@go-to-k/cdkd 0.290.30 → 0.290.32

package/dist/{deploy-engine-mI1Xv1oi.js → deploy-engine-CfOsVRQB.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BjWM-UVj.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-C15BftsD.js";
+import { t as getCdkdVersion } from "./version-F41ektvu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9980,18 +9980,54 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	const stackIsExact = safeStack === stackName;
 	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
 	const regionIsExact = region === void 0 || safeRegion === region;
-	const safeRecovery = {
-		profile: sanitizeRecoveryValue(recovery?.profile),
-		stateBucket: sanitizeRecoveryValue(recovery?.stateBucket),
-		statePrefix: sanitizeRecoveryValue(recovery?.statePrefix)
+	const recoveryFlags = recoveryCommandFlags(recovery);
+	if (!safeStack || safeRegion === "" || !stackIsExact || !regionIsExact || !recoveryFlags.exact) return "";
+	return [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`, ...recoveryFlags.flags].join(" ");
+}
+/**
+* A placeholder for a value a pasteable command could not name, QUOTED.
+*
+* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
+* reads stdin from a file named `profile` and `>` sends stdout to whatever
+* word follows. While the hole was the command's LAST word that was only a
+* syntax error; with flags appended after it (`--profile <profile>
+* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
+* redirect target and `b` as the profile — a delete against the ambient
+* bucket, with nothing printed (measured by the maintainer, M4 of the
+* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
+* nothing else — no redirection, no swallowed flag. It is not refused: an
+* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
+* `<prefix>`).
+*/
+function commandHole(name) {
+	return `'<${name}>'`;
+}
+/**
+* The flags that pin a pasteable state command to the caller's account and
+* bucket: `--profile`, the resolved `--state-bucket`, and a NON-default
+* `--state-prefix` (see {@link LockRecoveryContext} for why each is emitted
+* when it is). ONE spelling, shared by {@link buildForceUnlockCommand} and the
+* `cdkd orphan` properties refusal `malformed-resources-bag.ts` builds
+* (go-to-k/cdkd#3363): after `cdkd orphan --profile prod ...` a remedy that
+* carried none of these resolved the DEFAULT profile's bucket when pasted.
+* Each fragment takes {@link sanitizeRecoveryValue}'s sanitize + exactness
+* pair (go-to-k/cdkd#3377); what a caller does with an inexact one is its
+* own call — `buildForceUnlockCommand` suppresses the whole command, the orphan
+* refusal prints the hole.
+*/
+function recoveryCommandFlags(recovery) {
+	const profile = sanitizeRecoveryValue(recovery?.profile);
+	const stateBucket = sanitizeRecoveryValue(recovery?.stateBucket);
+	const statePrefix = sanitizeRecoveryValue(recovery?.statePrefix);
+	const flags = [];
+	if (profile.text || !profile.exact) flags.push(profile.exact ? `--profile ${shellQuote(profile.text)}` : `--profile ${commandHole("profile")}`);
+	if (stateBucket.text || !stateBucket.exact) flags.push(stateBucket.exact ? `--state-bucket ${shellQuote(stateBucket.text)}` : `--state-bucket ${commandHole("bucket")}`);
+	const prefix = recovery?.statePrefix;
+	if (prefix !== void 0 && prefix !== "cdkd") flags.push(statePrefix.exact ? `--state-prefix ${shellQuote(statePrefix.text)}` : `--state-prefix ${commandHole("prefix")}`);
+	return {
+		flags,
+		exact: profile.exact && stateBucket.exact && statePrefix.exact
 	};
-	const recoveryIsExact = Object.values(safeRecovery).every((v) => v.exact);
-	if (!safeStack || safeRegion === "" || !stackIsExact || !regionIsExact || !recoveryIsExact) return "";
-	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
-	if (safeRecovery.profile.text) parts.push(`--profile ${shellQuote(safeRecovery.profile.text)}`);
-	if (safeRecovery.stateBucket.text) parts.push(`--state-bucket ${shellQuote(safeRecovery.stateBucket.text)}`);
-	if (safeRecovery.statePrefix.text && safeRecovery.statePrefix.text !== "cdkd") parts.push(`--state-prefix ${shellQuote(safeRecovery.statePrefix.text)}`);
-	return parts.join(" ");
 }
 /**
 * Sanitize ONE {@link LockRecoveryContext} fragment and report whether that
@@ -17109,7 +17145,8 @@ var DagBuilder = class {
 		resourceIds.forEach((logicalId) => {
 			const resource = this.parser.getResource(template, logicalId);
 			graph.setNode(logicalId, resource);
-			this.logger.debug(`Added node: ${logicalId} (${resource?.Type})`);
+			const typeText = resource?.Type == null ? "<no Type>" : displayIdent(resource.Type);
+			this.logger.debug(`Added node: ${displayIdent(logicalId)} (${typeText})`);
 		});
 		this.logger.debug(`Total nodes: ${resourceIds.length}`);
 		const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
@@ -17123,15 +17160,15 @@ var DagBuilder = class {
 			for (const depId of dependencies) {
 				if (skip?.has(depId)) {
 					relaxedEdgeCount++;
-					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${depId} -> ${logicalId} (default; opt out with --no-aggressive-vpc-parallel)`);
+					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)} (default; opt out with --no-aggressive-vpc-parallel)`);
 					continue;
 				}
 				if (graph.hasNode(depId)) {
 					graph.setEdge(depId, logicalId);
 					edgeCount++;
-					this.logger.debug(`Added edge: ${depId} -> ${logicalId}`);
-				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${logicalId} -> ${depId}`);
-				else this.logger.warn(`Resource ${logicalId} depends on ${depId}, but ${depId} not found in template`);
+					this.logger.debug(`Added edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)}`);
+				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${displayIdent(logicalId)} -> ${displayIdent(depId)}`);
+				else this.logger.warn(`Resource ${displayIdent(logicalId)} depends on ${displayIdent(depId)}, but ${displayIdent(depId)} not found in template`);
 			}
 		}
 		if (relaxedEdgeCount > 0) this.logger.info(`[DagBuilder] Relaxed ${relaxedEdgeCount} CDK-defensive DependsOn edge(s) (default; opt out with --no-aggressive-vpc-parallel)`);
@@ -17140,7 +17177,7 @@ var DagBuilder = class {
 		edgeCount += this.addLambdaVpcEdges(graph, template);
 		if (!alg.isAcyclic(graph)) {
 			const cycles = this.findCycles(graph);
-			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.join(" -> ")).join("; ")}`);
+			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.map((n) => displayIdent(n)).join(" -> ")).join("; ")}`);
 		}
 		return graph;
 	}
@@ -17172,9 +17209,9 @@ var DagBuilder = class {
 			});
 			if (readyNodes.length === 0) {
 				const remaining = graphCopy.nodes();
-				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.join(", ")}`);
+				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.map((n) => displayIdent(n)).join(", ")}`);
 			}
-			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.join(", ")}`);
+			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.map((n) => displayIdent(n)).join(", ")}`);
 			levels.push(readyNodes);
 			readyNodes.forEach((node) => {
 				graphCopy.removeNode(node);
@@ -17291,7 +17328,7 @@ var DagBuilder = class {
 				if (graph.hasEdge(policyId, logicalId)) continue;
 				graph.setEdge(policyId, logicalId);
 				added++;
-				this.logger.debug(`Added implicit edge (custom resource policy): ${policyId} -> ${logicalId}`);
+				this.logger.debug(`Added implicit edge (custom resource policy): ${displayIdent(policyId)} -> ${displayIdent(logicalId)}`);
 			}
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for custom resource policies`);
@@ -17322,7 +17359,7 @@ var DagBuilder = class {
 			if (graph.hasEdge(depId, dependentId)) continue;
 			graph.setEdge(depId, dependentId);
 			added++;
-			this.logger.debug(`Added implicit edge (lambda vpc): ${depId} -> ${dependentId}`);
+			this.logger.debug(`Added implicit edge (lambda vpc): ${displayIdent(depId)} -> ${displayIdent(dependentId)}`);
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for Lambda VpcConfig`);
 		return added;
@@ -21846,19 +21883,70 @@ function stackClause(stackName, region) {
 * `destroy-runner.ts`; since go-to-k/cdkd#3328 the first operand is the S3
 * KEY's region rather than the record body's, which is a key SEGMENT and so
 * still plantable) -- its stack name is the caller's, so the region alone is
-* what would aim a destructive command using a value cdkd does not own. This one is reached only with the caller's
-* synthesized stack and `pickStackRegion`'s answer, so substituting is safe and
-* omitting the region is the wider action. Two opposite precedents in one
-* module; neither is the general rule.
+* what would aim a destructive command using a value cdkd does not own. This
+* one is reached only with the caller's synthesized stack and
+* `pickStackRegion`'s answer, so omitting the region is the wider action. Two
+* opposite precedents in one module; neither is the general rule.
+*
+* **Substitution is GATED on the identity rendering EXACTLY, at
+* `STACK_REF_MAX_CODE_POINTS`** (go-to-k/cdkd#3360, and the M0 finding of the
+* go-to-k/cdkd#3363 review). The synthesized name is not validated: a prebuilt
+* cloud assembly's manifest reaches `cdkd orphan` unread, so a name `safeIdentifier`
+* would TRIM (`'prod-api '`) substitutes as a healthy sibling's, and one it would
+* TRUNCATE (a 166-code-point nested name at the 128 default) becomes a command
+* `cdkd state orphan` resolves to zero records and reports as a skip at exit 0.
+* Since go-to-k/cdkd#3359 the legacy shape carries no `--stack-region`, so the
+* name is the ONLY thing narrowing this DELETE. The template arm is the fallback,
+* and the caller says where to take the name from instead
+* ({@link rendersExactly} is the test, shared with the inspect line and the
+* object path).
+*
+* `recovery` qualifies EVERY arm, the no-identity template included, the way
+* {@link buildForceUnlockCommand} is qualified, through the same `recoveryCommandFlags`: `cdkd state orphan`
+* re-resolves the bucket from the ambient profile, so a remedy pasted after
+* `cdkd orphan --profile prod ...` would otherwise address the default
+* profile's account. The template keeps them too: the identity is the hole,
+* not the account, and an operator who fills only the hole would otherwise run
+* an UNQUALIFIED delete — which `cdkd state orphan` reports as a skip at exit 0
+* when the default bucket has no such record, and offers to delete when it has
+* one (the M3 finding of the go-to-k/cdkd#3363 review).
+*/
+function dropRecordCommand(stackName, region, recovery) {
+	if (stackName === void 0 || stackName === "") return [`cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+	const known = region === void 0 || region === "" ? void 0 : region;
+	const regionExact = known === void 0 || rendersExactly(known);
+	if (!rendersExactly(stackName) || !regionExact) {
+		const flag = known === void 0 ? "" : regionExact ? ` --stack-region ${shellQuote(known)}` : ` --stack-region ${commandHole("region")}`;
+		return [`cdkd state orphan ${commandHole("stack")}${flag}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+	}
+	const flag = known === void 0 ? "" : ` --stack-region ${shellQuote(known)}`;
+	return [`cdkd state orphan ${shellQuote(stackName)}${flag}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/**
+* Whether an identity survives {@link safeIdentifier} UNCHANGED at the
+* state-record grammar's cap, so a command or a key built from it addresses the
+* record the message is about. The cap is `STACK_REF_MAX_CODE_POINTS`, not the
+* 128 the prose uses: `cdkd orphan` reads a PREBUILT assembly's stack name
+* unvalidated, so a manifest can carry one past 128 that is nonetheless the
+* record's real key, and truncating it names nothing — the same bound
+* `malformedDestroyResourcesRefusalMessage` uses, reached from a different
+* source.
+*
+* What it covers: every identity the `cdkd orphan` properties refusal builds
+* something PASTEABLE from — the drop command ({@link dropRecordCommand}), the
+* `cdkd state show` line ({@link orphanInspectCommand}) and the object path
+* ({@link orphanInspectClause}) — so no two of them can disagree about a name
+* (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
+* destroy refusal and the divergent-region refusal above still spell the same
+* test inline, and the shared {@link inspectCommand} is ungated at 128 for its
+* other callers.
 */
-function dropRecordCommand(stackName, region) {
-	if (stackName === void 0 || stackName === "") return "cdkd state orphan <stack> --stack-region <region>";
-	const flag = region === void 0 || region === "" ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
-	return `cdkd state orphan ${shellQuote(safeIdentifier(stackName))}${flag}`;
+function rendersExactly(value) {
+	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
 }
 /** The remedy command {@link stackClause}'s message ends on. */
 function inspectCommand(stackName, region) {
-	if (stackName === void 0) return "cdkd state show <stack> --stack-region <region> --json";
+	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
 	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
 	return `cdkd state show ${shellQuote(safeIdentifier(stackName))}${flag} --json`;
 }
@@ -22163,10 +22251,144 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 * stack name and the region `pickStackRegion` settled on, never the record's
 * own unvalidated self-report. See {@link stackClause}.
 */
-function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = rawStackName === "" ? void 0 : rawStackName;
 	const region = rawRegion === "" ? void 0 : rawRegion;
-	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with '${dropRecordCommand(stackName, region)}', which leaves the live AWS resources standing. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two. Inspect the record with: ${inspectCommand(stackName, region)}`;
+	const inspect = orphanInspectClause(stackName, region, recovery);
+	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
+	const commands = [
+		`Drop the record: ${dropRecordCommand(stackName, region, recovery)}`,
+		...listCommand === void 0 ? [] : [`Find the exact name: ${listCommand}`],
+		...inspect.command === void 0 ? [] : [`Inspect the record: ${inspect.command}`]
+	];
+	return [
+		`${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.` + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
+		...commands,
+		...inspect.locations ?? []
+	].join("\n");
+}
+/**
+* The half-sentence that accompanies a TEMPLATE drop remedy when a stack name
+* WAS known but it, or the region beside it, did not render exactly. The prose
+* above it prints the sanitized spelling, and an operator filling the template
+* from that spelling would be aiming at the healthy sibling the gate exists to
+* protect (`'prod-api '` renders as `prod-api`; a padded region is the same
+* misdirection one flag over), so the message says where to take them from
+* instead: `cdkd state list --json`, which writes the raw name
+* through `JSON.stringify` — `--long` renders through `displayIdent`, which
+* trims, so it would hand back the same spelling. Empty when the command was
+* substituted, and when no name was known at all — that arm's template already
+* reads as a hole to fill.
+*/
+function withheldIdentityClause(stackName, region) {
+	if (!identityWithheld(stackName, region)) return "";
+	return " — the stack name or region above did not render exactly, so take them from the 'Find the exact name' command below — replace each quoted hole, quotes included, with the shell-quoted value — rather than from this message";
+}
+/**
+* The half-sentence for the OTHER thing that can print as a hole: one of the
+* account fragments `recoveryCommandFlags` appends.
+*
+* Separate from {@link withheldIdentityClause} rather than folded into it,
+* because the two holes have different SOURCES and therefore different remedies.
+* An identity hole is filled from `cdkd state list --json`, which is why that
+* clause points at a command; an account fragment came from the operator's own
+* argv, so they already hold it and no listing would help. Conflating them would
+* send someone to a listing that does not carry their `--profile`.
+*
+* Without this, a run whose PREFIX or BUCKET was the inexact value printed
+* `--state-prefix '<prefix>'` with nothing in the message saying the hole was a
+* hole: `identityWithheld` reads the stack name and the region only, and the
+* object-path note is suppressed whenever a prefix WAS supplied. That is
+* {@link withheldIdentityClause}'s own defect class, one fragment over.
+*/
+function withheldRecoveryClause(recovery) {
+	if (recoveryCommandFlags(recovery).exact) return "";
+	return " — an account fragment ('--profile', '--state-bucket' or '--state-prefix') did not render exactly, so the command lines below print a quoted hole in its place, which you replace whole — quotes included — with the SHELL-QUOTED value you passed this run";
+}
+/**
+* The listing {@link withheldIdentityClause} points at, printed as its own
+* trailing command line. Qualified like the remedy it stands in for: a bare
+* listing after `cdkd orphan --profile prod ...` would read the DEFAULT
+* profile's bucket, and the name it hands back would then be a different
+* bucket's.
+*/
+function withheldIdentityListCommand(stackName, region, recovery) {
+	if (!identityWithheld(stackName, region)) return void 0;
+	return ["cdkd state list --json", ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/** A name WAS known, and it or the region beside it did not render exactly. */
+function identityWithheld(stackName, region) {
+	if (stackName === void 0 || stackName === "") return false;
+	const known = region === "" ? void 0 : region;
+	return !(rendersExactly(stackName) && (known === void 0 || rendersExactly(known)));
+}
+/**
+* The `cdkd state show` command on the orphan properties refusal's trailing
+* `Inspect the record:` line, for a record listed WITH a region — gated and
+* qualified exactly as the drop command on the line above it is, because it is
+* the same identity in the same message.
+* Gating only the drop command left the message contradicting itself: it said
+* the name did not render exactly, pointed at `cdkd state list --json`, and then
+* printed `cdkd state show prod-api ...` with the trimmed spelling of
+* `'prod-api '`, naming the healthy sibling (the M2 finding of the
+* go-to-k/cdkd#3363 review). Holes follow {@link dropRecordCommand}'s rule: an
+* altered region makes both a hole, an altered name only the name.
+*
+* Built here rather than by widening {@link inspectCommand}, which serves four
+* other builders whose identities come from different sources (and this one no
+* longer calls it at all).
+*/
+function orphanInspectCommand(stackName, region, recovery) {
+	const regionExact = rendersExactly(region);
+	return [`cdkd state show ${regionExact && rendersExactly(stackName) ? shellQuote(stackName) : commandHole("stack")} --stack-region ${regionExact ? shellQuote(region) : commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/**
+* How {@link malformedOrphanResourcePropertiesRefusalMessage} tells the operator
+* to inspect the record: a `command` it prints on its trailing
+* `Inspect the record:` line, or — for the legacy region-less shape, where no
+* command can serve — a prose `sentence` naming the S3 object.
+*
+* A KNOWN stack with NO region is a legacy record (`<prefix>/<stack>/state.json`)
+* that `listStacks` lists with no region — `cdkd orphan` hands this module the
+* region the record is LISTED under since go-to-k/cdkd#3359, and that is
+* `undefined` only for such a ref (its body names no region, or the probe that
+* reads it could not). `cdkd state show` refuses such a record with or without
+* `--stack-region` ("has only a legacy state record without a region"), and the
+* migration it suggests is a `cdkd deploy`, which refuses this very record
+* (go-to-k/cdkd#3191). So ending on `cdkd state show` would hand the operator a
+* command that cannot serve them; the line names the S3 object instead. Teaching
+* `state show` to read a legacy record was the alternative, declined as a wider
+* change to a command that is not the one refusing.
+*
+* The object path is printed only when the stack name {@link rendersExactly}: a
+* path with a sanitized or truncated segment names an object that does not
+* exist. The name comes from the assembly, and `cdkd orphan` accepts a PREBUILT
+* one whose manifest nothing validates, which is what makes an inexact name
+* reachable at all (go-to-k/cdkd#3360); an S3 key's `Parent~Child` name, the
+* case the destroy refusal's gate was written for, cannot appear here.
+*
+* With `recovery` the path carries the REAL prefix and names the bucket, the
+* way the drop remedy above it is qualified; without it the prefix is a
+* placeholder and the sentence says how to fill it.
+*/
+function orphanInspectClause(stackName, region, recovery) {
+	if (stackName === void 0 || stackName === "") return { command: [`cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ") };
+	if (region !== void 0) return { command: orphanInspectCommand(stackName, region, recovery) };
+	const lead = "The record is listed with no region — a legacy 'state.json' whose body names none, or one the listing could not read — which 'cdkd state show' cannot read and a 'cdkd deploy' will not migrate while it is torn, so inspect the object directly";
+	const exactOrUndefined = (v) => v !== void 0 && sanitizeRecoveryValue(v).exact ? v : void 0;
+	const bucket = exactOrUndefined(recovery?.stateBucket) || void 0;
+	const locations = bucket === void 0 ? [] : [`State bucket: ${shellQuote(bucket)}`];
+	const where = bucket === void 0 ? `, in the state bucket ('cdkd state info' names it)` : `, in the bucket on the 'State bucket' line below`;
+	if (!rendersExactly(stackName)) return {
+		sentence: `${lead}: it is the legacy 'state.json' under this stack name, which did not render exactly${where}.`,
+		locations
+	};
+	const prefix = exactOrUndefined(recovery?.statePrefix);
+	const key = shellQuote(`${prefix ?? "<prefix>"}/${stackName}/state.json`);
+	return {
+		sentence: `${lead}: the 'Object key' line below names it${where}.${recovery?.statePrefix === void 0 ? ` Its prefix is 'cdkd' unless '--state-prefix' was given.` : prefix === void 0 ? " The prefix you passed did not render exactly, so the key shows the hole '<prefix>' where it belongs; put your own value there, inside the outer quotes." : ""}`,
+		locations: [`Object key: ${key}`, ...locations]
+	};
 }
 /**
 * For `cdkd orphan`: refuse a record whose SURVIVING resource entries carry a
@@ -22220,11 +22442,11 @@ function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion
 * The orphan set is resolved from the synthesized template before the state is
 * loaded, so nothing forces this call any lower.
 */
-function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region) {
+function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
 	const removed = new Set(removedLogicalIds);
 	const unreadable = unreadableResourcePropertyBags(state).filter((id) => !removed.has(id));
 	if (unreadable.length === 0) return;
-	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
 /**
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
@@ -25780,7 +26002,7 @@ function detectUnknownIntrinsicKey(obj) {
 function buildUnknownIntrinsicError(key) {
 	const title = `Support intrinsic ${key}`;
 	const issueUrl = `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(title)}&labels=intrinsic-support`;
-	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
+	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${displayIdent(key)}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
 /**
 * The same context with the `producerRegions` EVIDENCE removed (issue #2134
@@ -27188,14 +27410,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
 		this.regionScopedClients.set(target, scoped);
-		this.logger.debug(`Using region-scoped AWS clients for ${loggedTarget}`);
+		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
 	/**
@@ -27261,7 +27483,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	async resolveParameters(template, userParameters, options) {
 		const inheritedSecrets = options?.inheritedSecrets;
-		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
+		const maskInherited = (text) => {
+			const mask = (value) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(value, inheritedSecrets) : value;
+			return displaySafe(mask(stripControlChars(mask(text))));
+		};
 		const inheritedLogContext = {
 			template,
 			resources: {},
@@ -27273,13 +27498,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let referencedNames;
 		for (const [name, definition] of Object.entries(templateParameters)) {
 			const paramDef = definition;
-			if (isUnboundTemplateParameter(name, template, userParameters)) throw new Error(`Parameter ${name} is required but no value was provided and no default exists`);
+			if (isUnboundTemplateParameter(name, template, userParameters)) throw new Error(`Parameter ${maskInherited(name)} is required but no value was provided and no default exists`);
 			if (userParameters && Object.hasOwn(userParameters, name)) {
 				const userValue = userParameters[name];
 				if (userValue !== void 0) {
 					this.refuseCoercedInheritedSecret(name, paramDef, userValue, inheritedSecrets);
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
 					continue;
 				}
 			}
@@ -27287,19 +27512,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (paramDef.Type.startsWith("AWS::SSM::Parameter::Value")) {
 					referencedNames ??= collectReferencedParameterNames(template);
 					if (!referencedNames.has(name)) {
-						this.logger.debug(`Parameter ${name}: skipping SSM resolution (not referenced by Resources/Outputs/Conditions)`);
+						this.logger.debug(`Parameter ${maskInherited(name)}: skipping SSM resolution (not referenced by Resources/Outputs/Conditions)`);
 						continue;
 					}
 					const ssmPath = String(paramDef.Default);
-					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: resolving SSM parameter path ${maskInherited(ssmPath)}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
 					const resolvedType = ssmResolvedValueType(paramDef.Type);
 					parameters[name] = resolvedType === void 0 ? resolved : this.coerceParameterValue(resolved, resolvedType);
-					this.logger.debug(`Parameter ${name}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
 					continue;
 				}
 				parameters[name] = coerceParameterDefault(paramDef.Default, paramDef.Type);
-				this.logger.debug(`Parameter ${name}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
+				this.logger.debug(`Parameter ${maskInherited(name)}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
 				continue;
 			}
 		}
@@ -27341,11 +27566,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const inProgress = /* @__PURE__ */ new Set();
 		const evaluateByName = async (name) => {
 			if (Object.hasOwn(conditions, name)) return conditions[name];
-			if (inProgress.has(name)) throw new Error(`Circular condition reference detected involving condition "${name}"`);
+			if (inProgress.has(name)) throw new Error(`Circular condition reference detected involving condition "${this.displayMasked(name, maskingContext)}"`);
 			const bag = templateConditions;
 			const definition = Object.hasOwn(bag, name) ? bag[name] : void 0;
 			if (definition === void 0) {
-				this.logger.warn(`Condition ${name} not found in template, assuming false`);
+				this.logger.warn(`Condition ${this.displayMasked(name, maskingContext)} not found in template, assuming false`);
 				conditions[name] = false;
 				return false;
 			}
@@ -27357,7 +27582,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				});
 				const value = Boolean(result);
 				conditions[name] = value;
-				this.logger.debug(`Evaluated condition ${name} = ${value}`);
+				this.logger.debug(`Evaluated condition ${this.displayMasked(name, maskingContext)} = ${value}`);
 				return value;
 			} finally {
 				inProgress.delete(name);
@@ -27366,7 +27591,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const name of Object.keys(templateConditions)) try {
 			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
-			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
+			this.logger.warn(this.displayMasked(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
 			inProgress.delete(name);
 		}
@@ -27470,7 +27695,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					configurable: true
 				});
 				else resolved[key] = resolvedVal;
-			} else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
+			} else this.logger.debug(`Property ${this.displayMasked(key, context)} resolved to AWS::NoValue, omitting from object`);
 		}
 		return resolved;
 	}
@@ -27633,7 +27858,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const carriedBefore = inheritedSecretsCarriedBy(userValue, inherited).length;
 		if (carriedBefore === 0) return;
 		if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), inherited).length >= carriedBefore) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${name}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${name}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+		const loggedName = this.displayMasked(name);
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 	}
 	/**
 	* Resolve Ref intrinsic function
@@ -27647,14 +27873,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (resource) {
 			const refValue = this.resolveRefValue(logicalId, resource, context);
-			this.logger.debug(`Resolved Ref to resource: ${logicalId} -> ${refValue}`);
+			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${refValue}`);
 			return refValue;
 		}
 		if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
 			const value = context.parameters[logicalId];
 			const declared = context.template.Parameters;
 			const paramDef = declared != null && Object.hasOwn(declared, logicalId) ? declared[logicalId] : void 0;
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.displayMasked(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${this.displayMasked(logicalId, context)} -> ${this.displayMasked(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
 			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
@@ -27664,10 +27890,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${valueStr}`);
 			return pseudoValue;
 		}
-		const notFoundMsg = `Ref ${logicalId} not found (not a resource, parameter, or pseudo parameter)`;
+		const loggedLogicalId = this.displayMasked(logicalId, context);
+		const notFoundMsg = `Ref ${loggedLogicalId} not found (not a resource, parameter, or pseudo parameter)`;
 		if (context.bestEffort) this.logger.debug(notFoundMsg);
 		else this.logger.warn(notFoundMsg);
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${logicalId} not found`));
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${loggedLogicalId} not found`));
 	}
 	/**
 	* Resolve the value a CloudFormation `Ref` returns for a resource.
@@ -27753,10 +27980,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* nothing to do at this site: the value has ALREADY been masked in state, so
 	* there is no plaintext to register.
 	*
-	* The SPELLING (`Ref <LogicalId> (state key <Key>)`) is what
-	* `DeployEngine.maskedRecordRemedyFor` partitions on, so it is load-bearing
-	* rather than cosmetic — that helper reads the logical id out of it to emit
-	* the re-import command, and pins the shape in a test.
+	* THE SPELLING IS NO LONGER PARSED, and this paragraph used to say the
+	* opposite (corrected in go-to-k/cdkd#3432). It read: "`Ref <LogicalId>
+	* (state key <Key>)` is what `DeployEngine.maskedRecordRemedyFor` partitions
+	* on ... that helper reads the logical id out of it". That was true when it
+	* was written and stopped being true at that helper's round-4 review, which
+	* moved the partition onto the `kind` / `logicalId` FIELDS precisely because
+	* two successive regexes over this rendering each shipped a defect — the
+	* second an `[A-Za-z0-9]+` id class that a HYPHENATED logical id falls out
+	* of. `targetOf` reads `read.logicalId`; no regex touches `display`.
+	*
+	* What the shape IS still load-bearing for is a SENTENCE: the refusal's
+	* `hasRefStateRead` arm tells the reader that "a 'Ref <LogicalId> (state key
+	* <Key>)' entry above is CDKD's own read", so the `Ref ` prefix and the
+	* `(state key ...)` clause have to keep appearing. Sanitizing the ID inside
+	* them leaves both intact.
+	*
+	* THE ID IS SANITIZED, the attribute-read sibling's judgement one branch over
+	* (go-to-k/cdkd#3432). `displayMasked` rather than `displayIdent`: the
+	* builder neither quotes nor bounds, so every legitimate id renders exactly
+	* as it did, and the deliberate collision `intrinsic-ref-state-mask.test.ts`
+	* pins between this rendering and `noteAttributeSecrecy`'s is preserved
+	* because BOTH sites take the same builder. The `logicalId` FIELD stays raw —
+	* it is the routing key and the `--resource <id>=` argument.
 	*
 	* `key` is never masked before interpolation because it is not template text:
 	* it comes from the fixed key lists `cfnRefValueFromPhysicalId` passes
@@ -27768,7 +28014,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			kind: "ref-state-key",
 			logicalId,
 			key,
-			display: `Ref ${logicalId} (state key ${key})`
+			display: `Ref ${this.displayMasked(logicalId, context)} (state key ${key})`
 		});
 	}
 	/**
@@ -27810,7 +28056,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const [rawLogicalId, rawAttributeName] = getAtt;
 			logicalId = rawLogicalId;
 			const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
+			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${this.displayMasked(logicalId, context)} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
@@ -27819,7 +28065,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			attributeName = split.attributeName;
 		}
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
-		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${logicalId} not found for Fn::GetAtt`));
+		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
@@ -27827,10 +28073,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -27843,18 +28089,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
-			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.maskSecretsForLog(this.outputNameLogText(k, context), context));
+			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.displayMasked(this.outputNameLogText(k, context), context));
 			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			const loggedLogicalId = this.displayMasked(logicalId, context);
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${loggedLogicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
 	/**
@@ -27905,12 +28152,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const maskedAttributeName = this.maskSecretsForLog(attributeName, context);
+			const maskedAttributeName = this.displayMasked(attributeName, context);
 			this.pushRedactedAttributeRead(context, {
 				kind: "attribute",
 				logicalId,
 				key: maskedAttributeName,
-				display: `${logicalId}.${maskedAttributeName}`
+				display: `${this.displayMasked(logicalId, context)}.${maskedAttributeName}`
 			});
 		}
 		return value;
@@ -27947,7 +28194,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -27992,7 +28239,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -28054,7 +28301,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": {
-				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
+				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
 				const cachedGroupId = cachedVpcDefaultSecurityGroups[physicalId];
 				if (cachedGroupId !== void 0) return cachedGroupId;
 				let groupId;
@@ -28269,7 +28516,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": {
-				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
+				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
 				const cachedVpcId = cachedSecurityGroupVpcIds[physicalId];
 				if (cachedVpcId !== void 0) return cachedVpcId;
 				let vpcId;
@@ -28386,7 +28633,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::CloudFront::Distribution") switch (attributeName) {
 			case "Id": return physicalId;
 			case "DomainName": {
-				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
+				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
 				const cachedDomainName = cachedCloudFrontDomainNames[physicalId];
 				if (cachedDomainName !== void 0) return cachedDomainName;
 				let domainName;
@@ -28420,7 +28667,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBProxy" || resourceType === "AWS::RDS::DBProxyEndpoint") {
-			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
+			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
 			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -28479,7 +28726,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	refuseUnservedAttribute(site) {
 		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
 	}
 	/**
 	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
@@ -28526,9 +28773,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
@@ -28806,13 +29053,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -29004,7 +29251,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") {
 			const source = this.describeSplitValueSource(value);
-			const sourceClause = source ? ` (from ${source.label})` : "";
+			const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
 			if (Array.isArray(resolvedValue)) {
 				const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
@@ -29025,12 +29272,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveIf(ifArgs, context) {
 		const [conditionName, valueIfTrue, valueIfFalse] = ifArgs;
 		if (!context.conditions || !Object.hasOwn(context.conditions, conditionName)) {
-			this.logger.warn(`Condition ${conditionName} not found in context, assuming false`);
+			this.logger.warn(`Condition ${this.displayMasked(String(conditionName), context)} not found in context, assuming false`);
 			return await this.resolveValue(valueIfFalse, context);
 		}
 		const conditionValue = context.conditions[conditionName];
 		const selectedValue = conditionValue ? valueIfTrue : valueIfFalse;
-		this.logger.debug(`Resolved Fn::If: condition ${conditionName} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
+		this.logger.debug(`Resolved Fn::If: condition ${this.displayMasked(String(conditionName), context)} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
 		return await this.resolveValue(selectedValue, context);
 	}
 	/**
@@ -29061,7 +29308,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveConditionReference(conditionName, context) {
 		if (context.conditionResolver) return await context.conditionResolver(conditionName);
 		if (context.conditions && Object.hasOwn(context.conditions, conditionName)) return context.conditions[conditionName];
-		this.logger.warn(`Condition ${conditionName} not found in context, assuming false`);
+		this.logger.warn(`Condition ${this.displayMasked(conditionName, context)} not found in context, assuming false`);
 		return false;
 	}
 	/**
@@ -29193,7 +29440,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return recovered;
 			}
 			if (context.redactedAttributeReads !== void 0) {
-				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				const loggedOrigin = this.displayMasked(origin, context);
 				this.pushRedactedAttributeRead(context, {
 					kind: "cross-stack",
 					display: loggedOrigin
@@ -29287,7 +29534,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const target = canonicalizeRegion(producerRegion);
 		if (target === canonicalizeRegion(this.explicitRegion)) return this;
 		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
-		const guestRegionText = this.maskThenStripThenMask(regionText, context);
+		const guestRegionText = this.displayMasked(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
 		if (cached) {
 			if (cached.explicitRegionLogText !== guestRegionText) cached.explicitRegionLogText = "***";
@@ -29313,7 +29560,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
-		const loggedExportName = this.maskSecretsForLog(exportName, context);
+		const loggedExportName = this.displayMasked(exportName, context);
 		this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 		if (context.exportIndex) {
 			let entry;
@@ -29442,7 +29689,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `OutputName` is the overwhelmingly common cause, and the list is what makes
 	* the error actionable.
 	*
-	* `maskSecretsForLog` reads the consumer pass's log twin first (issue #3150),
+	* `maskSecretsRaw` reads the consumer pass's log twin first (issue #3150),
 	* so a key equal to a name this pass assembled around a short secret is
 	* masked. Residual, stated rather than hidden: the needles and twins belong to the
 	* CONSUMER's resolution, so a plaintext sitting in a PRODUCER key that this
@@ -29493,7 +29740,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			const cfnNameMask = this.positionalNameMask([[stackName, this.displayMasked(stackName, context)], [region, this.displayMasked(loggedRegionText, context)]]);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.maskSecretsForLog(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.displayMasked(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -29616,7 +29863,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
 		const loggedStackName = this.displayMasked(stackName, context);
 		const loggedOutputName = this.displayMasked(outputName, context);
-		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
+		const loggedRegion = this.displayMasked(loggedRegionText, context);
 		const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
 		let stateData;
@@ -29706,7 +29953,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* own comment says why. What this clause is not is redundant against
 	* `raw !== masked`: `rememberLogTwin` has no empty-key guard and
 	* `splitLogTwins` registers every piece it produces, so `registeredLogTwin`
-	* can answer `***` for the empty string and make `maskSecretsForLog('')`
+	* can answer `***` for the empty string and make `maskSecretsRaw('')`
 	* differ from `''`. Neither call site can reach it — both refuse an empty
 	* name upstream — so it fences nothing measured today.
 	*
@@ -29931,7 +30178,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
-		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.maskSecretsForLog(loggedRegionText, context)).ec2;
+		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.displayMasked(loggedRegionText, context)).ec2;
 		let azNames;
 		try {
 			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
@@ -29980,9 +30227,34 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Results are cached to avoid repeated API calls.
 	*/
 	/**
-	* Mask any resolved secret value out of a string bound for a log line, using
-	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
-	* recorded no secrets.
+	* The SECRET answer alone: mask any resolved secret value out of `text`,
+	* using the secrets recorded on the resolution pass (GHSA fix). No-op when
+	* the pass recorded no secrets.
+	*
+	* ## NOT a display form, and the name says so
+	*
+	* This was `maskSecretsForLog` until go-to-k/cdkd#3426, and the name was the
+	* defect. It answers "does this text contain a recorded secret" and makes no
+	* claim about CONTROL CHARACTERS — but it read as "the spelling a log line
+	* takes", so TEN local bindings took its result and interpolated it later,
+	* one of them reaching an `Fn::ImportValue` warn and throw with a live
+	* `ESC[2K` + CR from a template-supplied export name (measured on this tree,
+	* at DEFAULT verbosity, on the DEFAULT path). Renaming it is what makes the
+	* hazard visible at the BINDING rather than at the render: `const x =
+	* this.maskSecretsRaw(...)` states that more work is owed.
+	*
+	* Reachable from ONE place, {@link maskThenStripThenMask}, which is itself
+	* reachable only from {@link displayMasked}. That containment is the whole
+	* mechanism. It used to be enforced by an AST walk that resolved an
+	* interpolated identifier to its declaration; go-to-k/cdkd#3435 deleted that
+	* checker, and what holds the containment now is
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts`, which
+	* asserts the exact reference COUNTS from the AST (one caller each) and
+	* refuses a direct `${this.<raw masker>(...)}` interpolation by line rule.
+	* Do not call this from a new site: a binding of it interpolated LATER is
+	* the shape neither survivor can see.
+	*
+	* ## What the masking itself does
 	*
 	* A value with a registered LOG TWIN prints as its twin first (issue
 	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The needle mask
@@ -29992,7 +30264,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* reference) printed in the clear at every site that handed its RAW value
 	* here, although the pass had registered where the secret sits. Looking the
 	* twin up HERE, rather than at each such site, is what makes the class
-	* closed for raw values: every one of those sites already calls this method.
+	* closed for raw values: every one of those sites already reaches this
+	* method through the builder.
 	* The twin prints as it is: it is the raw text with masked spans, so it
 	* holds no recorded needle the raw text lacks. When the needle mask ALSO
 	* changes the raw text the whole text is masked instead, the rule
@@ -30000,8 +30273,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* cannot be merged. What this cannot see is a value TRANSFORMED before it
 	* arrives (a lowercased region, a sliced output name, an assembled
 	* sentence); those sites derive their text from the twin themselves.
+	*
+	* ## The SELF-COMPARISON, and why it did not block the strip
+	*
+	* The line below compares `maskNeedlesForLog(text) !== text` — the NEEDLE
+	* mask, not this method's own result — so making the RENDER path strip
+	* changes no comparison anywhere. An earlier revision of `displayMasked`'s
+	* comment said stripping could not move inside "the masker" because its
+	* result is also a comparison; that was a claim about this expression, and
+	* the expression's operand is a different function. The measurement that
+	* settled it: every one of this method's 20 escaping call sites rendered
+	* into a log line, a throw, or a `display:` field that becomes one — none
+	* compared, persisted or re-parsed the result — so the render path could
+	* take the strip whole.
 	*/
-	maskSecretsForLog(text, context) {
+	maskSecretsRaw(text, context) {
 		const registered = this.registeredLogTwin(text, context);
 		if (registered === void 0) return this.maskNeedlesForLog(text, context);
 		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
@@ -30020,19 +30306,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const raw = error instanceof Error ? error.message : String(error);
 		return {
 			unit,
-			subject: this.maskSecretsForLog(subject, context),
-			message: this.maskSecretsForLog(preRedact === void 0 ? raw : preRedact(raw), context),
+			subject: this.displayMasked(subject, context),
+			message: this.displayMasked(preRedact === void 0 ? raw : preRedact(raw), context),
 			error,
 			carriedDynamicReference: carriesDynamicReference(rawInput),
 			carriedFetchableReference: carriesFetchableDynamicReference(rawInput)
 		};
 	}
 	/**
-	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
+	* The needle mask alone: {@link maskSecretsRaw} without the log-twin
 	* lookup. For the two DETECTORS that must ask the needle mask apart from the
 	* position mask: `logTwinText`, which asks it of a value that already has a
 	* twin, and `resolveBase64`, whose other operand is the position mask. A
-	* message masks through `maskSecretsForLog`.
+	* message masks through `displayMasked`.
 	*/
 	maskNeedlesForLog(text, context) {
 		let masked = text;
@@ -30060,8 +30346,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* part of it outside the span. The value's own needle mask cannot be merged
 	* with the twin's positions, so the line gives both up for `***`: never
 	* more text than either mask alone would print. Returns the text BEFORE the
-	* needle mask; each log line wraps it in `maskSecretsForLog` itself, so the
-	* resolver's mask-coverage checker sees a masker at the site.
+	* needle mask; each log line wraps it in `displayMasked` itself, so the
+	* sanitization happens at the render rather than here.
 	*/
 	logTwinText(result, twin, context) {
 		return twin !== result && this.maskNeedlesForLog(result, context) !== result ? "***" : twin;
@@ -30112,12 +30398,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the leaf treated as a resolution product — masked whole when it is a
 	* recorded secret, otherwise the masked twin this pass registered for it —
 	* and then `logTwinText`'s whole-line guard. The caller still wraps the
-	* result in `maskSecretsForLog`. Used where the text is needed BEFORE that
+	* result in `displayMasked`. Used where the text is needed BEFORE that
 	* masker, or apart from it: the `Fn::Base64` line and its detector, and the
 	* names issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)
 	* transforms or composes before printing (`regionLogText`,
 	* `outputNameLogText`, the invalid-region refusals, the cross-stack `origin`
-	* strings). A leaf printed as it is needs none of it: `maskSecretsForLog`
+	* strings). A leaf printed as it is needs none of it: `displayMasked`
 	* looks the twin up itself, which is how `maskValueLeaves` gives its lines
 	* and the THROWN messages it masks (the `Fn::Cidr` argument refusals, for
 	* one) the same position mask.
@@ -30357,7 +30643,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (typeof node === "string") return this.displayMasked(node, context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -30369,7 +30655,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.displayMasked(key, context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -30400,10 +30686,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* of the text in hand. A value this resolver resolved cannot be that text
 	* (the split copy is itself recorded, so the first mask catches it), but a
 	* template LITERAL can: issue #3150's region-scoped clients refusal prints
-	* a producer-region guest's region through this helper, and a literal ARN
-	* region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is masked only
-	* by the second pass (`intrinsic-resolver-name-argument-log-twin.test.ts`
-	* pins both halves on that route).
+	* a producer-region guest's region through {@link displayMasked}, and a
+	* literal ARN region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is
+	* masked only by the second pass
+	* (`intrinsic-resolver-name-argument-log-twin.test.ts` pins both halves on
+	* that route).
+	*
+	* ONE CALLER, {@link displayMasked}, since go-to-k/cdkd#3426. It is most of
+	* the answer and reads like all of it — it omits `displaySafe`, and
+	* therefore `U+2028` / `U+2029` and the bidi overrides — so a site reaching
+	* for it directly is the near-miss back onto the treadmill. A DIRECT
+	* `${this.maskThenStripThenMask(...)}` interpolation is refused by
+	* `resolver-display-masked-population.test.ts`'s line rule; a BINDING of it
+	* rendered later is not seen by anything since go-to-k/cdkd#3435 deleted the
+	* AST checker, which is why the one-caller containment above is the control
+	* that matters.
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -30412,59 +30709,71 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* solved here.
 	*/
 	maskThenStripThenMask(value, context) {
-		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+		return this.maskSecretsRaw(stripControlChars(this.maskSecretsRaw(value, context)), context);
 	}
 	/**
-	* The ONE way a masked value reaches a message in this file.
+	* The ONE way a masked value reaches a message in this file — and, since
+	* go-to-k/cdkd#3426, the ONLY exit from the masking machinery at all.
 	*
 	* ## Why this exists rather than a rule about call sites
 	*
-	* `maskSecretsForLog` answers "does this text contain a recorded secret". It
-	* makes NO claim about control characters, and it cannot be taught to: its
-	* result is also used as a COMPARISON (`maskNeedlesForLog(text) !== text`
-	* decides whether a twin was registered), so stripping inside it would change
-	* what that comparison means at every call site.
-	*
-	* That split produced a four-round treadmill on go-to-k/cdkd#3408. Round 1
-	* found the four `Fn::GetStackOutput` throws rendering a masked name raw and
-	* fixed them. Round 2 found the CloudFormation-fallback warn — the DEFAULT
-	* path, at DEFAULT verbosity — and the self-reference throw. Round 3 found
-	* the `reresolveCrossStackValue` origin builder and
-	* `describeAvailableOutputs`. Each round fixed what it found and the next
-	* round found more, because the population was never enumerated. Measured
-	* 2026-09-19 with a comment-stripped scan: SEVENTY-ONE interpolations
-	* rendered a `maskSecretsForLog` result directly, plus thirteen hand-spelled
+	* {@link maskSecretsRaw} answers "does this text contain a recorded secret"
+	* and makes NO claim about control characters. That split produced a
+	* four-round treadmill on go-to-k/cdkd#3408. Round 1 found the four
+	* `Fn::GetStackOutput` throws rendering a masked name raw and fixed them.
+	* Round 2 found the CloudFormation-fallback warn — the DEFAULT path, at
+	* DEFAULT verbosity — and the self-reference throw. Round 3 found the
+	* `reresolveCrossStackValue` origin builder and `describeAvailableOutputs`.
+	* Each round fixed what it found and the next round found more, because the
+	* population was never enumerated. Measured 2026-09-19 with a
+	* comment-stripped scan: SEVENTY-ONE interpolations rendered a bare masker
+	* result directly, plus thirteen hand-spelled
 	* `displaySafe(maskThenStripThenMask(...))` compositions and two bare
 	* `maskThenStripThenMask` interpolations — and three reviewers between them
 	* reached eight of the eighty-six.
 	*
-	* So the repair is not another site. Interpolating the MASKER is now itself
-	* the defect, and this is the only sanctioned way to render one — which turns
-	* "did someone remember to strip here" into a property one scanner checks
-	* over the whole file at once.
-	* `tests/unit/deployment/resolver-display-masked-population.test.ts` is that
-	* scanner: it fails on any `${this.maskSecretsForLog(...)}`, so a new raw
-	* render in THAT SHAPE cannot be added silently.
-	*
-	* ## KNOWN RESIDUAL — the class is NARROWED, not closed
-	*
-	* Stated here rather than implied away, because an earlier revision of this
-	* comment claimed the class was "closed by CONSTRUCTION" and that is FALSE.
-	* The scanner is line-shaped and forbids only the `${this.<masker>(` spelling.
-	* TEN local bindings take a raw masker result and interpolate it later, which
-	* it cannot see — and at least one is a live exposure:
-	* `loggedExportName` (bound from `maskSecretsForLog`) reaches an
-	* `Fn::ImportValue` throw carrying an unstripped ESC and CR, measured on this
-	* tree. `loggedSecretId`, `loggedJsonKey`, `loggedParameterName`,
-	* `maskedAttributeName` and `loggedOrigin` are the same shape.
-	*
-	* Do NOT close those by hand at the ten sites: that is the fifth round of the
-	* enumeration this builder exists to end, and the mechanism that resolves an
-	* identifier to its initializer ALREADY EXISTS in this repo —
-	* `sanitizedLocals` in
-	* `tests/unit/cli/local-profile-display-population.test.ts`.
-	* go-to-k/cdkd#3426 owns binding the scanner to it; go-to-k/cdkd#3405 and
-	* go-to-k/cdkd#3411 own the surrounding scope and parser work.
+	* ROUND FIVE was the BINDING shape: `const loggedExportName =
+	* this.<masker>(...)` interpolated later, which a line-shaped scanner
+	* forbidding `${this.<masker>(` structurally cannot see. Ten of them existed,
+	* and `loggedExportName` was a LIVE exposure — an `Fn::ImportValue` export
+	* name carrying `ESC[2K` + CR reached a warn AND a throw unstripped, at
+	* default verbosity on the default path.
+	*
+	* Patching those ten sites would have been the fifth round of one
+	* enumeration. What closes the class instead is that there is no longer a
+	* masking answer a site can reach WITHOUT the strip: every escaping call of
+	* the old `maskSecretsForLog` now calls this builder, the raw masker is
+	* reachable only through {@link maskThenStripThenMask}, and that helper is
+	* reachable only from here.
+	*
+	* ## What keeps it closed
+	*
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts`, which
+	* asserts from the AST that `maskSecretsRaw` is referenced only inside
+	* `maskThenStripThenMask` and that helper only inside this builder — exact
+	* reference counts, no inference — and refuses a direct
+	* `${this.<raw masker>(...)}` interpolation by line rule.
+	*
+	* An AST walk that ALSO resolved an interpolated identifier to its
+	* declaration used to cover the BINDING shape. go-to-k/cdkd#3435 deleted it
+	* as high-maintenance tooling (23 commits across it and its suite in nine
+	* days; a widening attempted one PR earlier produced nine defects inside
+	* itself and was withdrawn), so that shape is now held by the containment
+	* above — there is no bare masker to bind, because nothing outside this
+	* builder may call one.
+	*
+	* KNOWN BOUND, stated rather than implied away: a site carrying an
+	* exclusion marker is exempt from that walk, because the marker answers the
+	* SECRET question ("this value cannot carry a plaintext"), which is not the
+	* control-character question. Such a site sanitizes by hand or not at all —
+	* `clientsForRegion`'s two region renders are both markered, and both
+	* sanitize. Widening the walk to judge every interpolated value is
+	* go-to-k/cdkd#3405's mixed-render scope, not this builder's.
+	*
+	* (The marker's literal spelling is deliberately not written in this comment:
+	* the checker scans the raw text for it, and a prose mention parses as a
+	* marker no site consumes — which it then reports STALE. Measured while
+	* writing this paragraph.)
 	*
 	* ## What it does, in order
 	*
@@ -30476,10 +30785,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Trojan-Source bidi overrides. That composition is what the `physicalId`
 	* renders here already spelled by hand; this names it, and they now share it.
 	*
-	* It is listed in `MASKERS` in `scripts/check-resolver-mask-coverage.ts`,
-	* which is a SECURITY decision and a sound one: every path through it passes
-	* `maskSecretsForLog`, so it is strictly stronger than the entry it replaces
-	* and cannot be weaker at any input.
+	* It is the ONE sanctioned exit from the masking machinery, which is a
+	* SECURITY decision and a sound one: every path through it passes the
+	* needle-and-twin mask, twice, so it is strictly stronger than the bare
+	* masker it replaced and cannot be weaker at any input.
 	*/
 	displayMasked(value, context) {
 		return displaySafe(this.maskThenStripThenMask(value, context));
@@ -30489,16 +30798,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the same reason as {@link displayMasked} and closed by the same scanner.
 	*
 	* `logTextOfLeaf` resolves a value to its registered twin (or `SECRET_MASK`),
-	* which is a MASKING answer and, like `maskSecretsForLog`'s, says nothing
+	* which is a MASKING answer and, like `maskSecretsRaw`'s, says nothing
 	* about control characters. Four `origin` builders interpolated it raw — the
 	* `Fn::ImportValue` pair, the `Fn::GetStackOutput` one and the nested-stack
 	* attribute one — and those strings flow into `redactedAttributeReads[].display`
 	* and out through a `ProvisioningError` message.
 	*
-	* This route is why fixing the masker alone did not close the class:
-	* `displayMasked` covers every site that interpolates `maskSecretsForLog`,
-	* and these interpolate something else. Two routes, two names, one scanner
-	* forbidding the raw form of both.
+	* This route is why fixing the secret masker alone did not close the class:
+	* `displayMasked` covers every site that renders a needle-masked value, and
+	* these render something else. Two routes, two names, one checker refusing
+	* the raw form of both.
 	*
 	* Composed rather than re-derived. `maskSecretsInText` is idempotent (see
 	* {@link maskThenStripThenMask}), so masking twin text again costs nothing
@@ -30557,7 +30866,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					continue;
 				}
 				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.displayMasked(tokenLogText, context)}: it names '${this.displayMasked(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.displayMasked(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.displayMasked(tokenLogText, context)}: it names '${this.displayMasked(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.displayMasked(regionVerdict.foreignProducerRegions.map((r) => this.displayMasked(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 				if (regionVerdict.kind === "named-region") {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
@@ -30626,7 +30935,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					isSecret = true;
 					resolved = param.value;
 				} else {
-					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
+					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
 				}
@@ -30714,8 +31023,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		const loggedSecretId = this.maskSecretsForLog(nameLogText(secretId), context);
-		const loggedJsonKey = this.maskSecretsForLog(nameLogText(jsonKey), context);
+		const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
+		const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
 		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.displayMasked(nameLogText(versionStage), context)}:${this.displayMasked(nameLogText(versionId), context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
@@ -30880,7 +31189,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		const loggedParameterName = this.maskSecretsForLog(nameLogText(parameterName), context);
+		const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
 		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
@@ -32578,7 +32887,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-De5KONKr.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BuEvX2d9.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -43214,11 +43523,38 @@ var DeployEngine = class DeployEngine {
 		* cdkd never EXECUTES this string — it is advice in an error message — so
 		* this is about the pasted command being correct, not about injection into
 		* cdkd itself (issue #2847 round-5 review).
+		*
+		* SINCE go-to-k/cdkd#3435 no id reaching this arm can contain a `'`:
+		* `isPasteableIdent` admits `[A-Za-z0-9][A-Za-z0-9~_.-]*` only, and the
+		* command is not emitted for anything else. Kept anyway rather than
+		* deleted — dropping a guard on the strength of a NEW guard one line up is
+		* how the pair later comes apart, and this one costs a `replaceAll` on a
+		* short string.
 		*/
 		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
+		/**
+		* A logical id rendered as a NAME rather than as a command argument
+		* (go-to-k/cdkd#3435 security round).
+		*
+		* Every sentence below is joined into a `ProvisioningError` message that
+		* `handleError` prints at DEFAULT verbosity, and neither `formatError` nor
+		* the logger sanitizes `error.message` — they cover a `cause` and the extra
+		* ARGS respectively. So a `Resources` KEY carrying `ESC[2K` + CR reached the
+		* terminal raw, which is the same class this PR closed at 18 resolver
+		* renders and missed one module out.
+		*/
+		const shown = (id) => displayIdent(id);
+		/** CloudFormation's own logical-id length bound. */
+		const CFN_LOGICAL_ID_MAX_LENGTH = 255;
 		const parts = [];
-		if (localTargets.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + localTargets.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
-		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
+		if (localTargets.length > 0) {
+			const pasteableHere = (id) => isPasteableIdent(id) && id.length <= CFN_LOGICAL_ID_MAX_LENGTH;
+			const pasteable = localTargets.filter(pasteableHere);
+			const withheld = localTargets.filter((id) => !pasteableHere(id));
+			if (pasteable.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + pasteable.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+			if (withheld.length > 0) parts.push(`Re-import the record that HOLDS the mask for ${withheld.map(shown).join(", ")}, but the command is withheld: that is not a plain CloudFormation logical id, so a pasted 'cdkd import <stack> --resource <id>=<physicalId> --force' could be reshaped by the shell or name a different resource. Read the id from 'cdkd state show' and quote it yourself.`);
+		}
+		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.map(shown).join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
 		if (foreignReads.length > 0) {
 			const subject = reads.length === 1 ? "The read above resolves" : foreignReads.length === 1 ? "One of the reads above resolves" : "Some of the reads above resolve";
 			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
@@ -45645,4 +45981,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-mI1Xv1oi.js.map
+//# sourceMappingURL=deploy-engine-CfOsVRQB.js.map