@go-to-k/cdkd 0.291.4 → 0.291.6

package/dist/{program-C5r-kmIQ.js → program-CGPchKa2.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as describeAwsFailure, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalStartServiceError, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DynamicReferenceRegionAmbiguousError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as DeployCancelledError, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as ProvisioningError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as withErrorHandling, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ResourceTimeoutError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isThrottlingError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as isMarkedNonRetryable, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceUpdateNotSupportedError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as MalformedProducerRecordRefusalError, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as NestedStackChildDirectDestroyError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as IntrinsicResolutionRefusalError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as PartialFailureError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as retryClassificationText, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as StackHasActiveImportsError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as CdkdError, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as SynthesisError, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as normalizeAwsError, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as markNonRetryable, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isTransientServerError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markRedactedCause, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as setAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as safeStringify, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as LocalInvokeBuildError$1, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isRetryableTransientError, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as CrossAccountSecretRefusalError, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackTerminationProtectionError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-CpMT9Bmm.js";
+import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-BrGb93QQ.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
-import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-ChuDKy_E.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-_vdcb9QG.js";
+import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
+import { t as getCdkdVersion } from "./version-DQAkja2a.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B1pinTYm.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7284,11 +7284,10 @@ function isTruthyCfnBoolean(value) {
 * rather than a fallback.
 *
 * ONE clause for both arms so the two cannot come to render the same value
-* differently. The prose `(${bucketName})` each arm carries BESIDE it is still
-* interpolated as-is: this clause takes only the pasteable half, and
-* display-sanitizing the PROSE of provider warnings is tracked as issue
-* [#3269](https://github.com/go-to-k/cdkd/issues/3269) (#3136 covers the
-* COMMAND half across providers, not prose).
+* differently. The PROSE copy of the name each arm carries BESIDE it goes
+* through `displaySafe` at the arm, masked first (issue
+* [#3269](https://github.com/go-to-k/cdkd/issues/3269)): unlike the command, a
+* sanitized prose name names no target, so it is rendered rather than withheld.
 *
 * `maskSecrets` is REQUIRED rather than optional, and both call sites build it
 * from `context?.maskSecrets` (security review of #3136, which found these two
@@ -8383,8 +8382,8 @@ function canonicalizeItemList(properties, key, fold) {
 function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
-	if (typeof value === "string") return `a string ${JSON.stringify(maskDeep(value, maskSecrets))}`;
-	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
+	if (typeof value === "string") return `a string ${displaySafe(JSON.stringify(maskDeep(value, maskSecrets)))}`;
+	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => displaySafe(maskSecrets(key))).join(", ")}]`;
 	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 /**
@@ -8709,7 +8708,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: status }
 		}));
-		this.logger.debug(`Applied versioning (${status}) to bucket ${bucketName}`);
+		this.logger.debug(`Applied versioning (${status}) to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -8720,7 +8719,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			Tagging: { TagSet: tags }
 		}));
-		this.logger.debug(`Applied ${tags.length} tags to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${tags.length} tags to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via S3's
@@ -8746,7 +8745,7 @@ var S3BucketProvider = class S3BucketProvider {
 		if (newNorm.length === 0) {
 			try {
 				await this.s3Client.send(new DeleteBucketTaggingCommand({ Bucket: bucketName }));
-				this.logger.debug(`Cleared tags from bucket ${bucketName}`);
+				this.logger.debug(`Cleared tags from bucket ${displaySafe(bucketName)}`);
 			} catch (err) {
 				if (err.name === "NoSuchTagSet") return;
 				throw err;
@@ -8757,7 +8756,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			Tagging: { TagSet: newNorm }
 		}));
-		this.logger.debug(`Replaced tag set on bucket ${bucketName} (${newNorm.length} tags)`);
+		this.logger.debug(`Replaced tag set on bucket ${displaySafe(bucketName)} (${newNorm.length} tags)`);
 	}
 	/**
 	* Apply CORS configuration
@@ -8782,7 +8781,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			CORSConfiguration: { CORSRules: corsRules }
 		}));
-		this.logger.debug(`Applied CORS configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied CORS configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* The per-item / per-rule STRING guard, with the applier's own SKIP as the
@@ -8906,7 +8905,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (coerceCfnBoolean(rule["ExpiredObjectDeleteMarker"]) === true) {
 				const exp = sdkRule.Expiration;
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
-				else this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
+				else this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
 			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
@@ -8922,7 +8921,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const nvts = rule["NoncurrentVersionTransitions"];
 			const singularNvt = rule["NoncurrentVersionTransition"];
-			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
 			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
@@ -8931,7 +8930,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const transitions = rule["Transitions"];
 			const singularTransition = rule["Transition"];
-			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both Transitions and the legacy Transition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both Transitions and the legacy Transition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
 			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
@@ -8955,7 +8954,7 @@ var S3BucketProvider = class S3BucketProvider {
 			LifecycleConfiguration: { Rules: rules },
 			TransitionDefaultMinimumObjectSize: lifecycleConfig["TransitionDefaultMinimumObjectSize"]
 		}));
-		this.logger.debug(`Applied lifecycle configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied lifecycle configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -8975,7 +8974,7 @@ var S3BucketProvider = class S3BucketProvider {
 				RestrictPublicBuckets: config["RestrictPublicBuckets"]
 			}
 		}));
-		this.logger.debug(`Applied public access block configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied public access block configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply bucket encryption configuration
@@ -9005,7 +9004,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			ServerSideEncryptionConfiguration: { Rules: rules }
 		}));
-		this.logger.debug(`Applied encryption configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied encryption configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply logging configuration
@@ -9033,7 +9032,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				BucketLoggingStatus: {}
 			}));
-			this.logger.debug(`Cleared logging configuration on bucket ${bucketName}`);
+			this.logger.debug(`Cleared logging configuration on bucket ${displaySafe(bucketName)}`);
 			return true;
 		}
 		const loggingEnabled = {
@@ -9052,7 +9051,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			BucketLoggingStatus: { LoggingEnabled: loggingEnabled }
 		}));
-		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied logging configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9098,7 +9097,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			WebsiteConfiguration: sdkConfig
 		}));
-		this.logger.debug(`Applied website configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied website configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply accelerate configuration
@@ -9111,7 +9110,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			AccelerateConfiguration: { Status: config["AccelerationStatus"] }
 		}));
-		this.logger.debug(`Applied accelerate configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied accelerate configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply notification configuration (full-replace via PutBucketNotificationConfiguration)
@@ -9160,7 +9159,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			NotificationConfiguration: cfg
 		}));
-		this.logger.debug(`Applied notification configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied notification configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9219,7 +9218,7 @@ var S3BucketProvider = class S3BucketProvider {
 				MetricsConfiguration: metricsConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted: /* @__PURE__ */ new Map()
@@ -9355,7 +9354,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9420,7 +9419,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const sentItem = effectiveIntelligentTieringItem(config);
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9503,7 +9502,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9622,7 +9621,7 @@ var S3BucketProvider = class S3BucketProvider {
 				})
 			}
 		}));
-		this.logger.debug(`Applied replication configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied replication configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9668,7 +9667,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			ObjectLockConfiguration: objectLockConfig
 		}));
-		this.logger.debug(`Applied object lock configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied object lock configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9711,7 +9710,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
 		}));
-		this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
+		this.logger.debug(`Applied ownership controls to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Normalize an "empty container" sub-config value to `undefined` so the diff
@@ -10111,7 +10110,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (skippedIds.size === 0 && sentItems.size === 0) return;
 			const desired = properties[key];
 			if (!Array.isArray(desired)) {
-				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
+				this.logger.debug(`Bucket ${displaySafe(bucketName)}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
 				return;
 			}
 			const previous = previousProperties[key];
@@ -10128,7 +10127,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
 		const versioningRefusal = configStringRefusal(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 		if (versioningRefusal !== void 0 && versioningChanged) {
-			this.logger.warn(`Bucket ${bucketName}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
+			this.logger.warn(`Bucket ${displaySafe(bucketName)}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
 			retainPrevious("VersioningConfiguration");
 		}
 		const desiredVersioningStatus = versioningRefusal === void 0 ? readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration") : void 0;
@@ -10142,7 +10141,7 @@ var S3BucketProvider = class S3BucketProvider {
 				return;
 			}
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
+			this.logger.debug(`Deleted ownership controls on bucket ${displaySafe(bucketName)}`);
 		});
 		const encryptionEmptyDesired = S3BucketProvider.declaresEmptyCollection(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
@@ -10151,13 +10150,13 @@ var S3BucketProvider = class S3BucketProvider {
 				return;
 			}
 			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
+			this.logger.debug(`Deleted bucket encryption on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) {
 				if (context?.desiredFromAwsReadback === true) {
 					await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
-					this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					this.logger.debug(`Deleted lifecycle configuration on bucket ${displaySafe(bucketName)} (reverting to an unset baseline)`);
 					return;
 				}
 				this.emptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules", previousProperties, retainPrevious);
@@ -10167,13 +10166,13 @@ var S3BucketProvider = class S3BucketProvider {
 			else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(cfg));
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted lifecycle configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["CorsConfiguration"], properties["CorsConfiguration"], async (cfg) => {
 			if (!cfg.CorsRules || !Array.isArray(cfg.CorsRules) || cfg.CorsRules.length === 0) {
 				if (context?.desiredFromAwsReadback === true) {
 					await this.s3Client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
-					this.logger.debug(`Deleted CORS configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					this.logger.debug(`Deleted CORS configuration on bucket ${displaySafe(bucketName)} (reverting to an unset baseline)`);
 					return;
 				}
 				this.emptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules", previousProperties, retainPrevious);
@@ -10182,11 +10181,11 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.applyCorsConfiguration(bucketName, cfg);
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted CORS configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted CORS configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["WebsiteConfiguration"], properties["WebsiteConfiguration"], async (cfg) => this.applyWebsiteConfiguration(bucketName, cfg), async () => {
 			await this.s3Client.send(new DeleteBucketWebsiteCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted website configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted website configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => {
 			if (!await this.applyLoggingConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("LoggingConfiguration");
@@ -10203,7 +10202,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketReplicationCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted replication configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted replication configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["ObjectLockConfiguration"], properties["ObjectLockConfiguration"], async (cfg) => {
 			if (!await this.applyObjectLockConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ObjectLockConfiguration");
@@ -10212,7 +10211,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				ObjectLockConfiguration: { ObjectLockEnabled: "Enabled" }
 			}));
-			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
+			this.logger.debug(`Cleared object lock rule on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
 		const metricsOutcomes = itemOutcomes();
@@ -10224,7 +10223,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted metrics configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("MetricsConfigurations", metricsOutcomes);
 		const analyticsOutcomes = itemOutcomes();
@@ -10236,7 +10235,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted analytics configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("AnalyticsConfigurations", analyticsOutcomes);
 		const intelligentTieringOutcomes = itemOutcomes();
@@ -10248,7 +10247,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted intelligent tiering configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("IntelligentTieringConfigurations", intelligentTieringOutcomes);
 		const inventoryOutcomes = itemOutcomes();
@@ -10260,7 +10259,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted inventory configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("InventoryConfigurations", inventoryOutcomes);
 		if (versioningChanged && desiredVersioningStatus === "Suspended") {
@@ -10269,7 +10268,7 @@ var S3BucketProvider = class S3BucketProvider {
 				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
 			};
 			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) {
-				this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+				this.logger.warn(`Bucket ${displaySafe(bucketName)}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
 				retainPrevious("VersioningConfiguration");
 			} else await this.applyVersioning(bucketName, { Status: "Suspended" });
 		}
@@ -10427,7 +10426,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* statement without the compiler losing that control flow ends there.
 	*/
 	refuseForeignRegionAdopt(logicalId, resourceType, bucketName, wantRegion, actualRegion, cause) {
-		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${bucketName} for ${logicalId} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so owning the name (which is what 'BucketAlreadyOwnedByYou' and a successful location lookup each report) never means the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, cause));
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${displaySafe(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so owning the name (which is what 'BucketAlreadyOwnedByYou' and a successful location lookup each report) never means the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, cause));
 	}
 	/**
 	* The region an already-owned bucket actually lives in, canonicalized.
@@ -10577,14 +10576,14 @@ var S3BucketProvider = class S3BucketProvider {
 		const probe = await this.probeBucketRegion(physicalId);
 		if (probe.kind === "absent") return;
 		if (probe.kind === "indeterminate") {
-			this.logger.debug(`GetBucketLocation failed for S3 bucket ${physicalId} (${logicalId}) before ${operation}: ${probe.reason}`);
+			this.logger.debug(`GetBucketLocation failed for S3 bucket ${displaySafe(physicalId)} (${displaySafe(logicalId)}) before ${operation}: ${probe.reason}`);
 			this.announceUnverifiedBucketIdentity(operation, logicalId, physicalId, probeFailedCause(probe.errorName));
 			return;
 		}
 		if (probe.region === wantRegion) return;
 		const consequence = operation === "update" ? `Applying this stack's bucket configuration would reconfigure a bucket in ${probe.region} that this stack does not own the definition of.` : `Deleting it would destroy a bucket in ${probe.region} that this stack's region does not contain, and that deletion cannot be undone.`;
-		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop cdkd's record with 'cdkd state orphan <stack>', which removes the record without touching any AWS resource, and deploy again.` : `Confirm which bucket you mean. If ${physicalId} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack>', which removes cdkd's record without touching any AWS resource, and the destroy will then have nothing to do for this resource.`;
-		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${physicalId} for ${logicalId} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
+		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop cdkd's record with 'cdkd state orphan <stack>', which removes the record without touching any AWS resource, and deploy again.` : `Confirm which bucket you mean. If ${displaySafe(physicalId)} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack>', which removes cdkd's record without touching any AWS resource, and the destroy will then have nothing to do for this resource.`;
+		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${displaySafe(physicalId)} for ${displaySafe(logicalId)} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
 	}
 	/**
 	* Say out loud that the identity guard did not run.
@@ -10619,7 +10618,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* actual defect.
 	*/
 	announceUnverifiedBucketIdentity(operation, logicalId, physicalId, cause) {
-		const message = `Could not confirm which bucket ${physicalId} for ${logicalId} is before ${operation}: ${cause.why}, so the cross-region guard did NOT run and cdkd is proceeding on the recorded physical id alone.`;
+		const message = `Could not confirm which bucket ${displaySafe(physicalId)} for ${displaySafe(logicalId)} is before ${operation}: ${cause.why}, so the cross-region guard did NOT run and cdkd is proceeding on the recorded physical id alone.`;
 		if (operation === "delete") {
 			this.logger.warn(`${message} If this state record names a bucket in another region, this destroy will delete THAT bucket. ${cause.remedy}`);
 			return;
@@ -10630,7 +10629,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* Create an S3 bucket
 	*/
 	async create(logicalId, resourceType, properties, context) {
-		this.logger.debug(`Creating S3 bucket ${logicalId}`);
+		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
 			maxLength: 63,
 			lowercase: true,
@@ -10648,13 +10647,13 @@ var S3BucketProvider = class S3BucketProvider {
 				await this.s3Client.send(new CreateBucketCommand(createParams));
 				createdNewBucket = preflight.kind === "absent";
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
-				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${bucketName} for ${logicalId} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${bucketName} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
-				this.logger.debug(`Created S3 bucket: ${bucketName}`);
+				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${displaySafe(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${displaySafe(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
+				this.logger.debug(`Created S3 bucket: ${displaySafe(bucketName)}`);
 			} catch (createError) {
 				if (createError instanceof ProvisioningError) throw createError;
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) {
 					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
-					this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
+					this.logger.debug(`S3 bucket ${displaySafe(bucketName)} already exists and is owned by you`);
 				} else throw createError;
 			}
 			let effectiveOverrides;
@@ -10664,21 +10663,21 @@ var S3BucketProvider = class S3BucketProvider {
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
+					this.logger.debug(`Cleaned up partially-created S3 bucket ${displaySafe(logicalId)} (${displaySafe(bucketName)}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${describeAwsFailure(cleanupError).detail}`);
+					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${displaySafe(logicalId)} (${displaySafe(bucketName)}): ${describeAwsFailure(cleanupError).detail}`);
 					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
-					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
+					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${displaySafe(logicalId)} (${displaySafe(maskSecrets(bucketName))}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				else if (preflight.kind === "indeterminate") {
-					this.logger.debug(`GetBucketLocation failed for S3 bucket ${bucketName} (${logicalId}) during create: ${preflight.reason}`);
+					this.logger.debug(`GetBucketLocation failed for S3 bucket ${displaySafe(bucketName)} (${displaySafe(logicalId)}) during create: ${preflight.reason}`);
 					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
-					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
+					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${displaySafe(logicalId)} (${displaySafe(maskSecrets(bucketName))}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				throw innerError;
 			}
 			const attributes = await this.buildAttributes(bucketName);
-			this.logger.debug(`Successfully created S3 bucket ${logicalId}: ${bucketName}`);
+			this.logger.debug(`Successfully created S3 bucket ${displaySafe(logicalId)}: ${displaySafe(bucketName)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId: bucketName,
@@ -10693,10 +10692,10 @@ var S3BucketProvider = class S3BucketProvider {
 	* Update an S3 bucket
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		this.logger.debug(`Updating S3 bucket ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Updating S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		const newBucketName = properties["BucketName"];
 		if (newBucketName && newBucketName !== physicalId) {
-			this.logger.debug(`Bucket name changed (${physicalId} -> ${newBucketName}), replacement required`);
+			this.logger.debug(`Bucket name changed (${displaySafe(physicalId)} -> ${displaySafe(newBucketName)}), replacement required`);
 			return {
 				physicalId,
 				wasReplaced: true
@@ -10711,7 +10710,7 @@ var S3BucketProvider = class S3BucketProvider {
 			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties, context)) effectiveOverrides.set(key, value);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
-			this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
+			this.logger.debug(`Successfully updated S3 bucket ${displaySafe(logicalId)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId,
@@ -10729,7 +10728,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* Note: The bucket must be empty before deletion.
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting S3 bucket ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion);
 		else this.announceUnverifiedBucketIdentity("delete", logicalId, physicalId, noRecordedRegionCause());
@@ -10739,7 +10738,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (error instanceof NoSuchBucket) {
 				const clientRegion = await this.s3Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(`Bucket ${displaySafe(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error);
@@ -10785,8 +10784,8 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
 		const failure = describeAwsFailure(error);
-		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${logicalId} (${physicalId}): ${failure.detail}`);
-		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)} (${displaySafe(physicalId)}): ${failure.detail}`);
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${failure.summary}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	/**
@@ -11477,20 +11476,20 @@ var S3BucketProvider = class S3BucketProvider {
 		const maxAttempts = 3;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-			this.logger.debug(`Successfully deleted S3 bucket ${logicalId}`);
+			this.logger.debug(`Successfully deleted S3 bucket ${displaySafe(logicalId)}`);
 			return;
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
-				this.logger.info(`Bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
+				if (!allowAutoEmpty) throw new Error(`bucket ${displaySafe(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
+				this.logger.info(`Bucket ${displaySafe(bucketName)} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
 				await this.emptyBucket(bucketName);
 				continue;
 			}
 			throw error;
 		}
 		await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-		this.logger.debug(`Successfully deleted S3 bucket ${logicalId}`);
+		this.logger.debug(`Successfully deleted S3 bucket ${displaySafe(logicalId)}`);
 	}
 	/**
 	* Empty a bucket by deleting all object versions and delete markers.
@@ -11529,7 +11528,7 @@ var S3BucketProvider = class S3BucketProvider {
 						Quiet: true
 					}
 				}));
-				this.logger.debug(`Emptied ${objects.length} objects from ${bucketName}`);
+				this.logger.debug(`Emptied ${objects.length} objects from ${displaySafe(bucketName)}`);
 			}
 			if (!listResp.IsTruncated) break;
 			keyMarker = decodeListingKey(listResp.NextKeyMarker);
@@ -12226,7 +12225,7 @@ var SQSQueueProvider = class {
 			return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 		} catch {
 			this.logger.warn("Failed to construct SQS ARN from STS, using placeholder");
-			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			const { partition } = derivePartitionAndUrlSuffix(ambientRegion() ?? "");
 			return `arn:${partition}:sqs:unknown:unknown:${queueName}`;
 		}
 	}
@@ -26025,14 +26024,16 @@ var LogsLogGroupProvider = class {
 			} catch (innerError) {
 				if (createdNewLogGroup) try {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
-					this.logger.debug(`Cleaned up partially-created log group ${logicalId} (${logGroupName}) after wiring failure`);
+					this.logger.debug(`Cleaned up partially-created log group ${displaySafe(logicalId)} (${displaySafe(logGroupName)}) after wiring failure`);
 				} catch (cleanupError) {
+					const mask = maskerOrIdentity(context?.maskSecrets);
 					const deleteCommand = renderDisableCommand({
 						before: "aws logs delete-log-group --log-group-name",
-						identifier: logGroupName
+						identifier: logGroupName,
+						maskSecrets: mask
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
-					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
+					this.logger.warn(mask(`Failed to clean up partially-created log group ${displaySafe(logicalId)} (${displaySafe(mask(logGroupName))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`));
 				}
 				throw innerError;
 			}
@@ -26244,11 +26245,11 @@ var LogsLogGroupProvider = class {
 	async buildArn(logGroupName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			const region = await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const region = await this.logsClient.config.region() || ambientRegion() || "us-east-1";
 			const { partition } = derivePartitionAndUrlSuffix(region);
 			return `arn:${partition}:logs:${region}:${accountId}:log-group:${logGroupName}:*`;
 		} catch {
-			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			const { partition } = derivePartitionAndUrlSuffix(ambientRegion() ?? "");
 			return `arn:${partition}:logs:unknown:unknown:log-group:${logGroupName}:*`;
 		}
 	}
@@ -26512,11 +26513,11 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${describeAwsFailure(error).detail}`);
 		}
 		try {
-			const region = await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const region = await this.cloudWatchClient.config.region() || ambientRegion() || "us-east-1";
 			const { partition } = derivePartitionAndUrlSuffix(region);
 			return `arn:${partition}:cloudwatch:${region}:*:alarm:${alarmName}`;
 		} catch {
-			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			const { partition } = derivePartitionAndUrlSuffix(ambientRegion() ?? "");
 			return `arn:${partition}:cloudwatch:*:*:alarm:${alarmName}`;
 		}
 	}
@@ -27716,7 +27717,7 @@ var SSMParameterProvider = class {
 		try {
 			return await this.buildParameterArnUnguarded(name, mask);
 		} catch (error) {
-			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${describeAwsFailure(error).detail}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
+			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${displaySafe(mask(name))}: ${describeAwsFailure(error).detail}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
 			return;
 		}
 	}
@@ -27740,7 +27741,7 @@ var SSMParameterProvider = class {
 		const region = await this.ssmClient.config.region();
 		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) {
-			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
+			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${displaySafe(mask(name))} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
 		}
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
@@ -27754,14 +27755,14 @@ var SSMParameterProvider = class {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const warn = (message) => this.logger.warn(mask(message));
 		const debug = (message) => this.logger.debug(mask(message));
-		debug(`Creating SSM parameter ${logicalId}`);
+		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
 		const name = properties["Name"] || `/${generateResourceName(logicalId, {
 			maxLength: 1023,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
 		})}`;
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
-		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId);
+		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
 		try {
 			const putParams = {
 				Name: name,
@@ -27785,7 +27786,7 @@ var SSMParameterProvider = class {
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
+					debug(`Cleaned up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}) after wiring failure`);
 				} catch (cleanupError) {
 					const deleteCommand = renderDisableCommand({
 						before: "aws ssm delete-parameter --name",
@@ -27793,11 +27794,11 @@ var SSMParameterProvider = class {
 						maskSecrets: mask
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line, and a command naming the sanitized form would delete a DIFFERENT parameter.";
-					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
+					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw innerError;
 			}
-			debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			debug(`Successfully created SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(name))}`);
 			const arn = await this.buildParameterArn(name, mask);
 			return {
 				physicalId: name,
@@ -27809,7 +27810,7 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -27818,10 +27819,10 @@ var SSMParameterProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const debug = (message) => this.logger.debug(mask(message));
-		debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
+		debug(`Updating SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(physicalId))}`);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
-		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId, physicalId);
+		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId, physicalId);
 		try {
 			const putParams = {
 				Name: physicalId,
@@ -27850,9 +27851,9 @@ var SSMParameterProvider = class {
 					ResourceId: physicalId,
 					Tags: newTags
 				}));
-				debug(`Updated tags for SSM parameter ${physicalId}`);
+				debug(`Updated tags for SSM parameter ${displaySafe(mask(physicalId))}`);
 			}
-			debug(`Successfully updated SSM parameter ${logicalId}`);
+			debug(`Successfully updated SSM parameter ${displaySafe(logicalId)}`);
 			const arn = await this.buildParameterArn(physicalId, mask);
 			return {
 				physicalId,
@@ -27865,26 +27866,26 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SSM parameter ${displaySafe(logicalId)}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
 	* Delete an SSM parameter
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting SSM parameter ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting SSM parameter ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		try {
 			await this.ssmClient.send(new DeleteParameterCommand({ Name: physicalId }));
-			this.logger.debug(`Successfully deleted SSM parameter ${logicalId}`);
+			this.logger.debug(`Successfully deleted SSM parameter ${displaySafe(logicalId)}`);
 		} catch (error) {
 			if (error instanceof ParameterNotFound) {
 				const clientRegion = await this.ssmClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Parameter ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(`Parameter ${displaySafe(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SSM parameter ${displaySafe(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -28027,7 +28028,7 @@ var SSMParameterProvider = class {
 			after: "--query Parameter.Name --output text"
 		});
 		const howToRead = readCommand ? ` Read the name AWS holds with: ${readCommand}` : " Read the name AWS holds via the console: the value cdkd was given cannot be reproduced safely on a command line, so any command shown here would read a different parameter.";
-		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${displaySafe(input.logicalId)} from ${shape} ('${displaySafe(explicit)}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
 	}
 	/**
 	* Adopt an existing SSM parameter into cdkd state.
@@ -28871,7 +28872,7 @@ const generations = /* @__PURE__ */ new Map();
 * long-lived process cannot grow the map without bound.
 */
 const MAX_TRACKED_GENERATIONS = 1e5;
-const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, process.env["AWS_REGION"] ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
+const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
 const derive = (key, generation, maxLength, charset) => {
 	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
 	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
@@ -34167,7 +34168,7 @@ function appendMapPatchOps(ops, basePath, next, prev) {
 */
 var ApiGatewayV2Provider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ApiGatewayV2Provider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Set([
@@ -38058,7 +38059,7 @@ var AgentCoreEvaluatorProvider = class {
 var StepFunctionsProvider = class {
 	sfnClient;
 	s3Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("StepFunctionsProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::StepFunctions::StateMachine", /* @__PURE__ */ new Set([
 		"StateMachineName",
@@ -38650,7 +38651,7 @@ function clusterNameFromServiceArn(arn) {
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 var ECSProvider = class {
 	ecsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ECSProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::ECS::Cluster", /* @__PURE__ */ new Set([
@@ -40454,7 +40455,7 @@ const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "t
 */
 var ELBv2Provider = class {
 	elbv2Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ELBv2Provider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Set([
@@ -41732,7 +41733,7 @@ var ELBv2Provider = class {
 */
 var RDSProvider = class {
 	rdsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::RDS::DBSubnetGroup", /* @__PURE__ */ new Set([
@@ -42540,7 +42541,7 @@ const POLL_TIMEOUT_MS$1 = 18e5;
 */
 var RDSDBProxyProvider = class {
 	rdsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSDBProxyProvider");
 	attributeCache = /* @__PURE__ */ new Map();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxy", /* @__PURE__ */ new Set([
@@ -42882,7 +42883,7 @@ const POLL_TIMEOUT_MS = 18e5;
 */
 var RDSDBProxyEndpointProvider = class {
 	rdsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSDBProxyEndpointProvider");
 	attributeCache = /* @__PURE__ */ new Map();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxyEndpoint", /* @__PURE__ */ new Set([
@@ -43196,7 +43197,7 @@ var RDSDBProxyEndpointProvider = class {
 */
 var RDSDBProxyTargetGroupProvider = class {
 	rdsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSDBProxyTargetGroupProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxyTargetGroup", /* @__PURE__ */ new Set([
 		"DBProxyName",
@@ -43484,7 +43485,7 @@ var RDSDBProxyTargetGroupProvider = class {
 */
 var DocDBProvider = class {
 	docdbClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("DocDBProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::DocDB::DBSubnetGroup", /* @__PURE__ */ new Set([
@@ -44125,7 +44126,7 @@ var DocDBProvider = class {
 */
 var NeptuneProvider = class {
 	neptuneClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("NeptuneProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::Neptune::DBSubnetGroup", /* @__PURE__ */ new Set([
@@ -44908,7 +44909,7 @@ function canonicalizeQueryName(name) {
 */
 var Route53Provider = class {
 	route53Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("Route53Provider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Route53::HostedZone", /* @__PURE__ */ new Set([
 		"Name",
@@ -46975,7 +46976,7 @@ function narrowMfaConfiguration(properties) {
 */
 var CognitoUserPoolProvider = class {
 	cognitoClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("CognitoUserPoolProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
@@ -47910,7 +47911,7 @@ var CognitoUserPoolProvider = class {
 */
 var ElastiCacheProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
@@ -48448,7 +48449,7 @@ const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
 var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ServiceDiscoveryProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::ServiceDiscovery::PrivateDnsNamespace", /* @__PURE__ */ new Set([
@@ -49461,7 +49462,7 @@ const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 var AppSyncProvider = class {
 	client;
 	s3Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("AppSyncProvider");
 	/**
 	* Cache of `apiId -> GraphqlApi ARN` for the lifetime of this provider
@@ -51391,7 +51392,7 @@ function resolveTableIdentity(input) {
 */
 var GlueProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
 		"DatabaseInput",
@@ -52249,7 +52250,7 @@ var GlueWorkflowProvider = class {
 	client;
 	stsClient;
 	cachedAccountId;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueWorkflowProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Workflow", /* @__PURE__ */ new Set([
 		"Name",
@@ -52414,7 +52415,7 @@ var GlueWorkflowProvider = class {
 */
 var GlueSecurityConfigurationProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
@@ -52712,7 +52713,7 @@ function cleanCfnObject(obj) {
 * to STS when not provided.
 */
 async function buildGlueResourceArn(client, stsClient, resource, name, accountId) {
-	return `arn:aws:glue:${await client.config.region() || process.env["AWS_REGION"] || "us-east-1"}:${accountId ?? await resolveAccountId(stsClient)}:${resource}/${name}`;
+	return `arn:aws:glue:${await client.config.region() || ambientRegion() || "us-east-1"}:${accountId ?? await resolveAccountId(stsClient)}:${resource}/${name}`;
 }
 async function resolveAccountId(stsClient) {
 	const identity = await stsClient.send(new GetCallerIdentityCommand({}));
@@ -52753,7 +52754,7 @@ var GlueJobProvider = class {
 	client;
 	stsClient;
 	cachedAccountId;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueJobProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Job", /* @__PURE__ */ new Set([
 		"Name",
@@ -53142,7 +53143,7 @@ var GlueCrawlerProvider = class {
 	client;
 	stsClient;
 	cachedAccountId;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueCrawlerProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Crawler", /* @__PURE__ */ new Set([
 		"Name",
@@ -53473,7 +53474,7 @@ function toCfnCrawlerTargets(targets) {
 */
 var GlueConnectionProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueConnectionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
@@ -53628,7 +53629,7 @@ var GlueTriggerProvider = class {
 	client;
 	stsClient;
 	cachedAccountId;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueTriggerProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Trigger", /* @__PURE__ */ new Set([
 		"Name",
@@ -53851,7 +53852,7 @@ var GlueTriggerProvider = class {
 */
 var KMSProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("KMSProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Set([
 		"Description",
@@ -54308,7 +54309,7 @@ var KMSProvider = class {
 */
 var BudgetsBudgetProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("BudgetsBudgetProvider");
 	accountIdPromise;
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Budgets::Budget", /* @__PURE__ */ new Set([
@@ -54354,7 +54355,8 @@ var BudgetsBudgetProvider = class {
 	* `${AWS::Partition}` uses (issue #1815).
 	*
 	* Asking the CLIENT rather than `providerRegion` is what makes the ARN and
-	* its consumer agree. `providerRegion` is `process.env['AWS_REGION']`, and
+	* its consumer agree. `providerRegion` is `ambientRegion()` (the stack scope's region, else
+	* `process.env['AWS_REGION']`), and
 	* when that is unset `getClient()` builds `new BudgetsClient({})`, leaving
 	* the SDK to resolve the region from its OWN chain (`AWS_DEFAULT_REGION`,
 	* the `~/.aws/config` profile). So a profile-configured `cn-north-1` /
@@ -54922,7 +54924,7 @@ function comparableRecordSize(value, mask) {
 */
 var KinesisStreamProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("KinesisProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Set([
 		"Name",
@@ -55408,7 +55410,7 @@ var KinesisStreamProvider = class {
 */
 var KinesisStreamConsumerProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("KinesisStreamConsumerProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Set([
 		"ConsumerName",
@@ -55689,7 +55691,7 @@ function tagListToMap(tags) {
 */
 var SchedulerScheduleProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("SchedulerScheduleProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Scheduler::Schedule", /* @__PURE__ */ new Set([
 		"Name",
@@ -55975,7 +55977,7 @@ var SchedulerScheduleProvider = class {
 */
 var EFSProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("EFSProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::EFS::FileSystem", /* @__PURE__ */ new Set([
@@ -56900,7 +56902,7 @@ var FSxFileSystemProvider = class {
 	*/
 	disableCcApiFallback = true;
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("FSxFileSystemProvider");
 	pollIntervalMs;
 	maxWaitMs;
@@ -58007,7 +58009,7 @@ var EMRClusterProvider = class {
 	*/
 	disableCcApiFallback = true;
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("EMRClusterProvider");
 	pollIntervalMs;
 	maxWaitMs;
@@ -58798,7 +58800,7 @@ var EMRInstanceGroupConfigProvider = class {
 	*/
 	disableCcApiFallback = true;
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("EMRInstanceGroupConfigProvider");
 	pollIntervalMs;
 	maxWaitMs;
@@ -59121,7 +59123,7 @@ var EMRInstanceFleetConfigProvider = class {
 	*/
 	disableCcApiFallback = true;
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("EMRInstanceFleetConfigProvider");
 	pollIntervalMs;
 	maxWaitMs;
@@ -59427,7 +59429,7 @@ const SUPPORTED_UPDATE_DESTINATIONS = /* @__PURE__ */ new Set([
 */
 var FirehoseProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("FirehoseProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Set([
 		"DeliveryStreamName",
@@ -60775,7 +60777,7 @@ function describeValue(value) {
 */
 var CloudTrailProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("CloudTrailProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
@@ -61117,7 +61119,7 @@ var CloudTrailProvider = class {
 */
 var CodeBuildProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("CodeBuildProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CodeBuild::Project", /* @__PURE__ */ new Set([
 		"Name",
@@ -61700,7 +61702,7 @@ function triggersEqual(a, b) {
 var CodeCommitRepositoryProvider = class {
 	client;
 	s3Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("CodeCommitRepositoryProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CodeCommit::Repository", /* @__PURE__ */ new Set([
 		"RepositoryName",
@@ -62137,7 +62139,7 @@ var CodeCommitRepositoryProvider = class {
 */
 var DLMLifecyclePolicyProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("DLMLifecyclePolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
 		"Description",
@@ -62442,7 +62444,7 @@ var DLMLifecyclePolicyProvider = class {
 */
 var S3VectorsProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("S3VectorsProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Vectors::VectorBucket", /* @__PURE__ */ new Set([
 		"VectorBucketName",
@@ -62756,7 +62758,7 @@ var S3DirectoryBucketProvider = class {
 	])]]);
 	ec2Client;
 	s3ControlClient;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -62834,7 +62836,7 @@ var S3DirectoryBucketProvider = class {
 	* KNOWN BOUND (pre-existing, not introduced by #1815): the region — and now
 	* the partition derived from it — comes from `s3Client`, while the tag
 	* calls that consume this ARN go through `s3ControlClient`, built from
-	* `providerRegion` (`process.env['AWS_REGION']`). Those two can disagree,
+	* `providerRegion` (`ambientRegion()`). Those two can disagree,
 	* so the ARN can name a different region than the client receiving it. The
 	* region SEGMENT already had this exposure before the partition rode along
 	* with it; unifying the two clients' region resolution is a separate change.
@@ -63179,7 +63181,7 @@ function tableIdentityFromGetTable(tableARN, namespace, name) {
 */
 var S3TablesProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("S3TablesProvider");
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set(["TableBucketName", "Tags"])],
@@ -63981,7 +63983,7 @@ var S3TablesProvider = class {
 */
 var ECRProvider = class {
 	client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("ECRProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ECR::Repository", /* @__PURE__ */ new Set([
 		"RepositoryName",
@@ -66580,10 +66582,6 @@ async function deployCommand(stacks, options) {
 		const dagBuilder = new DagBuilder({ relaxCdkVpcDefensiveDeps: !!options.aggressiveVpcParallel });
 		const diffCalculator = new DiffCalculator();
 		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
-		const switchRegion = (region) => {
-			process.env["AWS_REGION"] = region;
-			process.env["AWS_DEFAULT_REGION"] = region;
-		};
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
 		const stackRedirects = /* @__PURE__ */ new Map();
@@ -66639,12 +66637,13 @@ async function deployCommand(stacks, options) {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
 			const stackRegion = stackInfo.region || baseRegion;
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
-			switchRegion(stackRegion);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
 				...options.profile && { profile: options.profile }
 			});
-			setAwsClients(stackAwsClients);
+			return runWithStackAwsClients(stackAwsClients, () => deployStackInScope(stackInfo, stackRegion, stackAwsClients));
+		};
+		const deployStackInScope = async (stackInfo, stackRegion, stackAwsClients) => {
 			const stateS3Client = new AwsClients({
 				region: baseRegion,
 				...options.profile && { profile: options.profile }
@@ -66812,8 +66811,6 @@ async function deployCommand(stacks, options) {
 				if (eventRecorder) await eventRecorder.finalize(runResult);
 				stackAwsClients.destroy();
 				stateS3Client.destroy();
-				switchRegion(baseRegion);
-				setAwsClients(awsClients);
 			}
 		};
 		if (options.pinCcApi?.length && options.recreateViaSdkProvider?.length) {
@@ -98143,4 +98140,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C5r-kmIQ.js.map
+//# sourceMappingURL=program-CGPchKa2.js.map