isInterrupted && {
 			isInterrupted,
 			onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while retrying the replay re-create")
 		}
-	}), logicalId, {
+	}), shownId, {
 		...RECREATE_RETRY_SCHEDULE,
 		logger: maskedLogger,
 		...isInterrupted && {
@@ -36836,18 +37467,18 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 	try {
 		switch (action) {
 			case "unrecoverable-delete":
-				logger.warn(`  Rollback: Cannot restore deleted resource ${op.logicalId} (${op.resourceType}) — resource has already been deleted`);
+				logger.warn(`  Rollback: Cannot restore deleted resource ${safe(op.logicalId)} (${safe(op.resourceType)}) — resource has already been deleted`);
 				result.warnings++;
 				return;
 			case "skip-already-done":
-				logger.debug(`  Rollback: ${op.logicalId} already reverted, skipping`);
+				logger.debug(`  Rollback: ${safe(op.logicalId)} already reverted, skipping`);
 				return;
 			case "skip-mismatch":
-				logger.warn(`  Rollback: Skipping ${op.logicalId} — its physical id changed since the failed deploy (replaced by a later attempt); manual attention may be required`);
+				logger.warn(`  Rollback: Skipping ${safe(op.logicalId)} — its physical id changed since the failed deploy (replaced by a later attempt); manual attention may be required`);
 				result.warnings++;
 				return;
 			case "skip-absent":
-				logger.warn(`  Rollback: Cannot restore ${op.logicalId} — resource no longer in state, skipping`);
+				logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource no longer in state, skipping`);
 				result.warnings++;
 				return;
 			case "orphan-flag":
@@ -36856,7 +37487,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					const orphanFlagProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 					createRollbackRoute = orphanFlagProvisionedBy;
 					delete stateResources[op.logicalId];
-					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
+					logger.info(`  Rollback: Orphaning created resource ${safe(op.logicalId)} (--orphan)`);
 					await afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -36870,7 +37501,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							reason: `--orphan left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
 						}
 					});
-				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
+				} else logger.info(`  Rollback: Leaving ${safe(op.logicalId)} at its new state (--orphan)`);
 				return;
 			case "orphan-retain": {
 				const record = stateResources[op.logicalId];
@@ -36886,7 +37517,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					onOrphan?.(orphaned);
 				}
 				delete stateResources[op.logicalId];
-				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
+				logger.info(`  Rollback: Leaving ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain) — removed from state`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -36905,7 +37536,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "delete":
 			case "delete-with-final-snapshot": {
 				if (!op.physicalId) {
-					logger.warn(`  Rollback: Cannot delete ${op.logicalId} — no physical ID recorded`);
+					logger.warn(`  Rollback: Cannot delete ${safe(op.logicalId)} — no physical ID recorded`);
 					result.warnings++;
 					return;
 				}
@@ -36915,7 +37546,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
 				let finalSnapshotIdentifier;
 				if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx);
-				logger.info(`  Rollback: Deleting created resource ${op.logicalId} (${op.resourceType})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
+				logger.info(`  Rollback: Deleting created resource ${safe(op.logicalId)} (${safe(op.resourceType)})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
 				const { provider } = ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: deleteProvisionedBy
@@ -36925,7 +37556,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 				}), op.logicalId, op.physicalId, "while rolling back its CREATE");
 				delete stateResources[op.logicalId];
-				logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
+				logger.info(`  Rollback: ${safe(op.logicalId)} deleted successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -36940,7 +37571,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement-readopt": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
-				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
+				logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the retained old one (${displaySafe(prev.physicalId)})`);
 				/**
 				* Set when this arm ORPHANS the replacement's new copy. Read at the
 				* `ROLLBACK_RESOURCE_SUCCEEDED` event below, which is the only channel
@@ -36974,7 +37605,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					}), op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)");
 				}
 				stateResources[op.logicalId] = prev;
-				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
+				logger.info(`  Rollback: ${safe(op.logicalId)} restored to the retained old resource`);
 				await afterOp?.(op.logicalId);
 				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
@@ -36998,8 +37629,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
 				refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
-				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
-				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
+				logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — re-creating the old resource and deleting the new one`);
+				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
@@ -37018,8 +37649,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				} catch (createError) {
 					const msg = createError instanceof Error ? createError.message : String(createError);
 					if (!isNameCollisionError(msg)) throw createError;
-					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${op.logicalId} (${op.resourceType}): the re-create of the old resource (${prev.physicalId}) collided with the name still held by the new one (${current.physicalId}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with \`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${msg}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
-					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
+					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create of the old resource (${safe(prev.physicalId)}) collided with the name still held by the new one (${safe(current.physicalId)}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with ` + (typeof op.logicalId === "string" && PASTEABLE_LOGICAL_ID.test(op.logicalId) ? `\`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the ` : "`cdkd rollback --orphan <id>` (the id is withheld: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource -- read it from `cdkd events`): one op failure stops the ") + `segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${displaySafe(msg)}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
+					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(current.physicalId)}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 						throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
@@ -37036,12 +37667,12 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
 					} catch (recreateError) {
-						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${current.physicalId}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
 				if (adoptedLiveNewResource) {
-					logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}): the re-create returned the LIVE new resource (${current.physicalId}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so run 'cdkd drift ${stackName}' to inspect and 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.`);
+					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so run 'cdkd drift ${stackName}' to inspect and 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.`);
 					result.warnings++;
 				}
 				const { observedProperties: _staleObserved, ...prevRecord } = prev;
@@ -37065,11 +37696,11 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
-					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
+					logger.warn(maskSecretsInText(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(current.physicalId)}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`, secrets));
 					survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 					result.warnings++;
 				}
-				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				logger.info(adoptedLiveNewResource ? `  Rollback: ${safe(op.logicalId)} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${safe(op.logicalId)} replacement reversed (old resource re-created as ${createResult.physicalId})`);
 				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37088,18 +37719,18 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			}
 			case "revert": {
 				if (!op.previousState) {
-					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — no previous state available`);
+					logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — no previous state available`);
 					result.warnings++;
 					return;
 				}
 				const previousState = op.previousState;
 				const current = stateResources[op.logicalId];
 				if (!current) {
-					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — resource not found in current state`);
+					logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource not found in current state`);
 					result.warnings++;
 					return;
 				}
-				logger.info(`  Rollback: Restoring ${op.logicalId} (${op.resourceType}) to previous state`);
+				logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 				const { provider } = ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
@@ -37121,8 +37752,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				const rollbackPartial = updatePartialReason(revertResult);
-				if (rollbackPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`, secrets));
-				else logger.info(`  Rollback: ${op.logicalId} restored successfully`);
+				if (rollbackPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`, secrets));
+				else logger.info(`  Rollback: ${safe(op.logicalId)} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37137,7 +37768,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			}
 		}
 	} catch (rollbackError) {
-		logger.warn(maskSecretsInText(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`, secrets));
+		logger.warn(maskSecretsInText(`  Rollback failed for ${safe(op.logicalId)} (${safe(op.changeType)}): ${displaySafe(rollbackError instanceof Error ? rollbackError.message : String(rollbackError))}`, secrets));
 		logger.warn("  Continuing with remaining rollback operations...");
 		result.failures++;
 		const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -37199,14 +37830,14 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		try {
 			switch (action) {
 				case "skip-failed-noop":
-					logger.info(`  Rollback: failed ${op.changeType} of ${op.logicalId} (${op.resourceType}) left nothing to revert, skipping`);
+					logger.info(`  Rollback: failed ${safe(op.changeType)} of ${safe(op.logicalId)} (${safe(op.resourceType)}) left nothing to revert, skipping`);
 					break;
 				case "skip-failed-unknown":
-					logger.warn(`  Rollback: failed CREATE of ${op.logicalId} (${op.resourceType}) recorded no physical id — if it was partially created in AWS, delete it manually`);
+					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
 					result.warnings++;
 					break;
 				case "skip-failed-absent":
-					logger.warn(`  Rollback: cannot revert failed UPDATE of ${op.logicalId} — no previous state available, skipping`);
+					logger.warn(`  Rollback: cannot revert failed UPDATE of ${safe(op.logicalId)} — no previous state available, skipping`);
 					result.warnings++;
 					break;
 				case "orphan-failed-create-retain": {
@@ -37223,7 +37854,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						options.onOrphan?.(orphaned);
 					}
 					delete stateResources[op.logicalId];
-					logger.info(`  Rollback: leaving partially-created ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
+					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain) — removed from state`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37243,7 +37874,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
 					let finalSnapshotIdentifier;
 					if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx);
-					logger.info(`  Rollback: deleting partially-created ${op.logicalId} (${op.resourceType}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
+					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
 					const { provider } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
@@ -37267,7 +37898,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 				case "revert-failed-update": {
 					const current = stateResources[op.logicalId];
 					const prev = op.previousState;
-					logger.info(`  Rollback: force-reverting failed UPDATE of ${op.logicalId} (${op.resourceType}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
+					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
 					const { provider } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
@@ -37289,8 +37920,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
-					if (revertFailedPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`, secrets));
-					else logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
+					if (revertFailedPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`, secrets));
+					else logger.info(`  Rollback: ${safe(op.logicalId)} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37305,7 +37936,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 				}
 			}
 		} catch (revertError) {
-			logger.warn(maskSecretsInText(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`, secrets));
+			logger.warn(maskSecretsInText(`  Rollback failed for failed-op ${safe(op.logicalId)} (${safe(op.changeType)}): ${displaySafe(revertError instanceof Error ? revertError.message : String(revertError))}`, secrets));
 			result.failures++;
 			pending.add(op);
 			const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -41041,5 +41672,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { getCurrentResourceSecrets as $, validateAssetBucketName as $n, DependencyError as $r, findActionableSilentDrops as $t, planOrphanAdoption as A, CUSTOM_RESOURCE_RESPONSE_PREFIX as An, warnDeprecatedNoPrefixCliFlag as Ar, resolveExplicitPhysicalId as At, bold as B, WorkGraph as Bn, derivePartitionAndUrlSuffix as Br, requireConfigObject as Bt, createPreDeleteFinalSnapshot as C, markNonRetryable as Ci, S3StateBackend as Cn, resolveAutoAssetStorage as Cr, coerceParameterTypedValue as Ct, makeCanonicalizePropertiesFn as D, forceQuitRecoveryClause as Dn, resolveStateBucketWithDefaultAndSource as Dr, refStateLookupFromResource as Dt, unsupportedFinalSnapshotError as E, __exportAll as Ei, buildLockContentionMessage as En, resolveStateBucketWithDefault as Er, parameterTypeMayLoseSecretIdentity as Et, WARM_THROUGHPUT_MEMBERS as F, orphansAfterRollback as Fn, uploadCfnTemplate as Fr, configIntegerRefusal as Ft, yellow as G, AssetModeResolver as Gn, AwsClients as Gr, s3BucketArn as Gt, gray as H, createAssetRedirectResolver as Hn, processStackMessages as Hr, classifyReplaySecretRegion as Ht, coerceWarmThroughput as I, orphansCarriedFrom as In, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ir, configStringRefusal as It, exportAliasCollisionScrubWarning as J, ensureAssetStorage as Jn, setAwsClients as Jr, s3BucketRegionalDomainName as Jt, collectDeclaredOutputNames as K, BOOTSTRAP_MARKER_PREFIX as Kn, getAwsClients as Kr, s3BucketDomainName as Kt, isWarmThroughputDecrease as L, shouldRetainResource as Ln, expectedOwnerParam as Lr, readConfigString as Lt, isStatefulRecreateTargetForReplace as M, exportNamesCarriedFrom as Mn, CFN_TEMPLATE_URL_LIMIT as Mr, coerceCfnBoolean as Mt, isStatefulRecreateTargetSync as N, importableOutputKeys as Nn, MIGRATE_TMP_PREFIX as Nr, coerceCfnInteger as Nt, extractDeploymentEventError as O, formatLockExpiry as On, resolveUseCdkBootstrapAssets as Or, WAFv2WebACLProvider as Ot, renderStatefulReason as P, importableOutputs as Pn, findLargeInlineResources as Pr, configBooleanRefusal as Pt, secretSafeKeyDisplay as Q, readBootstrapMarkerBody as Qn, CrossAccountSecretRefusalError as Qr, INTRINSIC_KEYS as Qt, toFiniteNumber as R, AssetPublisher as Rn, PARTITION_TABLE as Rr, replayWarn as Rt, ccRoutedFinalSnapshotError as S, isTransientServerError as Si, LockManager as Sn, resolveApp as Sr, cfnRefValueFromPhysicalId as St, refusesFinalSnapshot as T, retryClassificationText as Ti, buildForceUnlockCommand as Tn, resolveSkipPrefix as Tr, isUnboundTemplateParameter as Tt, green as U, loadPublishableAssetManifest as Un, clearBucketRegionCache as Ur, producerRegionsFromState as Ut, cyan as V, buildAssetRedirectMap as Vn, AssemblyReader as Vr, requireConfigString as Vt, red as W, rewriteTemplateAssetReferences as Wn, resolveBucketRegion as Wr, withSharedDrainBudget as Wt, secretBearing as X, isCrossRegionRedirect as Xn, CdkdError as Xr, applyRoleArnIfSet as Xt, isExportAliasCollision as Y, getBootstrapMarkerKey as Yn, AssetError as Yr, s3BucketWebsiteUrl as Yt, secretBearingStateKeyWarning as Z, parseBootstrapMarker as Zn, ConfigError as Zr, DiffCalculator as Zt, isSecretBearingReferenceString as _, normalizeAwsError as _i, maskSecretsInText as _n, getDockerImageBySourceHash as _r, deleteSkipReason as _t, DeploymentEventsStore as a, LockError as ai, STATE_SOURCED_BASELINE_RULES as an, describeDockerExecFailure as ar, createMaskedRetryLogger as at, PRE_DELETE_SNAPSHOT_TYPES as b, isRetryableTransientError as bi, redactSecretsForState as bn, getDefaultStateBucketName as br, IntrinsicFunctionResolver as bt, replayFailedOperations as c, ProvisioningError as ci, TEMPLATE_SOURCED_RULES as cn, formatDockerLoginError as cr, beginCommandInterruptScope as ct, updatePartialReason as d, StackHasActiveImportsError as di, dynamicReferenceTokens as dn, redactDockerArgvValues as dr, isInterruptedWaitError as dt, DeployCancelledError as ei, findSilentDropProperties as en, validateContainerRepoName as er, IAMRoleProvider as et, withResourceDeadline as f, StackTerminationProtectionError as fi, errorCauseChain as fn, runDockerForeground as fr, startInterruptWatch as ft, bagHoldsSecretExpression as g, isCdkdError as gi, maskSecretsInError as gn, AssetManifestLoader as gr, deleteIndeterminateGuards as gt, computeImplicitDeleteEdges as h, formatError as hi, markSameGenerationBag as hn, stripControlChars as hr, UNSPECIFIED_SKIP_REASON as ht, DeploymentEventsReader as i, LocalStartServiceError as ii, TemplateParser as in, describeDockerCapturedOutput as ir, wouldReturnToSdkProvider as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, DEFAULT_STATE_PREFIX as jn, CFN_TEMPLATE_BODY_LIMIT as jr, assertRegionMatch as jt, makeSiblingClaimReader as k, shellQuote as kn, stateBucketExistenceConfirmed as kr, normalizeAwsTagsToCfn as kt, replayRollback as l, ResourceTimeoutError as li, carriesSecretMask as ln, getDockerCmd as lr, endCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, SynthesisError as mi, isSingleDynamicReferenceToken as mn, escapeRegExp$1 as mr, slowCcOperationTimeoutMs as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, IntrinsicResolutionRefusalError as ni, withRetry as nn, describeAwsFailure as nr, clearOnUpdateRemoval as nt, planFailedOps as o, NestedStackChildDirectDestroyError as oi, STATE_SOURCED_CROSS_GENERATION_RULES as on, describeDockerFailure as or, maskDeep as ot, maskingRetryLogger as p, StateError as pi, identityKeyFor as pn, runDockerStreaming as pr, CloudControlProvider as pt, collectPublishedOutputNames as q, assertAssetBucketRegion as qn, resetAwsClients as qr, s3BucketDualStackDomainName as qt, DeployEngine as r, LocalInvokeBuildError as ri, DagBuilder as rn, buildDockerImage as rr, ProviderRegistry as rt, planRollback as s, PartialFailureError as si, STATE_SOURCED_READBACK_RULES as sn, dockerSpawnEnvWithSensitive as sr, maskerOrIdentity as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DynamicReferenceRegionAmbiguousError as ti, describeTypeWithThrottleRetry as tn, buildDenyExternalAccessPolicy as tr, collectInlinePolicyNamesManagedBySiblings as tt, updatePartialMessage as u, ResourceUpdateNotSupportedError as ui, createSecretMasker as un, partitionSensitiveEnv as ur, interruptWatchListenerCount as ut, bindingSkippedOutputs as v, withErrorHandling as vi, recordMaskOnlyValue as vn, Synthesizer as vr, disableInstanceApiTermination as vt, isFinalSnapshotError as w, markRedactedCause as wi, rebuildClientForBucketRegion as wn, resolveCaptureObservedState as wr, getAccountInfo as wt, buildFinalSnapshotIdentifier as x, isThrottlingError as xi, scrubResourceRecord as xn, getLegacyStateBucketName as xr, carriesDynamicReference as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, isMarkedNonRetryable as yi, recoverMaskedOutput as yn, synthesisStatusMessage as yr, isTerminationProtectionPropagationError as yt, formatResourceLine as z, stringifyValue as zn, canonicalizeRegion as zr, requireConfigArray as zt };
-//# sourceMappingURL=deploy-engine-Nn9j2GPK.js.map
+export { secretSafeKeyDisplay as $, parseBootstrapMarker as $n, ConfigError as $r, DiffCalculator as $t, planOrphanAdoption as A, formatLockExpiry as An, resolveUseCdkBootstrapAssets as Ar, WAFv2WebACLProvider as At, formatResourceLine as B, AssetPublisher as Bn, PARTITION_TABLE as Br, replayWarn as Bt, createPreDeleteFinalSnapshot as C, isThrottlingError as Ci, scrubResourceRecord as Cn, getLegacyStateBucketName as Cr, cfnRefValueFromPhysicalId as Ct, makeCanonicalizePropertiesFn as D, retryClassificationText as Di, buildForceUnlockCommand as Dn, resolveSkipPrefix as Dr, parameterTypeMayLoseSecretIdentity as Dt, unsupportedFinalSnapshotError as E, markRedactedCause as Ei, rebuildClientForBucketRegion as En, resolveCaptureObservedState as Er, isUnboundTemplateParameter as Et, WARM_THROUGHPUT_MEMBERS as F, importableOutputKeys as Fn, MIGRATE_TMP_PREFIX as Fr, coerceCfnInteger as Ft, red as G, loadPublishableAssetManifest as Gn, clearBucketRegionCache as Gr, producerRegionsFromState as Gt, cyan as H, WorkGraph as Hn, derivePartitionAndUrlSuffix as Hr, requireConfigObject as Ht, coerceWarmThroughput as I, importableOutputs as In, findLargeInlineResources as Ir, configBooleanRefusal as It, collectPublishedOutputNames as J, BOOTSTRAP_MARKER_PREFIX as Jn, getAwsClients as Jr, s3BucketDomainName as Jt, yellow as K, rewriteTemplateAssetReferences as Kn, resolveBucketRegion as Kr, withSharedDrainBudget as Kt, isWarmThroughputDecrease as L, orphansAfterRollback as Ln, uploadCfnTemplate as Lr, configIntegerRefusal as Lt, isStatefulRecreateTargetForReplace as M, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mn, warnDeprecatedNoPrefixCliFlag as Mr, resolveExplicitPhysicalId as Mt, isStatefulRecreateTargetSync as N, DEFAULT_STATE_PREFIX as Nn, CFN_TEMPLATE_BODY_LIMIT as Nr, assertRegionMatch as Nt, extractDeploymentEventError as O, __exportAll as Oi, buildLockContentionMessage as On, resolveStateBucketWithDefault as Or, refStateLookupFromResource as Ot, renderStatefulReason as P, exportNamesCarriedFrom as Pn, CFN_TEMPLATE_URL_LIMIT as Pr, coerceCfnBoolean as Pt, secretBearingStateKeyWarning as Q, isCrossRegionRedirect as Qn, CdkdError as Qr, applyRoleArnIfSet as Qt, toCfnInteger as R, orphansCarriedFrom as Rn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Rr, configStringRefusal as Rt, ccRoutedFinalSnapshotError as S, isRetryableTransientError as Si, redactSecretsForState as Sn, getDefaultStateBucketName as Sr, carriesDynamicReference as St, refusesFinalSnapshot as T, markNonRetryable as Ti, S3StateBackend as Tn, resolveAutoAssetStorage as Tr, getAccountInfo as Tt, gray as U, buildAssetRedirectMap as Un, AssemblyReader as Ur, requireConfigString as Ut, bold as V, stringifyValue as Vn, canonicalizeRegion as Vr, requireConfigArray as Vt, green as W, createAssetRedirectResolver as Wn, processStackMessages as Wr, classifyReplaySecretRegion as Wt, isExportAliasCollision as X, ensureAssetStorage as Xn, setAwsClients as Xr, s3BucketRegionalDomainName as Xt, exportAliasCollisionScrubWarning as Y, assertAssetBucketRegion as Yn, resetAwsClients as Yr, s3BucketDualStackDomainName as Yt, secretBearing as Z, getBootstrapMarkerKey as Zn, AssetError as Zr, s3BucketWebsiteUrl as Zt, isSecretBearingReferenceString as _, formatError as _i, markSameGenerationBag as _n, stripControlChars as _r, deleteIndeterminateGuards as _t, DeploymentEventsStore as a, LocalInvokeBuildError as ai, DagBuilder as an, buildDockerImage as ar, wouldReturnToSdkProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, withErrorHandling as bi, recordMaskOnlyValue as bn, Synthesizer as br, isTerminationProtectionPropagationError as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ci, STATE_SOURCED_CROSS_GENERATION_RULES as cn, describeDockerFailure as cr, maskerOrIdentity as ct, updatePartialReason as d, ResourceTimeoutError as di, carriesSecretMask as dn, getDockerCmd as dr, interruptWatchListenerCount as dt, CrossAccountSecretRefusalError as ei, INTRINSIC_KEYS as en, readBootstrapMarkerBody as er, getCurrentResourceSecrets as et, withResourceDeadline as f, ResourceUpdateNotSupportedError as fi, createSecretMasker as fn, partitionSensitiveEnv as fr, isInterruptedWaitError as ft, bagHoldsSecretExpression as g, SynthesisError as gi, isSingleDynamicReferenceToken as gn, escapeRegExp$1 as gr, UNSPECIFIED_SKIP_REASON as gt, computeImplicitDeleteEdges as h, StateError as hi, identityKeyFor as hn, runDockerStreaming as hr, slowCcOperationTimeoutMs as ht, DeploymentEventsReader as i, IntrinsicResolutionRefusalError as ii, withRetry as in, describeAwsFailure as ir, ProviderRegistry as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, shellQuote as jn, stateBucketExistenceConfirmed as jr, normalizeAwsTagsToCfn as jt, makeSiblingClaimReader as k, forceQuitRecoveryClause as kn, resolveStateBucketWithDefaultAndSource as kr, isSettledInstanceState as kt, replayRollback as l, PartialFailureError as li, STATE_SOURCED_READBACK_RULES as ln, dockerSpawnEnvWithSensitive as lr, beginCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, StackTerminationProtectionError as mi, errorCauseChain as mn, runDockerForeground as mr, CloudControlProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DeployCancelledError as ni, findSilentDropProperties as nn, validateContainerRepoName as nr, collectInlinePolicyNamesManagedBySiblings as nt, planFailedOps as o, LocalStartServiceError as oi, TemplateParser as on, describeDockerCapturedOutput as or, createMaskedRetryLogger as ot, maskingRetryLogger as p, StackHasActiveImportsError as pi, dynamicReferenceTokens as pn, redactDockerArgvValues as pr, startInterruptWatch as pt, collectDeclaredOutputNames as q, AssetModeResolver as qn, AwsClients as qr, s3BucketArn as qt, DeployEngine as r, DynamicReferenceRegionAmbiguousError as ri, describeTypeWithThrottleRetry as rn, buildDenyExternalAccessPolicy as rr, clearOnUpdateRemoval as rt, planRollback as s, LockError as si, STATE_SOURCED_BASELINE_RULES as sn, describeDockerExecFailure as sr, maskDeep as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DependencyError as ti, findActionableSilentDrops as tn, validateAssetBucketName as tr, IAMRoleProvider as tt, updatePartialMessage as u, ProvisioningError as ui, TEMPLATE_SOURCED_RULES as un, formatDockerLoginError as ur, endCommandInterruptScope as ut, bindingSkippedOutputs as v, isCdkdError as vi, maskSecretsInError as vn, AssetManifestLoader as vr, deleteSkipReason as vt, isFinalSnapshotError as w, isTransientServerError as wi, LockManager as wn, resolveApp as wr, coerceParameterTypedValue as wt, buildFinalSnapshotIdentifier as x, isMarkedNonRetryable as xi, recoverMaskedOutput as xn, synthesisStatusMessage as xr, IntrinsicFunctionResolver as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, normalizeAwsError as yi, maskSecretsInText as yn, getDockerImageBySourceHash as yr, disableInstanceApiTermination as yt, toFiniteNumber as z, shouldRetainResource as zn, expectedOwnerParam as zr, readConfigString as zt };
+//# sourceMappingURL=deploy-engine-DD7JE_Ic.js.map