@go-to-k/cdkd 0.291.24 → 0.291.25

package/dist/{program-CQ_Y14q1.js → program-DGa6mbzV.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as retryClassificationText, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as shellQuote, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isTransientServerError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isThrottlingError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Ga as resolveBucketRegion, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as renderAssemblyPathEscape, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as resetAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as AwsClients, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as safeStringify, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as markNonRetryable, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qa as CdkdError, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as pasteableCommand, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isRetryableTransientError, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveAssemblyPath, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as displayAssemblyPath, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as setAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as runWithStackAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _o as SynthesisError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as LocalInvokeBuildError$1, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, bo as normalizeAwsError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, co as MalformedProducerRecordRefusalError, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as ProvisioningError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, eo as CrossAccountSecretRefusalError, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ResourceTimeoutError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackTerminationProtectionError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as IntrinsicResolutionRefusalError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as describeAwsFailure, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markRedactedCause, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as NestedStackChildDirectDestroyError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as StackHasActiveImportsError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, no as DeployCancelledError, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalStartServiceError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceUpdateNotSupportedError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as getAwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DynamicReferenceRegionAmbiguousError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as PartialFailureError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as isMarkedNonRetryable, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as withErrorHandling, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-Czuf7jgT.js";
+import { $ as yellow, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as retryClassificationText, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as shellQuote, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isTransientServerError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isThrottlingError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Ga as resolveBucketRegion, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as renderAssemblyPathEscape, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as resetAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as AwsClients, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as safeStringify, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as markNonRetryable, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qa as CdkdError, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as pasteableCommand, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isRetryableTransientError, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveAssemblyPath, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as displayAssemblyPath, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as setAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as runWithStackAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _o as SynthesisError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as LocalInvokeBuildError$1, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, bo as normalizeAwsError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, co as MalformedProducerRecordRefusalError, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as ProvisioningError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, eo as CrossAccountSecretRefusalError, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ResourceTimeoutError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackTerminationProtectionError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as IntrinsicResolutionRefusalError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as describeAwsFailure, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markRedactedCause, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as NestedStackChildDirectDestroyError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as StackHasActiveImportsError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, no as DeployCancelledError, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalStartServiceError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceUpdateNotSupportedError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as getAwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DynamicReferenceRegionAmbiguousError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as PartialFailureError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as isMarkedNonRetryable, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as withErrorHandling, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-JdJuqXID.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BI33Emlj.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CXNAEgyw.js";
+import { t as getCdkdVersion } from "./version-BuS5njuZ.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B32vpt_E.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -68527,9 +68527,9 @@ function indexNestedChildTemplates(template, templatePath) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 		const resolved = resolveAssemblyPath(dir, assetPath);
-		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
+		if (!resolved.contained) throw new Error(`Nested stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
 		result[logicalId] = resolved.path;
 	}
 	return result;
@@ -68685,7 +68685,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
 	for (const name of tokenParameterNames) {
 		const declaredType = (template.Parameters?.[name])?.Type;
-		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stripControlChars(stackName)}: parameter '${stripControlChars(name)}' is declared 'Type: ${stripControlChars(declaredType)}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
+		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${displayStackName(stackName)}: parameter ${displayIdent(name)} is declared Type: ${displayIdent(declaredType)} and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
 	}
 	try {
 		const userParameters = {};
@@ -68701,7 +68701,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		}
 		parametersBound = true;
 	} catch (error) {
-		logger.debug(`Diff parameter binding for stack ${stackName} is partial: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	let effectiveTemplate = template;
 	let conditions;
@@ -68716,7 +68716,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		});
 		effectiveTemplate = new TemplateParser().filterResourcesByCondition(template, conditions);
 	} catch (error) {
-		logger.debug(`Diff condition evaluation for stack ${stackName} skipped: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	const resolveFn = (value) => intrinsicResolver.resolve(value, {
 		template: effectiveTemplate,
@@ -68929,10 +68929,10 @@ async function buildDiffTree(args) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		templateChildIds.add(logicalId);
 		const childTemplatePath = nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} ${displayIdent(logicalId)} under stack ${displayStackName(stackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
 		const resolvedChildPath = path.resolve(childTemplatePath);
-		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template ${displayAssemblyPath(resolvedChildPath)}, which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
+		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack ${displayIdent(logicalId)} under stack ${displayStackName(stackName)} resolves to nested template ${displayAssemblyPath(resolvedChildPath)}, which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
 		const childAncestorTemplatePaths = new Set(ancestorTemplatePaths ?? []).add(resolvedChildPath);
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
@@ -69672,7 +69672,7 @@ function describeFailure(err) {
 * thing the paragraph above rejects.
 */
 function scrubStacksFailedError(failures) {
-	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
+	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => displayStackName(f.stackName)).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
 }
 /**
 * Which of `entries` this stack's post-scrub `outputs` bag disagrees with.
@@ -69751,8 +69751,8 @@ function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
 */
 function exportIndexIncompleteError(unwritten, unreadable, dryRun) {
 	const parts = [dryRun ? "no state written (--dry-run)" : "state.json complete"];
-	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${u.region}`).join(", ")})`);
-	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${u.region}: ${u.reason}`).join("; ")})`);
+	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${displayIdent(u.region)}`).join(", ")})`);
+	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${displayIdent(u.region)}: ${u.reason}`).join("; ")})`);
 	return new ScrubRefusalError(`${parts.join("; ")}. Re-run the same command once the cause is cleared: each entry is written only while its value differs from the producer's state.outputs, so a re-run writes the remainder and leaves the rest alone.`, "SCRUB_EXPORT_INDEX_INCOMPLETE");
 }
 /**
@@ -69983,6 +69983,7 @@ async function scrubCommand(stacks, options) {
 	const indexUnwritten = [];
 	const indexUnreadable = [];
 	for (const stack of targetStacks) {
+		const shownStack = displayStackName(stack.stackName);
 		const stackRegion = stack.region || region;
 		let scrubbed;
 		try {
@@ -69994,7 +69995,7 @@ async function scrubCommand(stacks, options) {
 			});
 		} catch (err) {
 			failures.push({ stackName: stack.stackName });
-			logger.error(`Scrub of ${stack.stackName} failed: ${describeFailure(err)}`);
+			logger.error(`Scrub of ${shownStack} failed: ${describeFailure(err)}`);
 			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
 			continue;
 		}
@@ -70007,8 +70008,8 @@ async function scrubCommand(stacks, options) {
 			const named = (exportName) => {
 				const shown = scrubbed.exportNameDisplay(exportName);
 				switch (shown.kind) {
-					case "safe": return `'${shown.text}'`;
-					case "masked": return `(masked: "${shown.text}")`;
+					case "safe": return displayIdent(shown.text);
+					case "masked": return `(masked: ${displayIdent(shown.text)})`;
 					case "withheld": return "(name withheld: it holds a secret this run recorded)";
 				}
 			};
@@ -70019,14 +70020,14 @@ async function scrubCommand(stacks, options) {
 			});
 			for (const finding of repair.findings) if (finding.kind === "converge") {
 				indexConverged++;
-				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) differs from ${stack.stackName}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
 				else {
 					totalIndexEntriesConverged++;
-					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${stackRegion}) to ${stack.stackName}'s state.outputs value.`);
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
 				}
 			} else {
 				totalIndexEntriesAbsent++;
-				logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) is published by ${stack.stackName}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${stack.stackName} to rewrite the index from its own outputs.`);
+				logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) is published by ${shownStack}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${shownStack} to rewrite the index from its own outputs.`);
 			}
 		} catch (err) {
 			if (err instanceof ScrubIndexInvariantError) throw err;
@@ -70036,28 +70037,28 @@ async function scrubCommand(stacks, options) {
 					region: stackRegion,
 					reason
 				});
-				logger.error(`Exports index for ${stackRegion} could not be read (first seen while scrubbing ${stack.stackName}): ${reason}`);
+				logger.error(`Exports index for ${displayIdent(stackRegion)} could not be read (first seen while scrubbing ${shownStack}): ${reason}`);
 			}
 		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
-			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${shownStack}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${shownStack}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
 		if (scrubbed.malformedOrphans || scrubbed.malformedOrphanRows) malformedOrphanRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
-			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
+			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${shownStack} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
 		}
 		if (scrubbed.unverifiableProducerRecords > 0) damagedProducerStacks.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
-			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
+			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${shownStack} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
 		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
-			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
+			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${shownStack} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
 	for (const [indexRegion, store] of exportIndexStores) {
@@ -70071,7 +70072,7 @@ async function scrubCommand(stacks, options) {
 				region: indexRegion,
 				reason
 			});
-			logger.error(`Exports index for ${indexRegion} could not be read for the coverage report: ${reason}`);
+			logger.error(`Exports index for ${displayIdent(indexRegion)} could not be read for the coverage report: ${reason}`);
 			continue;
 		}
 		if (!entries) continue;
@@ -70079,7 +70080,7 @@ async function scrubCommand(stacks, options) {
 		const unexamined = [...entries.keys()].filter((name) => !examined.has(name));
 		if (unexamined.length === 0) continue;
 		totalIndexEntriesUnexamined += unexamined.length;
-		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
+		logger.info(`Exports index (${displayIdent(indexRegion)}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
@@ -70370,8 +70371,8 @@ var ScrubResolvers = class {
 * Never the resolved value: nothing has been resolved for this reference, and
 * the expression is the same string `state.json` already stores in the clear.
 */
-function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion) {
-	return new ScrubRefusalError(`Scrub of ${stackName} cannot re-resolve the secret reference '${secretName}' in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${stackRegion}'. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
+function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion, secrets) {
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} cannot re-resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => displayIdent(r)).join(", ")}), so it may have been resolved in one of those rather than in ${displayIdent(stackRegion)}. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
 }
 /**
 * The refusal a `named-region` reference raises when its OWN region cannot
@@ -70389,7 +70390,7 @@ function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignP
 * into, so a value recorded a moment earlier in this very leaf is covered.
 */
 function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the secret reference '${secretName}' in ${origin} in the region its ARN names ('${region}'): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
 }
 /**
 * The literal that OPENS a dynamic reference. Used as the CHEAP pre-filter that
@@ -70537,17 +70538,18 @@ function isAssembledSecretReference(leaf, secretTokens) {
 * together out of a plaintext is not.
 */
 async function resolveForeignRegionTokens(leaf, stackName, ctx) {
+	const shownStackName = displayStackName(stackName);
 	const tokens = dynamicReferenceTokens(leaf);
 	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
 	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
-	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion, ctx.recordedSecretValues);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
 	const localTokens = [];
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
-		if (at < 0) throw new ScrubRefusalError(`Scrub of ${stackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in '${ctx.stackRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
+		if (at < 0) throw new ScrubRefusalError(`Scrub of ${shownStackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in ${displayIdent(ctx.stackRegion)}, which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		if (verdict.kind === "named-region") {
 			const resolver = ctx.resolvers.forRegion(verdict.region);
@@ -70568,7 +70570,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	}
 	out += leaf.slice(cursor);
 	const surviving = dynamicReferenceTokens(out);
-	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${stackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
+	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${shownStackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
 	return out;
 }
 /**
@@ -70875,7 +70877,7 @@ function effectiveIntrinsicKey(node) {
 * can carry one, and the map is the same one this pass records into.
 */
 function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
 }
 /**
 * The two sentences the plaintext-producer refusal is built from: what the
@@ -70919,8 +70921,10 @@ function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cau
 function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, loggedVia) {
 	const chain = dedupePreservingOrder(loggedVia, "first");
 	const chainRoot = chain[chain.length - 1];
-	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => `'${s}'`).join(", ")})` : "";
-	const templateClaim = verdict.kind === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes '${loggedExportKey}' by RE-EXPORTING a value that '${chainRoot}' declares from a {{resolve:...}} expression${through}` : `publishes '${loggedExportKey}' by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value '${chainRoot}' declares from a {{resolve:...}} expression${through} (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
+	const shownKey = displayIdent(loggedExportKey);
+	const shownRoot = chainRoot === void 0 ? void 0 : displayStackName(chainRoot);
+	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => displayStackName(s)).join(", ")})` : "";
+	const templateClaim = verdict.kind === "declared" ? `declares ${shownKey} from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes ${shownKey} by RE-EXPORTING a value that ${shownRoot} declares from a {{resolve:...}} expression${through}` : `publishes ${shownKey} by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value ${shownRoot} declares from a {{resolve:...}} expression${through} (this run could not match ${shownKey} to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match ${shownKey} to a declared output, so it cannot say which)`;
 	const scrubOrder = dedupePreservingOrder([...chain].reverse().concat(loggedProducerStack), "last");
 	const remedyCommands = scrubOrder.map((name) => `Scrub with: ${pasteableCommand("cdkd scrub", [{
 		value: name,
@@ -70993,7 +70997,7 @@ function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path
 	const loggedExportKey = maskSecretsInText(exportKey, secrets);
 	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
 	const { templateClaim, remedy, remedyCommands } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
-	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} resolved the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""} to a PLAINTEXT value: the producer stack ${displayStackName(loggedProducerStack)} ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
 		value: stackName,
 		hole: "stack",
 		opts: { patternMatched: true }
@@ -71445,6 +71449,16 @@ function isNamelessDynamicReferenceFailure(err) {
 	return isNamelessDynamicReferenceError(err);
 }
 /**
+* An assembly-chosen NAME (a logical id, a property or output name, a property
+* path, a secret reference's name) rendered into scrub's prose: MASKED FIRST,
+* then bounded (go-to-k/cdkd#3638). `displayIdent` JSON-escapes, blanks
+* non-ASCII and cuts at 255, any of which would stop a recorded plaintext
+* embedded in the name from matching a mask that ran over the rendered text.
+*/
+function maskedIdent(value, secrets) {
+	return displayIdent(maskSecretsInText(value, secrets));
+}
+/**
 * The per-record line each counting site prints. Deliberately ONE SHORT
 * SENTENCE, and that is a fix rather than a style choice: the first cut emitted
 * a ~440-character paragraph PER RECORD at default verbosity, and the arm it
@@ -71459,11 +71473,9 @@ function isNamelessDynamicReferenceFailure(err) {
 * it through `maskSecretsInText`, and a resolver error echoes what it was
 * handed — which, after `pinCrossRegionSecrets`, can be a foreign plaintext.
 *
-* RESIDUAL on the `subject` the call sites pass. They compose
-* `maskSecretsInText(... displaySafe(id) ...)` — sanitise, then mask — and
-* `displaySafe` REPLACES a control character with a space rather than deleting
-* it, so it cannot JOIN a split needle (the go-to-k/cdkd#2874 direction) but it
-* can BREAK one, and it leaves `U+200B`-`U+200D` / `U+FEFF` untouched. A secret
+* The `subject` the call sites pass renders each name through
+* {@link maskedIdent} — masked, then bounded — so bounding cannot break a needle.
+* RESIDUAL: the mask sees only what this run has recorded SO FAR, and a secret
 * would have to sit inside a template logical id or Outputs key to be reachable,
 * which is why `secretSafeKeyDisplay` is not used here — that one is for RESOLVED
 * state-bag keys. Recorded rather than closed: go-to-k/cdkd#3178 security review.
@@ -71850,6 +71862,7 @@ var SharedEntriesSecrets = class extends Map {
 */
 function makeCrossStackPrePass(deps) {
 	const { stackName, resolver, producerTemplates, findings, logger } = deps;
+	const shownStackName = displayStackName(stackName);
 	const exportOwners = buildExportOwnerIndex(producerTemplates);
 	const verdicts = /* @__PURE__ */ new Map();
 	/**
@@ -72004,26 +72017,27 @@ function makeCrossStackPrePass(deps) {
 		*/
 		const storedProducerValue = async (producer, backend, nodeCanRefuse) => {
 			if (!backend) return void 0;
+			const shownProducer = displayStackName(maskSecretsInText(producer.stack, secrets));
 			let loaded;
 			try {
 				loaded = await backend.getState(producer.stack, producer.region);
 			} catch (err) {
-				logger.debug(`Scrub of ${stackName}: could not re-read producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.debug(`Scrub of ${shownStackName}: could not re-read producer ${shownProducer} (${displayIdent(producer.region)}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
 			if (outputs !== void 0 && !isReadableBag(outputs)) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, and this position cannot refuse.`);
+					logger.debug(`Scrub of ${shownStackName}: producer ${shownProducer} (${displayIdent(producer.region)}) has no readable 'outputs' map, and this position cannot refuse.`);
 					return;
 				}
 				const seenKey = producerRecordKey(producer.stack, producer.region);
 				if (!warnedDamagedProducers.has(seenKey)) {
 					warnedDamagedProducers.add(seenKey);
-					const detail = `the stored value of producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}), whose 'outputs' map cannot be read`;
+					const detail = `the stored value of producer ${shownProducer} (${displayIdent(producer.region)}), whose 'outputs' map cannot be read`;
 					findings.unverifiable.push(detail);
 					findings.damagedProducerRecords.push(detail);
-					logger.warn(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, so its stored value could NOT be classified — this run cannot tell whether it still holds plaintext for the value ${stackName} imports from it. ${stackName} is scrubbed for everything else. Repair that record and scrub it first.`);
+					logger.warn(`Scrub of ${shownStackName}: producer ${shownProducer} (${displayIdent(producer.region)}) has no readable 'outputs' map, so its stored value could NOT be classified — this run cannot tell whether it still holds plaintext for the value ${shownStackName} imports from it. ${shownStackName} is scrubbed for everything else. Repair that record and scrub it first.`);
 				}
 				return;
 			}
@@ -72037,60 +72051,60 @@ function makeCrossStackPrePass(deps) {
 				recordedImports: [],
 				recordedOutputReads: []
 			};
-			const where = `${key} in ${origin}${path ? ` at ${path}` : ""}`;
+			const where = `${key} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}`;
 			try {
 				await resolver.resolve({ [key]: node[key] }, probe);
 			} catch (err) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`Scrub of ${shownStackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				if (isByDesignRefusal(err)) {
 					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
-					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
+					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
 				}
 				if (isMalformedProducerRefusal(err)) {
 					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
 					findings.damagedProducerRecords.push(detail);
-					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
+					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
 					return;
 				}
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
 			const producer = recordedProducer(key, probe);
 			if (!producer) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
 				return;
 			}
-			const loggedKey = maskSecretsInText(producer.key, secrets);
-			const loggedStack = maskSecretsInText(producer.stack, secrets);
+			const loggedKey = displayIdent(maskSecretsInText(producer.key, secrets));
+			const loggedStack = displayStackName(maskSecretsInText(producer.stack, secrets));
 			if (!producerTemplates.has(producer.stack)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), which is not a stack of this app — scrub has no template to classify export '${loggedKey}' with. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack} (${displayIdent(producer.region)}), which is not a stack of this app — scrub has no template to classify export ${loggedKey} with. Not classified as a plaintext producer.`);
 				return;
 			}
 			const verdict = secretExpressionVerdict(producer.stack, producer.key);
 			if (verdict.kind === "no") {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose template declares no {{resolve:...}} expression for '${loggedKey}' and no re-export chain reaching one. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose template declares no {{resolve:...}} expression for ${loggedKey} and no re-export chain reaching one. Not classified as a plaintext producer.`);
 				return;
 			}
 			const stored = await storedProducerValue(producer, context.stateBackend, nodeCanRefuse);
 			if (!stored) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), whose state record could not be read or does not carry the key '${loggedKey}' — cannot classify, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack} (${displayIdent(producer.region)}), whose state record could not be read or does not carry the key ${loggedKey} — cannot classify, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (carriesDynamicReference(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for '${loggedKey}' already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose stored value for ${loggedKey} already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
 				return;
 			}
 			if (storedValueCarriesNoPlaintext(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (!nodeCanRefuse) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved to a plaintext from unscrubbed producer '${loggedStack}', and this position cannot refuse.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved to a plaintext from unscrubbed producer ${loggedStack}, and this position cannot refuse.`);
 				return;
 			}
 			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
@@ -72147,6 +72161,7 @@ function makeCrossStackPrePass(deps) {
 */
 async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const { logger } = opts;
+	const shownStack = displayStackName(stack.stackName);
 	const acquired = !opts.dryRun;
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
 	const perResourceSecrets = /* @__PURE__ */ new Map();
@@ -72232,7 +72247,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
-			logger.debug(`No state for ${stack.stackName} (${region}) — skipping`);
+			logger.debug(`No state for ${shownStack} (${displayIdent(region)}) — skipping`);
 			return {
 				recordsChanged: 0,
 				secretsFound: 0,
@@ -72285,7 +72300,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			parameters = await resolver.resolveParameters(stack.template);
 		} catch (err) {
-			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Parameter resolution skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
 		const resolverContext = (recordedSecretValues) => ({
@@ -72309,7 +72324,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
-			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Condition evaluation skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const templateResources = stack.template.Resources ?? {};
 		const templateOutputs = stack.template.Outputs ?? {};
@@ -72329,10 +72344,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `resource '${logicalId}'`
+					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`
 				});
 				const resourceContext = resolverContext(recordedSecretValues);
-				await resolveCrossStackReads(resolveInput, resourceContext, `resource '${logicalId}'`);
+				await resolveCrossStackReads(resolveInput, resourceContext, `resource ${maskedIdent(logicalId, recordedSecretValues)}`);
 				const bagKeys = resolveInput !== null && typeof resolveInput === "object" && !Array.isArray(resolveInput) ? Object.keys(resolveInput) : void 0;
 				const intrinsicShapedBag = bagKeys?.some((k) => RESOLVER_DISPATCH_KEYS.has(k)) ?? false;
 				const resolveUnits = bagKeys && !intrinsicShapedBag ? Object.entries(resolveInput) : [["", resolveInput]];
@@ -72343,16 +72358,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							...resourceContext,
 							abandonedResolutions: abandoned
 						});
-						reportAbandonedBag(abandoned, propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, recordedSecretValues, `${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""}`);
+						reportAbandonedBag(abandoned, propertyName ? `resource ${maskedIdent(logicalId, recordedSecretValues)} property ${maskedIdent(propertyName, recordedSecretValues)}` : `resource ${maskedIdent(logicalId, recordedSecretValues)}`, recordedSecretValues, `${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""}`);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						const leafVerdict = abandonedScanVerdict(propertyValue, err);
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource ${maskedIdent(logicalId, recordedSecretValues)} property ${maskedIdent(propertyName, recordedSecretValues)}` : `resource ${maskedIdent(logicalId, recordedSecretValues)}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of ${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of ${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -72369,7 +72384,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `orphan record '${record.logicalId}'`
+					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`
 				});
 				const orphanContext = resolverContext(recordedSecretValues);
 				for (const [bagName, bagValue] of Object.entries(resolveInput)) {
@@ -72379,16 +72394,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							...orphanContext,
 							abandonedResolutions: abandoned
 						});
-						reportAbandonedBag(abandoned, `orphan record '${displaySafe(record.logicalId)}' ${bagName}`, recordedSecretValues, `orphan record ${displaySafe(record.logicalId)} ${bagName}`);
+						reportAbandonedBag(abandoned, `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`, recordedSecretValues, `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						const leafVerdict = abandonedScanVerdict(bagValue, err);
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}' ${bagName}`, leafVerdict), recordedSecretValues));
+							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of orphan record ${displaySafe(record.logicalId)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
 				}
 			}
@@ -72404,10 +72419,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						producerRegions,
 						resolvers,
 						recordedSecretValues: nameSecrets,
-						origin: `Export.Name of output '${name}'`
+						origin: `Export.Name of output ${maskedIdent(name, nameSecrets)}`
 					});
 					const nameContext = resolverContext(nameSecrets);
-					await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
+					await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output ${maskedIdent(name, nameSecrets)}`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 					try {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
@@ -72416,14 +72431,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output ${maskedIdent(name, outputSecrets)}`, leafVerdict), outputSecrets));
 						}
 						nameFailed = true;
 						nameError = err;
 					}
 					if (nameFailed) {
 						outputsSourceUntrusted = true;
-						logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+						logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 					}
 				}
 				if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
@@ -72431,7 +72446,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				if (typeof exportName === "string" && !exportNameUnresolved) accountedOutputKeys.add(exportName);
 				if (exportNameUnresolved) {
 					outputsSourceUntrusted = true;
-					logger.warn(`Export.Name of output ${name} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+					logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 				} else if (typeof exportName === "string" && isExportAliasCollision(exportName, name, declaredOutputNames)) {
 					ambiguousKeys.add(exportName);
 					collisions.push([name, exportName]);
@@ -72448,26 +72463,26 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
-					origin: `output '${name}'`
+					origin: `output ${maskedIdent(name, outputSecrets)}`
 				});
 				const valueContext = resolverContext(outputSecrets);
-				await resolveCrossStackReads(valueSource, valueContext, `output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
+				await resolveCrossStackReads(valueSource, valueContext, `output ${maskedIdent(name, outputSecrets)}`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				const abandonedOutput = [];
 				try {
 					await resolver.resolve(valueSource, {
 						...valueContext,
 						abandonedResolutions: abandonedOutput
 					});
-					reportAbandonedBag(abandonedOutput, `output '${displaySafe(name)}'`, outputSecrets, `output ${displaySafe(name)}`);
+					reportAbandonedBag(abandonedOutput, `output ${maskedIdent(name, outputSecrets)}`, outputSecrets, `output ${maskedIdent(name, outputSecrets)}`);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					const leafVerdict = abandonedScanVerdict(valueSource, err);
 					if (leafVerdict !== "silent") {
 						if (leafVerdict === "count") unverifiableLeaves++;
 						else ungateableAbandonedScans++;
-						logger.warn(maskSecretsInText(abandonedScanWarning(`output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+						logger.warn(maskSecretsInText(abandonedScanWarning(`output ${maskedIdent(name, outputSecrets)}`, leafVerdict), outputSecrets));
 					}
-					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+					logger.debug(`Resolution of output ${maskedIdent(name, outputSecrets)} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
 		});
@@ -72580,7 +72595,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
-			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to release lock for ${shownStack}: ${err instanceof Error ? err.message : String(err)}`);
 		});
 	}
 }
@@ -88372,7 +88387,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	if (divergentParameters !== void 0 && divergentParameters.size > 0) try {
 		parameterTaint = computeParameterTaint(template, new Map(entries.map(([logicalId, resource]) => [logicalId, resource.properties])), divergentParameters);
 	} catch (err) {
-		logger.debug(`observed-baseline parameter-dependence walk failed for '${displaySafe(stackState.stackName)}': ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
+		logger.debug(`observed-baseline parameter-dependence walk failed for ${displayStackName(stackState.stackName)}: ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
 		const all = new Set(entries.map(([logicalId]) => logicalId));
 		parameterTaint = {
 			refused: all,
@@ -88425,8 +88440,8 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		const refusedHere = [...parameterTaint.refused].filter((id) => inState.has(id));
 		const unreadable = refusedHere.filter((id) => parameterTaint.unclassifiable.has(id));
 		if (refusedHere.length > 0) {
-			const named = [...parameterTaint.parametersHit].sort().map((name) => displaySafe(name));
-			logger.warn(`${refusedHere.length} resource(s) in '${displaySafe(stackState.stackName)}' depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
+			const named = [...parameterTaint.parametersHit].sort().map((name) => displayIdent(name));
+			logger.warn(`${refusedHere.length} resource(s) in ${displayStackName(stackState.stackName)} depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
 		}
 	}
 	return unsafeObservedBaselineLogicalIds;
@@ -89048,9 +89063,9 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 		if (resource.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates.`);
 		const resolved = resolveAssemblyPath(dir, assetPath);
-		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
 		result[grandLogicalId] = resolved.path;
 	}
 	return result;
@@ -99040,4 +99055,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CQ_Y14q1.js.map
+//# sourceMappingURL=program-DGa6mbzV.js.map