@go-to-k/cdkd 0.290.29 → 0.290.31

package/dist/{deploy-engine-Bcwb9_mO.js → deploy-engine-21iNqwR3.js}

@@ -1,6 +1,6 @@
-import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-6LP1UiFA.js";
+import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BjWM-UVj.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-snXN__f1.js";
+import { t as getCdkdVersion } from "./version-IwTfNQ-K.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17109,7 +17109,8 @@ var DagBuilder = class {
 		resourceIds.forEach((logicalId) => {
 			const resource = this.parser.getResource(template, logicalId);
 			graph.setNode(logicalId, resource);
-			this.logger.debug(`Added node: ${logicalId} (${resource?.Type})`);
+			const typeText = resource?.Type == null ? "<no Type>" : displayIdent(resource.Type);
+			this.logger.debug(`Added node: ${displayIdent(logicalId)} (${typeText})`);
 		});
 		this.logger.debug(`Total nodes: ${resourceIds.length}`);
 		const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
@@ -17123,15 +17124,15 @@ var DagBuilder = class {
 			for (const depId of dependencies) {
 				if (skip?.has(depId)) {
 					relaxedEdgeCount++;
-					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${depId} -> ${logicalId} (default; opt out with --no-aggressive-vpc-parallel)`);
+					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)} (default; opt out with --no-aggressive-vpc-parallel)`);
 					continue;
 				}
 				if (graph.hasNode(depId)) {
 					graph.setEdge(depId, logicalId);
 					edgeCount++;
-					this.logger.debug(`Added edge: ${depId} -> ${logicalId}`);
-				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${logicalId} -> ${depId}`);
-				else this.logger.warn(`Resource ${logicalId} depends on ${depId}, but ${depId} not found in template`);
+					this.logger.debug(`Added edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)}`);
+				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${displayIdent(logicalId)} -> ${displayIdent(depId)}`);
+				else this.logger.warn(`Resource ${displayIdent(logicalId)} depends on ${displayIdent(depId)}, but ${displayIdent(depId)} not found in template`);
 			}
 		}
 		if (relaxedEdgeCount > 0) this.logger.info(`[DagBuilder] Relaxed ${relaxedEdgeCount} CDK-defensive DependsOn edge(s) (default; opt out with --no-aggressive-vpc-parallel)`);
@@ -17140,7 +17141,7 @@ var DagBuilder = class {
 		edgeCount += this.addLambdaVpcEdges(graph, template);
 		if (!alg.isAcyclic(graph)) {
 			const cycles = this.findCycles(graph);
-			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.join(" -> ")).join("; ")}`);
+			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.map((n) => displayIdent(n)).join(" -> ")).join("; ")}`);
 		}
 		return graph;
 	}
@@ -17172,9 +17173,9 @@ var DagBuilder = class {
 			});
 			if (readyNodes.length === 0) {
 				const remaining = graphCopy.nodes();
-				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.join(", ")}`);
+				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.map((n) => displayIdent(n)).join(", ")}`);
 			}
-			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.join(", ")}`);
+			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.map((n) => displayIdent(n)).join(", ")}`);
 			levels.push(readyNodes);
 			readyNodes.forEach((node) => {
 				graphCopy.removeNode(node);
@@ -17291,7 +17292,7 @@ var DagBuilder = class {
 				if (graph.hasEdge(policyId, logicalId)) continue;
 				graph.setEdge(policyId, logicalId);
 				added++;
-				this.logger.debug(`Added implicit edge (custom resource policy): ${policyId} -> ${logicalId}`);
+				this.logger.debug(`Added implicit edge (custom resource policy): ${displayIdent(policyId)} -> ${displayIdent(logicalId)}`);
 			}
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for custom resource policies`);
@@ -17322,7 +17323,7 @@ var DagBuilder = class {
 			if (graph.hasEdge(depId, dependentId)) continue;
 			graph.setEdge(depId, dependentId);
 			added++;
-			this.logger.debug(`Added implicit edge (lambda vpc): ${depId} -> ${dependentId}`);
+			this.logger.debug(`Added implicit edge (lambda vpc): ${displayIdent(depId)} -> ${displayIdent(dependentId)}`);
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for Lambda VpcConfig`);
 		return added;
@@ -20580,13 +20581,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"FifoThroughputScope",
 			"FifoTopic",
 			"KmsMasterKeyId",
+			"MaximumMessageSize",
 			"SignatureVersion",
 			"Subscription",
 			"Tags",
 			"TopicName",
 			"TracingConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["MaximumMessageSize", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::SNS::TopicPolicy", {
@@ -23136,7 +23138,8 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 	}
 	const promise = (async () => {
 		const logger = getLogger().child("role-arn");
-		logger.debug(`Assuming role for cross-account state read: ${roleArn}`);
+		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
+		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
 		const sts = new STSClient({ ...awsClientDefaults() });
 		try {
 			let response;
@@ -23147,13 +23150,13 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 					DurationSeconds: 3600
 				}));
 			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				throw new Error(`AssumeRole into ${roleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://github.com/go-to-k/cdkd/blob/main/docs/cross-stack-references.md for the trust-policy template.`, { cause: err instanceof Error ? err : void 0 });
+				const message = displayAwsMessage(err instanceof Error ? err.message : String(err));
+				throw new Error(`AssumeRole into ${displayRoleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://github.com/go-to-k/cdkd/blob/main/docs/cross-stack-references.md for the trust-policy template.`, { cause: err instanceof Error ? err : void 0 });
 			}
-			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${roleArn})`);
+			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${displayRoleArn})`);
 			const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${roleArn})`);
-			logger.info(`Assumed role for cross-account state read: ${roleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${displayRoleArn})`);
+			logger.info(`Assumed role for cross-account state read: ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
 			return {
 				accessKeyId: AccessKeyId,
 				secretAccessKey: SecretAccessKey,
@@ -23261,18 +23264,23 @@ async function applyRoleArnIfSet(opts) {
 	if (!roleArn) return;
 	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
 	const logger = getLogger().child("role-arn");
-	const displayRoleArn = displaySafe(roleArn, { asciiOnly: true });
+	const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
 	logger.debug(`Assuming role ${displayRoleArn}...`);
 	const sts = new STSClient({
 		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...opts.region && { region: opts.region }
 	});
 	try {
-		const response = await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `cdkd-${Date.now()}`,
-			DurationSeconds: 3600
-		}));
+		let response;
+		try {
+			response = await sts.send(new AssumeRoleCommand({
+				RoleArn: roleArn,
+				RoleSessionName: `cdkd-${Date.now()}`,
+				DurationSeconds: 3600
+			}));
+		} catch (err) {
+			throw new Error(`AssumeRole for ${displayRoleArn} failed: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, { cause: err instanceof Error ? err : void 0 });
+		}
 		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
 		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
 		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
@@ -27181,14 +27189,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
 		this.regionScopedClients.set(target, scoped);
-		this.logger.debug(`Using region-scoped AWS clients for ${loggedTarget}`);
+		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
 	/**
@@ -27254,7 +27262,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	async resolveParameters(template, userParameters, options) {
 		const inheritedSecrets = options?.inheritedSecrets;
-		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
+		const maskInherited = (text) => {
+			const mask = (value) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(value, inheritedSecrets) : value;
+			return displaySafe(mask(stripControlChars(mask(text))));
+		};
 		const inheritedLogContext = {
 			template,
 			resources: {},
@@ -27359,7 +27370,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const name of Object.keys(templateConditions)) try {
 			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
-			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
+			this.logger.warn(this.displayMasked(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
 			inProgress.delete(name);
 		}
@@ -27647,7 +27658,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const value = context.parameters[logicalId];
 			const declared = context.template.Parameters;
 			const paramDef = declared != null && Object.hasOwn(declared, logicalId) ? declared[logicalId] : void 0;
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.displayMasked(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
 			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
@@ -27657,10 +27668,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${valueStr}`);
 			return pseudoValue;
 		}
-		const notFoundMsg = `Ref ${logicalId} not found (not a resource, parameter, or pseudo parameter)`;
+		const loggedLogicalId = this.displayMasked(logicalId, context);
+		const notFoundMsg = `Ref ${loggedLogicalId} not found (not a resource, parameter, or pseudo parameter)`;
 		if (context.bestEffort) this.logger.debug(notFoundMsg);
 		else this.logger.warn(notFoundMsg);
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${logicalId} not found`));
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${loggedLogicalId} not found`));
 	}
 	/**
 	* Resolve the value a CloudFormation `Ref` returns for a resource.
@@ -27820,11 +27832,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.logTextOfLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -27836,18 +27848,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
-			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.maskSecretsForLog(this.outputNameLogText(k, context), context));
+			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.displayMasked(this.outputNameLogText(k, context), context));
 			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.maskSecretsForLog(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
 	/**
@@ -27898,7 +27910,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const maskedAttributeName = this.maskSecretsForLog(attributeName, context);
+			const maskedAttributeName = this.displayMasked(attributeName, context);
 			this.pushRedactedAttributeRead(context, {
 				kind: "attribute",
 				logicalId,
@@ -27940,7 +27952,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -27985,7 +27997,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -28030,7 +28042,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
@@ -28047,7 +28059,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": {
-				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
+				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
 				const cachedGroupId = cachedVpcDefaultSecurityGroups[physicalId];
 				if (cachedGroupId !== void 0) return cachedGroupId;
 				let groupId;
@@ -28262,7 +28274,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": {
-				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
+				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
 				const cachedVpcId = cachedSecurityGroupVpcIds[physicalId];
 				if (cachedVpcId !== void 0) return cachedVpcId;
 				let vpcId;
@@ -28356,7 +28368,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					resourceType,
 					physicalId,
 					context,
-					observed: `DescribeInstances reports no ${this.maskSecretsForLog(attributeName, context)} yet (${observedState})`,
+					observed: `DescribeInstances reports no ${this.displayMasked(attributeName, context)} yet (${observedState})`,
 					remedy: settled ? "Check the instance in the console; a terminated or stopped instance has no such attribute to serve." : "Deploy without --no-wait so the instance is running before its attributes are read, or reference the attribute from a later deploy once it is."
 				});
 			}
@@ -28369,7 +28381,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
@@ -28379,7 +28391,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::CloudFront::Distribution") switch (attributeName) {
 			case "Id": return physicalId;
 			case "DomainName": {
-				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
+				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
 				const cachedDomainName = cachedCloudFrontDomainNames[physicalId];
 				if (cachedDomainName !== void 0) return cachedDomainName;
 				let domainName;
@@ -28413,7 +28425,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBProxy" || resourceType === "AWS::RDS::DBProxyEndpoint") {
-			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
+			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
 			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -28472,7 +28484,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	refuseUnservedAttribute(site) {
 		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is not a usable ${this.maskSecretsForLog(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
 	}
 	/**
 	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
@@ -28484,7 +28496,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const name = displaySafe(err instanceof Error && err.name ? err.name : "Error", { asciiOnly: true }).slice(0, 64).trim() || "Error";
 		const status = err?.$metadata?.httpStatusCode;
 		const errorClass = typeof status === "number" && Number.isInteger(status) ? `${name}, HTTP ${status}` : name;
-		this.logger.debug(`${read} failed (${errorClass}): ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
+		this.logger.debug(`${read} failed (${errorClass}): ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 		return `${read} failed (${errorClass}); re-run with --verbose for the AWS error text`;
 	}
 	/**
@@ -28519,11 +28531,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${displaySafe(this.maskThenStripThenMask(physicalId, context))}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
-		this.logger.warn(`Unknown attribute ${this.maskSecretsForLog(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
+		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
 	/**
@@ -28594,7 +28606,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			complete
 		});
 		this.rememberLogTwin(context, result, twin);
-		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
+		this.logger.debug(`Resolved Fn::Join: ${this.displayMasked(this.logTwinText(result, twin, context), context)}`);
 		return result;
 	}
 	/**
@@ -28799,13 +28811,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -28843,7 +28855,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			complete
 		});
 		this.rememberLogTwin(context, result, twin);
-		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
+		this.logger.debug(`Resolved Fn::Sub: ${this.displayMasked(this.logTwinText(result, twin, context), context)}`);
 		return result;
 	}
 	/**
@@ -29186,7 +29198,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return recovered;
 			}
 			if (context.redactedAttributeReads !== void 0) {
-				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				const loggedOrigin = this.displayMasked(origin, context);
 				this.pushRedactedAttributeRead(context, {
 					kind: "cross-stack",
 					display: loggedOrigin
@@ -29210,7 +29222,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			return v;
 		};
-		this.logger.debug(`Re-resolving dynamic reference(s) in ${this.maskSecretsForLog(origin, context)}`);
+		this.logger.debug(`Re-resolving dynamic reference(s) in ${this.displayMasked(origin, context)}`);
 		const reresolved = await walk(value);
 		if (sourceKey !== void 0 && typeof value === "string" && isSingleDynamicReferenceToken(value) && typeof reresolved === "string" && context.recordedSecretValues?.has(reresolved) === true && isSecretExpressionByVerdictOrSpelling(value)) recordCrossStackExpression(context.recordedSecretValues, sourceKey, value, reresolved);
 		return reresolved;
@@ -29280,7 +29292,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const target = canonicalizeRegion(producerRegion);
 		if (target === canonicalizeRegion(this.explicitRegion)) return this;
 		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
-		const guestRegionText = this.maskThenStripThenMask(regionText, context);
+		const guestRegionText = this.displayMasked(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
 		if (cached) {
 			if (cached.explicitRegionLogText !== guestRegionText) cached.explicitRegionLogText = "***";
@@ -29306,20 +29318,20 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
-		const loggedExportName = this.maskSecretsForLog(exportName, context);
+		const loggedExportName = this.displayMasked(exportName, context);
 		this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 		if (context.exportIndex) {
 			let entry;
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${this.maskSecretsForLog(entry.producerRegion, context)}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(entry.producerStack, context)} / ${this.logTextOfLeaf(entry.producerRegion, context)})`, sourceKey, {
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.displayMasked(entry.producerStack, context)} / ${this.displayMasked(entry.producerRegion, context)}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${this.displayLeaf(exportName, context)}' (producer ${this.displayLeaf(entry.producerStack, context)} / ${this.displayLeaf(entry.producerRegion, context)})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
 					outputKey: exportName
@@ -29332,30 +29344,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
 			if (context.stackName && refStack === context.stackName) {
-				this.logger.debug(`Skipping current stack: ${this.maskSecretsForLog(refStack, context)}`);
+				this.logger.debug(`Skipping current stack: ${this.displayMasked(refStack, context)}`);
 				continue;
 			}
 			try {
 				const lookupRegion = refRegion ?? this.resolverRegion ?? "";
 				if (!lookupRegion) {
-					this.logger.debug(`No region available for stack '${this.maskSecretsForLog(refStack, context)}' — skipping (cdkd cannot read state without a region)`);
+					this.logger.debug(`No region available for stack '${this.displayMasked(refStack, context)}' — skipping (cdkd cannot read state without a region)`);
 					continue;
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${this.maskSecretsForLog(lookupRegion, context)})`);
+					this.logger.debug(`No state found for stack: ${this.displayMasked(refStack, context)} (${this.displayMasked(lookupRegion, context)})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${this.maskSecretsForLog(lookupRegion, context)}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.displayMasked(refStack, context)} / ${this.displayMasked(lookupRegion, context)}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
 						producerRegion: lookupRegion
 					}).catch((err) => {
-						this.logger.debug(`Failed to patch exports index for '${this.maskSecretsForLog(exportName, context)}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
+						this.logger.debug(`Failed to patch exports index for '${this.displayMasked(exportName, context)}': ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 					});
 					this.recordImport(context, exportName, refStack, lookupRegion);
 					found = {
@@ -29366,11 +29378,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 			} catch (error) {
-				this.logger.warn(`Failed to read state for stack ${this.maskSecretsForLog(refStack, context)}: ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
+				this.logger.warn(`Failed to read state for stack ${this.displayMasked(refStack, context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${this.logTextOfLeaf(exportName, context)}' (producer ${this.logTextOfLeaf(found.refStack, context)} / ${this.logTextOfLeaf(found.lookupRegion, context)})`, sourceKey, {
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${this.displayLeaf(exportName, context)}' (producer ${this.displayLeaf(found.refStack, context)} / ${this.displayLeaf(found.lookupRegion, context)})`, sourceKey, {
 			stackName: found.refStack,
 			region: found.lookupRegion,
 			outputKey: exportName
@@ -29413,7 +29425,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.displayMasked(exportName, context)}' (region ${this.resolverRegion}): ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -29435,7 +29447,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `OutputName` is the overwhelmingly common cause, and the list is what makes
 	* the error actionable.
 	*
-	* `maskSecretsForLog` reads the consumer pass's log twin first (issue #3150),
+	* `maskSecretsRaw` reads the consumer pass's log twin first (issue #3150),
 	* so a key equal to a name this pass assembled around a short secret is
 	* masked. Residual, stated rather than hidden: the needles and twins belong to the
 	* CONSUMER's resolution, so a plaintext sitting in a PRODUCER key that this
@@ -29445,7 +29457,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	describeAvailableOutputs(keys, context) {
 		if (keys.length === 0) return "(none)";
 		const shown = keys.slice(0, MAX_LISTED_AVAILABLE_OUTPUTS);
-		const rendered = shown.map((k) => this.maskSecretsForLog(k, context)).join(", ");
+		const rendered = shown.map((k) => this.displayMasked(k, context)).join(", ");
 		const hidden = keys.length - shown.length;
 		return hidden > 0 ? `${rendered} (+${hidden} more)` : rendered;
 	}
@@ -29485,8 +29497,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			const cfnNameMask = this.positionalNameMask([[stackName, this.maskSecretsForLog(stackName, context)], [region, this.maskSecretsForLog(loggedRegionText, context)]]);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(loggedRegionText, context)}): ${this.maskSecretsForLog(cfnNameMask ? cfnNameMask(message) : message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			const cfnNameMask = this.positionalNameMask([[stackName, this.displayMasked(stackName, context)], [region, this.displayMasked(loggedRegionText, context)]]);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.displayMasked(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -29596,7 +29608,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.displayMasked(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
 			loggedRegionText = this.regionLogText(resolvedRegion, context);
 		}
@@ -29606,11 +29618,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(loggedRegionText, context)}'`);
-		const loggedStackName = this.maskSecretsForLog(stackName, context);
-		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
+		const loggedStackName = this.displayMasked(stackName, context);
+		const loggedOutputName = this.displayMasked(outputName, context);
+		const loggedRegion = this.displayMasked(loggedRegionText, context);
+		const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
 		let stateData;
 		try {
 			stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
@@ -29630,7 +29643,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return value;
 				}
 			}
-			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
 		if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack '${loggedStackName}' (${loggedRegion}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 		const outputs = stateData.state.outputs ?? {};
@@ -29639,10 +29652,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${this.logTextOfLeaf(outputName, context)}' (producer ${this.logTextOfLeaf(stackName, context)} / ${loggedRegionText})`, sourceKey, {
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${this.displayLeaf(outputName, context)}' (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
 			stackName,
 			region,
 			outputKey: outputName,
@@ -29698,7 +29711,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* own comment says why. What this clause is not is redundant against
 	* `raw !== masked`: `rememberLogTwin` has no empty-key guard and
 	* `splitLogTwins` registers every piece it produces, so `registeredLogTwin`
-	* can answer `***` for the empty string and make `maskSecretsForLog('')`
+	* can answer `***` for the empty string and make `maskSecretsRaw('')`
 	* differ from `''`. Neither call site can reach it — both refuse an empty
 	* name upstream — so it fences nothing measured today.
 	*
@@ -29794,7 +29807,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	async getCrossAccountStackState(roleArn, stackName, region, context) {
 		const parsed = parseIamRoleArn(roleArn);
-		if (!parsed) throw new Error(`Fn::GetStackOutput: RoleArn '${roleArn}' is not a valid IAM role ARN. Expected shape: arn:<partition>:iam::<12-digit-account-id>:role/<role-name> (e.g. arn:aws:iam::123456789012:role/MyRole, arn:aws-us-gov:iam::...).`);
+		if (!parsed) throw new Error(`Fn::GetStackOutput: RoleArn '${displayIdent(roleArn, { maxCodePoints: 613 })}' is not a valid IAM role ARN. Expected shape: arn:<partition>:iam::<12-digit-account-id>:role/<role-name> (e.g. arn:aws:iam::123456789012:role/MyRole, arn:aws-us-gov:iam::...).`);
 		const credentials = await assumeRoleForCrossAccountStateRead(roleArn);
 		const { bucket, region: bucketRegion } = await resolveCrossAccountStateBucket(parsed.accountId, credentials);
 		const prefix = context.stateBackend?.prefix ?? "cdkd";
@@ -29851,19 +29864,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (!map) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: mapping '${this.maskSecretsForLog(mapName, context)}' not found in Mappings section`);
+			throw new Error(`Fn::FindInMap: mapping '${this.displayMasked(mapName, context)}' not found in Mappings section`);
 		}
 		const topLevel = Object.hasOwn(map, topLevelKey) ? map[topLevelKey] : void 0;
 		if (!topLevel || typeof topLevel !== "object") {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: top-level key '${this.maskSecretsForLog(topLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}'`);
+			throw new Error(`Fn::FindInMap: top-level key '${this.displayMasked(topLevelKey, context)}' not found in mapping '${this.displayMasked(mapName, context)}'`);
 		}
 		if (!Object.hasOwn(topLevel, secondLevelKey)) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: second-level key '${this.maskSecretsForLog(secondLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}' -> '${this.maskSecretsForLog(topLevelKey, context)}'`);
+			throw new Error(`Fn::FindInMap: second-level key '${this.displayMasked(secondLevelKey, context)}' not found in mapping '${this.displayMasked(mapName, context)}' -> '${this.displayMasked(topLevelKey, context)}'`);
 		}
 		const result = topLevel[secondLevelKey];
-		this.logger.debug(`Resolved Fn::FindInMap: ${this.maskSecretsForLog(mapName, context)}.${this.maskSecretsForLog(topLevelKey, context)}.${this.maskSecretsForLog(secondLevelKey, context)} -> ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(result, context)), context)}`);
+		this.logger.debug(`Resolved Fn::FindInMap: ${this.displayMasked(mapName, context)}.${this.displayMasked(topLevelKey, context)}.${this.displayMasked(secondLevelKey, context)} -> ${this.displayMasked(JSON.stringify(this.maskValueLeaves(result, context)), context)}`);
 		return result;
 	}
 	/**
@@ -29878,7 +29891,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const result = Buffer.from(resolvedValue).toString("base64");
 		const inputLogText = this.logTextOfLeaf(resolvedValue, context);
 		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskNeedlesForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
-		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(inputLogText, context)} -> ${this.maskSecretsForLog(inputLogText !== resolvedValue ? "***" : result, context)}`);
+		this.logger.debug(`Resolved Fn::Base64: ${this.displayMasked(inputLogText, context)} -> ${this.displayMasked(inputLogText !== resolvedValue ? "***" : result, context)}`);
 		return result;
 	}
 	/**
@@ -29910,7 +29923,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let loggedRegionText;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.displayMasked(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
 			loggedRegionText = this.regionLogText(resolvedValue, context);
@@ -29920,10 +29933,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
-		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.maskSecretsForLog(loggedRegionText, context)).ec2;
+		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.displayMasked(loggedRegionText, context)).ec2;
 		let azNames;
 		try {
 			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
@@ -29934,11 +29947,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.displayMasked(loggedRegionText ?? region, context)}': ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.displayMasked(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -29972,9 +29985,31 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Results are cached to avoid repeated API calls.
 	*/
 	/**
-	* Mask any resolved secret value out of a string bound for a log line, using
-	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
-	* recorded no secrets.
+	* The SECRET answer alone: mask any resolved secret value out of `text`,
+	* using the secrets recorded on the resolution pass (GHSA fix). No-op when
+	* the pass recorded no secrets.
+	*
+	* ## NOT a display form, and the name says so
+	*
+	* This was `maskSecretsForLog` until go-to-k/cdkd#3426, and the name was the
+	* defect. It answers "does this text contain a recorded secret" and makes no
+	* claim about CONTROL CHARACTERS — but it read as "the spelling a log line
+	* takes", so TEN local bindings took its result and interpolated it later,
+	* one of them reaching an `Fn::ImportValue` warn and throw with a live
+	* `ESC[2K` + CR from a template-supplied export name (measured on this tree,
+	* at DEFAULT verbosity, on the DEFAULT path). Renaming it is what makes the
+	* hazard visible at the BINDING rather than at the render: `const x =
+	* this.maskSecretsRaw(...)` states that more work is owed.
+	*
+	* Reachable from ONE place, {@link maskThenStripThenMask}, which is itself
+	* reachable only from {@link displayMasked}. That containment is the whole
+	* mechanism and it is enforced, not conventional:
+	* `scripts/check-resolver-mask-coverage.ts` does not list this method in
+	* `MASKERS`, so its AST walk — which RESOLVES an interpolated identifier to
+	* its declaration — reports any render that reaches it, through a binding or
+	* directly. Do not add it to that list, and do not call it from a new site.
+	*
+	* ## What the masking itself does
 	*
 	* A value with a registered LOG TWIN prints as its twin first (issue
 	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The needle mask
@@ -29984,7 +30019,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* reference) printed in the clear at every site that handed its RAW value
 	* here, although the pass had registered where the secret sits. Looking the
 	* twin up HERE, rather than at each such site, is what makes the class
-	* closed for raw values: every one of those sites already calls this method.
+	* closed for raw values: every one of those sites already reaches this
+	* method through the builder.
 	* The twin prints as it is: it is the raw text with masked spans, so it
 	* holds no recorded needle the raw text lacks. When the needle mask ALSO
 	* changes the raw text the whole text is masked instead, the rule
@@ -29992,8 +30028,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* cannot be merged. What this cannot see is a value TRANSFORMED before it
 	* arrives (a lowercased region, a sliced output name, an assembled
 	* sentence); those sites derive their text from the twin themselves.
+	*
+	* ## The SELF-COMPARISON, and why it did not block the strip
+	*
+	* The line below compares `maskNeedlesForLog(text) !== text` — the NEEDLE
+	* mask, not this method's own result — so making the RENDER path strip
+	* changes no comparison anywhere. An earlier revision of `displayMasked`'s
+	* comment said stripping could not move inside "the masker" because its
+	* result is also a comparison; that was a claim about this expression, and
+	* the expression's operand is a different function. The measurement that
+	* settled it: every one of this method's 20 escaping call sites rendered
+	* into a log line, a throw, or a `display:` field that becomes one — none
+	* compared, persisted or re-parsed the result — so the render path could
+	* take the strip whole.
 	*/
-	maskSecretsForLog(text, context) {
+	maskSecretsRaw(text, context) {
 		const registered = this.registeredLogTwin(text, context);
 		if (registered === void 0) return this.maskNeedlesForLog(text, context);
 		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
@@ -30012,19 +30061,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const raw = error instanceof Error ? error.message : String(error);
 		return {
 			unit,
-			subject: this.maskSecretsForLog(subject, context),
-			message: this.maskSecretsForLog(preRedact === void 0 ? raw : preRedact(raw), context),
+			subject: this.displayMasked(subject, context),
+			message: this.displayMasked(preRedact === void 0 ? raw : preRedact(raw), context),
 			error,
 			carriedDynamicReference: carriesDynamicReference(rawInput),
 			carriedFetchableReference: carriesFetchableDynamicReference(rawInput)
 		};
 	}
 	/**
-	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
+	* The needle mask alone: {@link maskSecretsRaw} without the log-twin
 	* lookup. For the two DETECTORS that must ask the needle mask apart from the
 	* position mask: `logTwinText`, which asks it of a value that already has a
 	* twin, and `resolveBase64`, whose other operand is the position mask. A
-	* message masks through `maskSecretsForLog`.
+	* message masks through `displayMasked`.
 	*/
 	maskNeedlesForLog(text, context) {
 		let masked = text;
@@ -30052,7 +30101,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* part of it outside the span. The value's own needle mask cannot be merged
 	* with the twin's positions, so the line gives both up for `***`: never
 	* more text than either mask alone would print. Returns the text BEFORE the
-	* needle mask; each log line wraps it in `maskSecretsForLog` itself, so the
+	* needle mask; each log line wraps it in `displayMasked` itself, so the
 	* resolver's mask-coverage checker sees a masker at the site.
 	*/
 	logTwinText(result, twin, context) {
@@ -30104,12 +30153,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the leaf treated as a resolution product — masked whole when it is a
 	* recorded secret, otherwise the masked twin this pass registered for it —
 	* and then `logTwinText`'s whole-line guard. The caller still wraps the
-	* result in `maskSecretsForLog`. Used where the text is needed BEFORE that
+	* result in `displayMasked`. Used where the text is needed BEFORE that
 	* masker, or apart from it: the `Fn::Base64` line and its detector, and the
 	* names issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)
 	* transforms or composes before printing (`regionLogText`,
 	* `outputNameLogText`, the invalid-region refusals, the cross-stack `origin`
-	* strings). A leaf printed as it is needs none of it: `maskSecretsForLog`
+	* strings). A leaf printed as it is needs none of it: `displayMasked`
 	* looks the twin up itself, which is how `maskValueLeaves` gives its lines
 	* and the THROWN messages it masks (the `Fn::Cidr` argument refusals, for
 	* one) the same position mask.
@@ -30349,7 +30398,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (typeof node === "string") return this.displayMasked(node, context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -30361,7 +30410,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.displayMasked(key, context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -30392,10 +30441,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* of the text in hand. A value this resolver resolved cannot be that text
 	* (the split copy is itself recorded, so the first mask catches it), but a
 	* template LITERAL can: issue #3150's region-scoped clients refusal prints
-	* a producer-region guest's region through this helper, and a literal ARN
-	* region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is masked only
-	* by the second pass (`intrinsic-resolver-name-argument-log-twin.test.ts`
-	* pins both halves on that route).
+	* a producer-region guest's region through {@link displayMasked}, and a
+	* literal ARN region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is
+	* masked only by the second pass
+	* (`intrinsic-resolver-name-argument-log-twin.test.ts` pins both halves on
+	* that route).
+	*
+	* ONE CALLER, {@link displayMasked}, since go-to-k/cdkd#3426. It is most of
+	* the answer and reads like all of it — it omits `displaySafe`, and
+	* therefore `U+2028` / `U+2029` and the bidi overrides — so a site reaching
+	* for it directly is the near-miss back onto the treadmill. It is not in
+	* `MASKERS` in `scripts/check-resolver-mask-coverage.ts`, so a render that
+	* reaches it (through a binding or directly) is reported there.
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -30404,7 +30461,109 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* solved here.
 	*/
 	maskThenStripThenMask(value, context) {
-		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+		return this.maskSecretsRaw(stripControlChars(this.maskSecretsRaw(value, context)), context);
+	}
+	/**
+	* The ONE way a masked value reaches a message in this file — and, since
+	* go-to-k/cdkd#3426, the ONLY exit from the masking machinery at all.
+	*
+	* ## Why this exists rather than a rule about call sites
+	*
+	* {@link maskSecretsRaw} answers "does this text contain a recorded secret"
+	* and makes NO claim about control characters. That split produced a
+	* four-round treadmill on go-to-k/cdkd#3408. Round 1 found the four
+	* `Fn::GetStackOutput` throws rendering a masked name raw and fixed them.
+	* Round 2 found the CloudFormation-fallback warn — the DEFAULT path, at
+	* DEFAULT verbosity — and the self-reference throw. Round 3 found the
+	* `reresolveCrossStackValue` origin builder and `describeAvailableOutputs`.
+	* Each round fixed what it found and the next round found more, because the
+	* population was never enumerated. Measured 2026-09-19 with a
+	* comment-stripped scan: SEVENTY-ONE interpolations rendered a bare masker
+	* result directly, plus thirteen hand-spelled
+	* `displaySafe(maskThenStripThenMask(...))` compositions and two bare
+	* `maskThenStripThenMask` interpolations — and three reviewers between them
+	* reached eight of the eighty-six.
+	*
+	* ROUND FIVE was the BINDING shape: `const loggedExportName =
+	* this.<masker>(...)` interpolated later, which a line-shaped scanner
+	* forbidding `${this.<masker>(` structurally cannot see. Ten of them existed,
+	* and `loggedExportName` was a LIVE exposure — an `Fn::ImportValue` export
+	* name carrying `ESC[2K` + CR reached a warn AND a throw unstripped, at
+	* default verbosity on the default path.
+	*
+	* Patching those ten sites would have been the fifth round of one
+	* enumeration. What closes the class instead is that there is no longer a
+	* masking answer a site can reach WITHOUT the strip: every escaping call of
+	* the old `maskSecretsForLog` now calls this builder, the raw masker is
+	* reachable only through {@link maskThenStripThenMask}, and that helper is
+	* reachable only from here.
+	*
+	* ## What keeps it closed
+	*
+	* `scripts/check-resolver-mask-coverage.ts` — an AST walk that already
+	* RESOLVES an interpolated identifier to its declaration and judges the
+	* initializer. Its `MASKERS` list names the functions a render may reach,
+	* and since go-to-k/cdkd#3426 every entry on it SANITIZES as well as masks.
+	* So a binding of a raw masker is a finding wherever it is later
+	* interpolated, by the same mechanism that already answered the secret
+	* question — no second scanner, and nothing line-shaped.
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts` pins the
+	* population and the builder bodies beside it.
+	*
+	* KNOWN BOUND, stated rather than implied away: a site carrying an
+	* exclusion marker is exempt from that walk, because the marker answers the
+	* SECRET question ("this value cannot carry a plaintext"), which is not the
+	* control-character question. Such a site sanitizes by hand or not at all —
+	* `clientsForRegion`'s two region renders are both markered, and both
+	* sanitize. Widening the walk to judge every interpolated value is
+	* go-to-k/cdkd#3405's mixed-render scope, not this builder's.
+	*
+	* (The marker's literal spelling is deliberately not written in this comment:
+	* the checker scans the raw text for it, and a prose mention parses as a
+	* marker no site consumes — which it then reports STALE. Measured while
+	* writing this paragraph.)
+	*
+	* ## What it does, in order
+	*
+	* `maskThenStripThenMask` first — mask, strip, mask — because
+	* `stripControlChars` DELETES, so a plaintext split by an invisible would be
+	* reconstituted contiguous by a strip applied after a single mask. Then
+	* `displaySafe`, which covers the class `stripControlChars` does not:
+	* `U+2028` / `U+2029` (line terminators to JSON and web log viewers) and the
+	* Trojan-Source bidi overrides. That composition is what the `physicalId`
+	* renders here already spelled by hand; this names it, and they now share it.
+	*
+	* It is listed in `MASKERS` in `scripts/check-resolver-mask-coverage.ts`,
+	* which is a SECURITY decision and a sound one: every path through it passes
+	* the needle-and-twin mask, twice, so it is strictly stronger than the bare
+	* masker it replaced and cannot be weaker at any input.
+	*/
+	displayMasked(value, context) {
+		return displaySafe(this.maskThenStripThenMask(value, context));
+	}
+	/**
+	* The display form of a LOG-TWIN leaf — the second render route, named for
+	* the same reason as {@link displayMasked} and closed by the same scanner.
+	*
+	* `logTextOfLeaf` resolves a value to its registered twin (or `SECRET_MASK`),
+	* which is a MASKING answer and, like `maskSecretsRaw`'s, says nothing
+	* about control characters. Four `origin` builders interpolated it raw — the
+	* `Fn::ImportValue` pair, the `Fn::GetStackOutput` one and the nested-stack
+	* attribute one — and those strings flow into `redactedAttributeReads[].display`
+	* and out through a `ProvisioningError` message.
+	*
+	* This route is why fixing the secret masker alone did not close the class:
+	* `displayMasked` covers every site that renders a needle-masked value, and
+	* these render something else. Two routes, two names, one checker refusing
+	* the raw form of both.
+	*
+	* Composed rather than re-derived. `maskSecretsInText` is idempotent (see
+	* {@link maskThenStripThenMask}), so masking twin text again costs nothing
+	* and cannot change the twin — which keeps this a STRICT addition of the
+	* strip and the `displaySafe` pass, with the twin resolution untouched.
+	*/
+	displayLeaf(value, context) {
+		return this.displayMasked(this.logTextOfLeaf(value, context), context);
 	}
 	async resolveDynamicReferences(value, context) {
 		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
@@ -30455,7 +30614,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					continue;
 				}
 				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.displayMasked(tokenLogText, context)}: it names '${this.displayMasked(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.displayMasked(regionVerdict.foreignProducerRegions.map((r) => this.displayMasked(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 				if (regionVerdict.kind === "named-region") {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
@@ -30520,11 +30679,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					resolved = param.value;
 				} else if (service === "ssm-secure") {
 					const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
-					if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+					if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 					isSecret = true;
 					resolved = param.value;
 				} else {
-					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
 				}
@@ -30612,9 +30771,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		const loggedSecretId = this.maskSecretsForLog(nameLogText(secretId), context);
-		const loggedJsonKey = this.maskSecretsForLog(nameLogText(jsonKey), context);
-		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(nameLogText(versionStage), context)}:${this.maskSecretsForLog(nameLogText(versionId), context)}`);
+		const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
+		const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.displayMasked(nameLogText(versionStage), context)}:${this.displayMasked(nameLogText(versionId), context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
@@ -30656,7 +30815,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
 		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -30688,7 +30847,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				results.push(`${a}.${b}.${c}.${d}/${subnetPrefix}`);
 			}
 		}
-		this.logger.debug(`Fn::Cidr result: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(results, context)), context)}`);
+		this.logger.debug(`Fn::Cidr result: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(results, context)), context)}`);
 		return results;
 	}
 	/** Expand IPv6 address to full 8-group form */
@@ -30778,7 +30937,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		const loggedParameterName = this.maskSecretsForLog(nameLogText(parameterName), context);
+		const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
 		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
@@ -32476,7 +32635,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dwnb3CES.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DNzgk-BS.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45543,4 +45702,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-Bcwb9_mO.js.map
+//# sourceMappingURL=deploy-engine-21iNqwR3.js.map