@go-to-k/cdkd 0.291.5 → 0.291.7

package/dist/{program-CAdTYHWf.js → program-Cy-pVgf_.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-BtJocpRR.js";
+import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-Gl-b_bNn.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-DVA14XyG.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CZTUKQnY.js";
+import { t as getCdkdVersion } from "./version-oHfbqdBD.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DqAx9B6g.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7284,11 +7284,10 @@ function isTruthyCfnBoolean(value) {
 * rather than a fallback.
 *
 * ONE clause for both arms so the two cannot come to render the same value
-* differently. The prose `(${bucketName})` each arm carries BESIDE it is still
-* interpolated as-is: this clause takes only the pasteable half, and
-* display-sanitizing the PROSE of provider warnings is tracked as issue
-* [#3269](https://github.com/go-to-k/cdkd/issues/3269) (#3136 covers the
-* COMMAND half across providers, not prose).
+* differently. The PROSE copy of the name each arm carries BESIDE it goes
+* through `displaySafe` at the arm, masked first (issue
+* [#3269](https://github.com/go-to-k/cdkd/issues/3269)): unlike the command, a
+* sanitized prose name names no target, so it is rendered rather than withheld.
 *
 * `maskSecrets` is REQUIRED rather than optional, and both call sites build it
 * from `context?.maskSecrets` (security review of #3136, which found these two
@@ -8383,8 +8382,8 @@ function canonicalizeItemList(properties, key, fold) {
 function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
-	if (typeof value === "string") return `a string ${JSON.stringify(maskDeep(value, maskSecrets))}`;
-	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
+	if (typeof value === "string") return `a string ${displaySafe(JSON.stringify(maskDeep(value, maskSecrets)))}`;
+	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => displaySafe(maskSecrets(key))).join(", ")}]`;
 	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 /**
@@ -8709,7 +8708,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: status }
 		}));
-		this.logger.debug(`Applied versioning (${status}) to bucket ${bucketName}`);
+		this.logger.debug(`Applied versioning (${status}) to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -8720,7 +8719,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			Tagging: { TagSet: tags }
 		}));
-		this.logger.debug(`Applied ${tags.length} tags to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${tags.length} tags to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via S3's
@@ -8746,7 +8745,7 @@ var S3BucketProvider = class S3BucketProvider {
 		if (newNorm.length === 0) {
 			try {
 				await this.s3Client.send(new DeleteBucketTaggingCommand({ Bucket: bucketName }));
-				this.logger.debug(`Cleared tags from bucket ${bucketName}`);
+				this.logger.debug(`Cleared tags from bucket ${displaySafe(bucketName)}`);
 			} catch (err) {
 				if (err.name === "NoSuchTagSet") return;
 				throw err;
@@ -8757,7 +8756,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			Tagging: { TagSet: newNorm }
 		}));
-		this.logger.debug(`Replaced tag set on bucket ${bucketName} (${newNorm.length} tags)`);
+		this.logger.debug(`Replaced tag set on bucket ${displaySafe(bucketName)} (${newNorm.length} tags)`);
 	}
 	/**
 	* Apply CORS configuration
@@ -8782,7 +8781,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			CORSConfiguration: { CORSRules: corsRules }
 		}));
-		this.logger.debug(`Applied CORS configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied CORS configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* The per-item / per-rule STRING guard, with the applier's own SKIP as the
@@ -8906,7 +8905,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (coerceCfnBoolean(rule["ExpiredObjectDeleteMarker"]) === true) {
 				const exp = sdkRule.Expiration;
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
-				else this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
+				else this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
 			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
@@ -8922,7 +8921,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const nvts = rule["NoncurrentVersionTransitions"];
 			const singularNvt = rule["NoncurrentVersionTransition"];
-			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
 			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
@@ -8931,7 +8930,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const transitions = rule["Transitions"];
 			const singularTransition = rule["Transition"];
-			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both Transitions and the legacy Transition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both Transitions and the legacy Transition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
 			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
@@ -8955,7 +8954,7 @@ var S3BucketProvider = class S3BucketProvider {
 			LifecycleConfiguration: { Rules: rules },
 			TransitionDefaultMinimumObjectSize: lifecycleConfig["TransitionDefaultMinimumObjectSize"]
 		}));
-		this.logger.debug(`Applied lifecycle configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied lifecycle configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -8975,7 +8974,7 @@ var S3BucketProvider = class S3BucketProvider {
 				RestrictPublicBuckets: config["RestrictPublicBuckets"]
 			}
 		}));
-		this.logger.debug(`Applied public access block configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied public access block configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply bucket encryption configuration
@@ -9005,7 +9004,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			ServerSideEncryptionConfiguration: { Rules: rules }
 		}));
-		this.logger.debug(`Applied encryption configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied encryption configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply logging configuration
@@ -9033,7 +9032,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				BucketLoggingStatus: {}
 			}));
-			this.logger.debug(`Cleared logging configuration on bucket ${bucketName}`);
+			this.logger.debug(`Cleared logging configuration on bucket ${displaySafe(bucketName)}`);
 			return true;
 		}
 		const loggingEnabled = {
@@ -9052,7 +9051,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			BucketLoggingStatus: { LoggingEnabled: loggingEnabled }
 		}));
-		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied logging configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9098,7 +9097,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			WebsiteConfiguration: sdkConfig
 		}));
-		this.logger.debug(`Applied website configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied website configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply accelerate configuration
@@ -9111,7 +9110,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			AccelerateConfiguration: { Status: config["AccelerationStatus"] }
 		}));
-		this.logger.debug(`Applied accelerate configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied accelerate configuration to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Apply notification configuration (full-replace via PutBucketNotificationConfiguration)
@@ -9160,7 +9159,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			NotificationConfiguration: cfg
 		}));
-		this.logger.debug(`Applied notification configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied notification configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9219,7 +9218,7 @@ var S3BucketProvider = class S3BucketProvider {
 				MetricsConfiguration: metricsConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted: /* @__PURE__ */ new Map()
@@ -9355,7 +9354,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9420,7 +9419,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const sentItem = effectiveIntelligentTieringItem(config);
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9503,7 +9502,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			if (sentItem !== config) substituted.set(index, sentItem);
 		}
-		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${displaySafe(bucketName)}`);
 		return {
 			skipped,
 			substituted
@@ -9622,7 +9621,7 @@ var S3BucketProvider = class S3BucketProvider {
 				})
 			}
 		}));
-		this.logger.debug(`Applied replication configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied replication configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9668,7 +9667,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			ObjectLockConfiguration: objectLockConfig
 		}));
-		this.logger.debug(`Applied object lock configuration to bucket ${bucketName}`);
+		this.logger.debug(`Applied object lock configuration to bucket ${displaySafe(bucketName)}`);
 		return true;
 	}
 	/**
@@ -9711,7 +9710,7 @@ var S3BucketProvider = class S3BucketProvider {
 			Bucket: bucketName,
 			OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
 		}));
-		this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
+		this.logger.debug(`Applied ownership controls to bucket ${displaySafe(bucketName)}`);
 	}
 	/**
 	* Normalize an "empty container" sub-config value to `undefined` so the diff
@@ -10111,7 +10110,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (skippedIds.size === 0 && sentItems.size === 0) return;
 			const desired = properties[key];
 			if (!Array.isArray(desired)) {
-				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
+				this.logger.debug(`Bucket ${displaySafe(bucketName)}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
 				return;
 			}
 			const previous = previousProperties[key];
@@ -10128,7 +10127,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
 		const versioningRefusal = configStringRefusal(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 		if (versioningRefusal !== void 0 && versioningChanged) {
-			this.logger.warn(`Bucket ${bucketName}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
+			this.logger.warn(`Bucket ${displaySafe(bucketName)}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
 			retainPrevious("VersioningConfiguration");
 		}
 		const desiredVersioningStatus = versioningRefusal === void 0 ? readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration") : void 0;
@@ -10142,7 +10141,7 @@ var S3BucketProvider = class S3BucketProvider {
 				return;
 			}
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
+			this.logger.debug(`Deleted ownership controls on bucket ${displaySafe(bucketName)}`);
 		});
 		const encryptionEmptyDesired = S3BucketProvider.declaresEmptyCollection(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
@@ -10151,13 +10150,13 @@ var S3BucketProvider = class S3BucketProvider {
 				return;
 			}
 			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
+			this.logger.debug(`Deleted bucket encryption on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) {
 				if (context?.desiredFromAwsReadback === true) {
 					await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
-					this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					this.logger.debug(`Deleted lifecycle configuration on bucket ${displaySafe(bucketName)} (reverting to an unset baseline)`);
 					return;
 				}
 				this.emptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules", previousProperties, retainPrevious);
@@ -10167,13 +10166,13 @@ var S3BucketProvider = class S3BucketProvider {
 			else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(cfg));
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted lifecycle configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["CorsConfiguration"], properties["CorsConfiguration"], async (cfg) => {
 			if (!cfg.CorsRules || !Array.isArray(cfg.CorsRules) || cfg.CorsRules.length === 0) {
 				if (context?.desiredFromAwsReadback === true) {
 					await this.s3Client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
-					this.logger.debug(`Deleted CORS configuration on bucket ${bucketName} (reverting to an unset baseline)`);
+					this.logger.debug(`Deleted CORS configuration on bucket ${displaySafe(bucketName)} (reverting to an unset baseline)`);
 					return;
 				}
 				this.emptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules", previousProperties, retainPrevious);
@@ -10182,11 +10181,11 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.applyCorsConfiguration(bucketName, cfg);
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted CORS configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted CORS configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["WebsiteConfiguration"], properties["WebsiteConfiguration"], async (cfg) => this.applyWebsiteConfiguration(bucketName, cfg), async () => {
 			await this.s3Client.send(new DeleteBucketWebsiteCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted website configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted website configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => {
 			if (!await this.applyLoggingConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("LoggingConfiguration");
@@ -10203,7 +10202,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketReplicationCommand({ Bucket: bucketName }));
-			this.logger.debug(`Deleted replication configuration on bucket ${bucketName}`);
+			this.logger.debug(`Deleted replication configuration on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["ObjectLockConfiguration"], properties["ObjectLockConfiguration"], async (cfg) => {
 			if (!await this.applyObjectLockConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ObjectLockConfiguration");
@@ -10212,7 +10211,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				ObjectLockConfiguration: { ObjectLockEnabled: "Enabled" }
 			}));
-			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
+			this.logger.debug(`Cleared object lock rule on bucket ${displaySafe(bucketName)}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
 		const metricsOutcomes = itemOutcomes();
@@ -10224,7 +10223,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted metrics configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("MetricsConfigurations", metricsOutcomes);
 		const analyticsOutcomes = itemOutcomes();
@@ -10236,7 +10235,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted analytics configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("AnalyticsConfigurations", analyticsOutcomes);
 		const intelligentTieringOutcomes = itemOutcomes();
@@ -10248,7 +10247,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted intelligent tiering configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("IntelligentTieringConfigurations", intelligentTieringOutcomes);
 		const inventoryOutcomes = itemOutcomes();
@@ -10260,7 +10259,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Bucket: bucketName,
 				Id: id
 			}));
-			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
+			this.logger.debug(`Deleted inventory configuration ${displaySafe(id)} on bucket ${displaySafe(bucketName)}`);
 		});
 		retainPreviousItems("InventoryConfigurations", inventoryOutcomes);
 		if (versioningChanged && desiredVersioningStatus === "Suspended") {
@@ -10269,7 +10268,7 @@ var S3BucketProvider = class S3BucketProvider {
 				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
 			};
 			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) {
-				this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+				this.logger.warn(`Bucket ${displaySafe(bucketName)}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
 				retainPrevious("VersioningConfiguration");
 			} else await this.applyVersioning(bucketName, { Status: "Suspended" });
 		}
@@ -10427,7 +10426,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* statement without the compiler losing that control flow ends there.
 	*/
 	refuseForeignRegionAdopt(logicalId, resourceType, bucketName, wantRegion, actualRegion, cause) {
-		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${bucketName} for ${logicalId} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so owning the name (which is what 'BucketAlreadyOwnedByYou' and a successful location lookup each report) never means the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, cause));
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${displaySafe(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so owning the name (which is what 'BucketAlreadyOwnedByYou' and a successful location lookup each report) never means the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, cause));
 	}
 	/**
 	* The region an already-owned bucket actually lives in, canonicalized.
@@ -10577,14 +10576,14 @@ var S3BucketProvider = class S3BucketProvider {
 		const probe = await this.probeBucketRegion(physicalId);
 		if (probe.kind === "absent") return;
 		if (probe.kind === "indeterminate") {
-			this.logger.debug(`GetBucketLocation failed for S3 bucket ${physicalId} (${logicalId}) before ${operation}: ${probe.reason}`);
+			this.logger.debug(`GetBucketLocation failed for S3 bucket ${displaySafe(physicalId)} (${displaySafe(logicalId)}) before ${operation}: ${probe.reason}`);
 			this.announceUnverifiedBucketIdentity(operation, logicalId, physicalId, probeFailedCause(probe.errorName));
 			return;
 		}
 		if (probe.region === wantRegion) return;
 		const consequence = operation === "update" ? `Applying this stack's bucket configuration would reconfigure a bucket in ${probe.region} that this stack does not own the definition of.` : `Deleting it would destroy a bucket in ${probe.region} that this stack's region does not contain, and that deletion cannot be undone.`;
-		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop cdkd's record with 'cdkd state orphan <stack>', which removes the record without touching any AWS resource, and deploy again.` : `Confirm which bucket you mean. If ${physicalId} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack>', which removes cdkd's record without touching any AWS resource, and the destroy will then have nothing to do for this resource.`;
-		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${physicalId} for ${logicalId} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
+		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop cdkd's record with 'cdkd state orphan <stack>', which removes the record without touching any AWS resource, and deploy again.` : `Confirm which bucket you mean. If ${displaySafe(physicalId)} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack>', which removes cdkd's record without touching any AWS resource, and the destroy will then have nothing to do for this resource.`;
+		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${displaySafe(physicalId)} for ${displaySafe(logicalId)} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
 	}
 	/**
 	* Say out loud that the identity guard did not run.
@@ -10619,7 +10618,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* actual defect.
 	*/
 	announceUnverifiedBucketIdentity(operation, logicalId, physicalId, cause) {
-		const message = `Could not confirm which bucket ${physicalId} for ${logicalId} is before ${operation}: ${cause.why}, so the cross-region guard did NOT run and cdkd is proceeding on the recorded physical id alone.`;
+		const message = `Could not confirm which bucket ${displaySafe(physicalId)} for ${displaySafe(logicalId)} is before ${operation}: ${cause.why}, so the cross-region guard did NOT run and cdkd is proceeding on the recorded physical id alone.`;
 		if (operation === "delete") {
 			this.logger.warn(`${message} If this state record names a bucket in another region, this destroy will delete THAT bucket. ${cause.remedy}`);
 			return;
@@ -10630,7 +10629,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* Create an S3 bucket
 	*/
 	async create(logicalId, resourceType, properties, context) {
-		this.logger.debug(`Creating S3 bucket ${logicalId}`);
+		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
 			maxLength: 63,
 			lowercase: true,
@@ -10648,13 +10647,13 @@ var S3BucketProvider = class S3BucketProvider {
 				await this.s3Client.send(new CreateBucketCommand(createParams));
 				createdNewBucket = preflight.kind === "absent";
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
-				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${bucketName} for ${logicalId} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${bucketName} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
-				this.logger.debug(`Created S3 bucket: ${bucketName}`);
+				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${displaySafe(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${displaySafe(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
+				this.logger.debug(`Created S3 bucket: ${displaySafe(bucketName)}`);
 			} catch (createError) {
 				if (createError instanceof ProvisioningError) throw createError;
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) {
 					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
-					this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
+					this.logger.debug(`S3 bucket ${displaySafe(bucketName)} already exists and is owned by you`);
 				} else throw createError;
 			}
 			let effectiveOverrides;
@@ -10664,21 +10663,21 @@ var S3BucketProvider = class S3BucketProvider {
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
+					this.logger.debug(`Cleaned up partially-created S3 bucket ${displaySafe(logicalId)} (${displaySafe(bucketName)}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${describeAwsFailure(cleanupError).detail}`);
+					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${displaySafe(logicalId)} (${displaySafe(bucketName)}): ${describeAwsFailure(cleanupError).detail}`);
 					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
-					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
+					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${displaySafe(logicalId)} (${displaySafe(maskSecrets(bucketName))}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				else if (preflight.kind === "indeterminate") {
-					this.logger.debug(`GetBucketLocation failed for S3 bucket ${bucketName} (${logicalId}) during create: ${preflight.reason}`);
+					this.logger.debug(`GetBucketLocation failed for S3 bucket ${displaySafe(bucketName)} (${displaySafe(logicalId)}) during create: ${preflight.reason}`);
 					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
-					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
+					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${displaySafe(logicalId)} (${displaySafe(maskSecrets(bucketName))}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				throw innerError;
 			}
 			const attributes = await this.buildAttributes(bucketName);
-			this.logger.debug(`Successfully created S3 bucket ${logicalId}: ${bucketName}`);
+			this.logger.debug(`Successfully created S3 bucket ${displaySafe(logicalId)}: ${displaySafe(bucketName)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId: bucketName,
@@ -10693,10 +10692,10 @@ var S3BucketProvider = class S3BucketProvider {
 	* Update an S3 bucket
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		this.logger.debug(`Updating S3 bucket ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Updating S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		const newBucketName = properties["BucketName"];
 		if (newBucketName && newBucketName !== physicalId) {
-			this.logger.debug(`Bucket name changed (${physicalId} -> ${newBucketName}), replacement required`);
+			this.logger.debug(`Bucket name changed (${displaySafe(physicalId)} -> ${displaySafe(newBucketName)}), replacement required`);
 			return {
 				physicalId,
 				wasReplaced: true
@@ -10711,7 +10710,7 @@ var S3BucketProvider = class S3BucketProvider {
 			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties, context)) effectiveOverrides.set(key, value);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
-			this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
+			this.logger.debug(`Successfully updated S3 bucket ${displaySafe(logicalId)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId,
@@ -10729,7 +10728,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* Note: The bucket must be empty before deletion.
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting S3 bucket ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion);
 		else this.announceUnverifiedBucketIdentity("delete", logicalId, physicalId, noRecordedRegionCause());
@@ -10739,7 +10738,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (error instanceof NoSuchBucket) {
 				const clientRegion = await this.s3Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(`Bucket ${displaySafe(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error);
@@ -10785,8 +10784,8 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
 		const failure = describeAwsFailure(error);
-		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${logicalId} (${physicalId}): ${failure.detail}`);
-		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)} (${displaySafe(physicalId)}): ${failure.detail}`);
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${failure.summary}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	/**
@@ -11477,20 +11476,20 @@ var S3BucketProvider = class S3BucketProvider {
 		const maxAttempts = 3;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-			this.logger.debug(`Successfully deleted S3 bucket ${logicalId}`);
+			this.logger.debug(`Successfully deleted S3 bucket ${displaySafe(logicalId)}`);
 			return;
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
-				this.logger.info(`Bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
+				if (!allowAutoEmpty) throw new Error(`bucket ${displaySafe(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
+				this.logger.info(`Bucket ${displaySafe(bucketName)} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
 				await this.emptyBucket(bucketName);
 				continue;
 			}
 			throw error;
 		}
 		await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
-		this.logger.debug(`Successfully deleted S3 bucket ${logicalId}`);
+		this.logger.debug(`Successfully deleted S3 bucket ${displaySafe(logicalId)}`);
 	}
 	/**
 	* Empty a bucket by deleting all object versions and delete markers.
@@ -11529,7 +11528,7 @@ var S3BucketProvider = class S3BucketProvider {
 						Quiet: true
 					}
 				}));
-				this.logger.debug(`Emptied ${objects.length} objects from ${bucketName}`);
+				this.logger.debug(`Emptied ${objects.length} objects from ${displaySafe(bucketName)}`);
 			}
 			if (!listResp.IsTruncated) break;
 			keyMarker = decodeListingKey(listResp.NextKeyMarker);
@@ -26025,14 +26024,16 @@ var LogsLogGroupProvider = class {
 			} catch (innerError) {
 				if (createdNewLogGroup) try {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
-					this.logger.debug(`Cleaned up partially-created log group ${logicalId} (${logGroupName}) after wiring failure`);
+					this.logger.debug(`Cleaned up partially-created log group ${displaySafe(logicalId)} (${displaySafe(logGroupName)}) after wiring failure`);
 				} catch (cleanupError) {
+					const mask = maskerOrIdentity(context?.maskSecrets);
 					const deleteCommand = renderDisableCommand({
 						before: "aws logs delete-log-group --log-group-name",
-						identifier: logGroupName
+						identifier: logGroupName,
+						maskSecrets: mask
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
-					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
+					this.logger.warn(mask(`Failed to clean up partially-created log group ${displaySafe(logicalId)} (${displaySafe(mask(logGroupName))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`));
 				}
 				throw innerError;
 			}
@@ -27716,7 +27717,7 @@ var SSMParameterProvider = class {
 		try {
 			return await this.buildParameterArnUnguarded(name, mask);
 		} catch (error) {
-			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${describeAwsFailure(error).detail}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
+			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${displaySafe(mask(name))}: ${describeAwsFailure(error).detail}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
 			return;
 		}
 	}
@@ -27740,7 +27741,7 @@ var SSMParameterProvider = class {
 		const region = await this.ssmClient.config.region();
 		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) {
-			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
+			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${displaySafe(mask(name))} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
 		}
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
@@ -27754,14 +27755,14 @@ var SSMParameterProvider = class {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const warn = (message) => this.logger.warn(mask(message));
 		const debug = (message) => this.logger.debug(mask(message));
-		debug(`Creating SSM parameter ${logicalId}`);
+		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
 		const name = properties["Name"] || `/${generateResourceName(logicalId, {
 			maxLength: 1023,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
 		})}`;
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
-		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId);
+		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
 		try {
 			const putParams = {
 				Name: name,
@@ -27785,7 +27786,7 @@ var SSMParameterProvider = class {
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
+					debug(`Cleaned up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}) after wiring failure`);
 				} catch (cleanupError) {
 					const deleteCommand = renderDisableCommand({
 						before: "aws ssm delete-parameter --name",
@@ -27793,11 +27794,11 @@ var SSMParameterProvider = class {
 						maskSecrets: mask
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line, and a command naming the sanitized form would delete a DIFFERENT parameter.";
-					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
+					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw innerError;
 			}
-			debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			debug(`Successfully created SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(name))}`);
 			const arn = await this.buildParameterArn(name, mask);
 			return {
 				physicalId: name,
@@ -27809,7 +27810,7 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -27818,10 +27819,10 @@ var SSMParameterProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const debug = (message) => this.logger.debug(mask(message));
-		debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
+		debug(`Updating SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(physicalId))}`);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
-		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId, physicalId);
+		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId, physicalId);
 		try {
 			const putParams = {
 				Name: physicalId,
@@ -27850,9 +27851,9 @@ var SSMParameterProvider = class {
 					ResourceId: physicalId,
 					Tags: newTags
 				}));
-				debug(`Updated tags for SSM parameter ${physicalId}`);
+				debug(`Updated tags for SSM parameter ${displaySafe(mask(physicalId))}`);
 			}
-			debug(`Successfully updated SSM parameter ${logicalId}`);
+			debug(`Successfully updated SSM parameter ${displaySafe(logicalId)}`);
 			const arn = await this.buildParameterArn(physicalId, mask);
 			return {
 				physicalId,
@@ -27865,26 +27866,26 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SSM parameter ${displaySafe(logicalId)}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
 	* Delete an SSM parameter
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting SSM parameter ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting SSM parameter ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		try {
 			await this.ssmClient.send(new DeleteParameterCommand({ Name: physicalId }));
-			this.logger.debug(`Successfully deleted SSM parameter ${logicalId}`);
+			this.logger.debug(`Successfully deleted SSM parameter ${displaySafe(logicalId)}`);
 		} catch (error) {
 			if (error instanceof ParameterNotFound) {
 				const clientRegion = await this.ssmClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Parameter ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(`Parameter ${displaySafe(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SSM parameter ${displaySafe(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -28027,7 +28028,7 @@ var SSMParameterProvider = class {
 			after: "--query Parameter.Name --output text"
 		});
 		const howToRead = readCommand ? ` Read the name AWS holds with: ${readCommand}` : " Read the name AWS holds via the console: the value cdkd was given cannot be reproduced safely on a command line, so any command shown here would read a different parameter.";
-		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${displaySafe(input.logicalId)} from ${shape} ('${displaySafe(explicit)}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
 	}
 	/**
 	* Adopt an existing SSM parameter into cdkd state.
@@ -73789,7 +73790,11 @@ async function driftCommand(stacks, options) {
 		const targetRefs = resolveTargetRefs(stacks, await stateBackend.listStacks(), options);
 		const reports = [];
 		for (const ref of targetRefs) {
-			if (!ref.region) throw new Error(`Stack '${ref.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${ref.stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run drift detection.`);
+			if (!ref.region) {
+				const migrate = stackCommandFor("cdkd deploy", ref.stackName, { patternMatched: true });
+				const identity = stackIdentityLine(ref.stackName);
+				throw new Error("A state record for this stack is a legacy one with no region, which drift cannot read. A cdkd write migrates it to the region-scoped layout; re-run drift detection after it." + (identity === void 0 ? "\nThe stack name is not printed here: a name is printed only when it renders exactly, is non-empty and fits the reference cap — this one fails at least one of those." : `\n${identity}`) + (migrate === void 0 ? `\nThe migrate command is not printed here: ${WITHHELD_COMMAND_REASON} List records as stored with 'cdkd state list --json' and migrate the one whose key matches.` : `\nMigrate with: ${migrate}`));
+			}
 			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair");
 			reports.push(report);
 		}
@@ -74889,7 +74894,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				for (const change of outcome.changes) {
 					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
 					if (refusal !== void 0) {
-						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift ${report.stackName} --revert' to push the referenced value back to AWS, or re-deploy if the reference changed.`);
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed.`);
 						continue;
 					}
 					setAtPath(newBaseline, change.path, change.awsValue);
@@ -76186,7 +76191,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
 					logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
 				} catch (err) {
-					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift ${report.stackName} --revert' once the state write can succeed.`);
+					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift --revert' for this stack once the state write can succeed.`);
 				}
 			}
 		} finally {
@@ -76297,7 +76302,7 @@ function printRevertPlan(reports, out) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
 					for (const path of unbaselined) out.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
-					out.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
+					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed' for this stack (or re-deploy) to populate observedProperties if you want them reverted too.\n");
 				}
 			}
 		}
@@ -76466,6 +76471,134 @@ function formatScalar(value) {
 	return JSON.stringify(value);
 }
 /**
+* Why a command is not printed, phrased as the RULE rather than as a claim
+* about the name (m19 of the go-to-k/cdkd#3486 review). This SUPERSEDES the
+* m4 / m10 wording, which said the constant should name every reason the gate
+* has "since naming one tells the operator something false about the others" —
+* the enumeration is what round 4 measured as the defect.
+*
+* The earlier wording was a four-way disjunction — "does not render exactly, is
+* empty, is too long, or ... an option or a pattern" — which is true, but three
+* of the four disjuncts are visibly FALSE of a name printed on the `Stack:`
+* line right above it: `--all` renders exactly, is non-empty and is short. A
+* reader checking the sentence against what they can see concludes the tool is
+* guessing.
+*
+* The leading-`-` clause is stated as the GATE rather than as a parse, because
+* the gate is wider than Commander: `--all` really is parsed as the flag, while
+* a BARE `-` Commander takes positionally (measured) and this refuses it
+* anyway. Writing "would be read as an option" would be false of that one name.
+*
+* Naming the ACTUAL reason needs the gate to return it, and deriving it here
+* from a second copy of the predicates is the exact defect go-to-k/cdkd#3499
+* closed one file over. So this states the rule and leaves the reason to the
+* go-to-k/cdkd#3436 fold-in, where `pasteableCommand` supplies it.
+*/
+const WITHHELD_COMMAND_REASON = "a name is printed in a command only when it renders exactly, is non-empty, fits the reference cap, does not begin with '-', and is not a 'cdkd deploy' pattern — this one fails at least one of those.";
+/**
+* Does `value` reach the terminal as itself — sanitizing changes nothing, and
+* the state-reference cap does not cut it?
+*
+* Module-private and shared by {@link stackCommandFor} and
+* {@link stackIdentityLine}: the identity line and the command it sits above
+* must agree about which names are safe to print, and two spellings of this
+* predicate is how they would come to disagree.
+*/
+function rendersExactly(value) {
+	if (value === "") return false;
+	const safe = displaySafe(value, { asciiOnly: true });
+	return safe === value && !truncateCodePoints(safe, 1152).truncated;
+}
+/**
+* The `Stack: '<name>'` line that carries a record's identity NEXT TO a
+* pasteable command, or `undefined` when the name cannot be printed at all.
+*
+* A labelled command line is a trusted-looking shape, and a stack name is an
+* S3 key segment `listStacks` validates only for non-emptiness — so a name
+* carrying a newline printed ABOVE one forges a second labelled line that the
+* operator has every reason to trust. The same gate as the command, on its own
+* line, shell-quoted: inside a sentence a `$(...)` name executes when the
+* phrase is pasted, and `displayIdent`'s JSON quotes would not stop that —
+* double quotes do not close command substitution.
+*
+* USED BY SITE 1 ALONE, deliberately. A labelled command line is only safe in
+* a block whose OTHER values are gated too, and site 1's block carries exactly
+* two: this identity and the command beside it. The blocks that also carry a
+* property path, a resource type, a state-write error message or an AWS
+* readback value cannot meet that bar
+* by sanitizing — an arbitrary value cannot be gated for exactness and still
+* printed — so they keep their command in prose and the whole class is
+* [#3436](https://github.com/go-to-k/cdkd/issues/3436)'s.
+*/
+function stackIdentityLine(stackName, indent = "") {
+	return rendersExactly(stackName) ? `${indent}Stack: ${shellQuote(stackName)}` : void 0;
+}
+/**
+* A pasteable `cdkd ...` command addressing ONE state record, or `undefined`
+* when this stack name cannot be named safely — in which case the caller names
+* the command in prose and leaves the operator to supply the name.
+*
+* Every name these messages carry comes out of an S3 KEY (`listStacks`, and the
+* `report.stackName` derived from it), so it is as untrusted as a state record's
+* body (issue [#3307](https://github.com/go-to-k/cdkd/issues/3307)). Four gates,
+* and each closes a different failure:
+*
+* - SANITIZE, then compare against the RAW value. `displaySafe` drops the
+*   forgery class (C0 + DEL, `U+0085` and C1, `U+2028`/`U+2029`, the bidi
+*   overrides), so a name carrying one is never NAMED IN A COMMAND; and a name
+*   it ALTERED addresses a DIFFERENT record, the misdirection
+*   `malformedDestroyResourcesRefusalMessage` and `orphanCommandFor` already
+*   gate for. `asciiOnly` here rather than the denylist, because a stack name's
+*   charset is the S3 key's. What this does NOT do is sanitize the identity the
+*   surrounding prose prints: `report.stackName` reaches ~20 message sites in
+*   this file raw, which is the DISPLAY class go-to-k/cdkd#3232 records, not
+*   this gate's.
+* - CAP at `STACK_REF_MAX_CODE_POINTS`, the state-reference grammar, so a
+*   multi-kilobyte planted name cannot grow the pasted payload without bound,
+*   while a legitimate multi-level nested child (`Parent~Child~...`) still
+*   renders. It bounds the PAYLOAD and nothing more — a name at the cap still
+*   wraps across a terminal, which is `display-safe.ts`'s own caveat on the
+*   constant (go-to-k/cdkd#3179).
+* - SHELL-QUOTE, and print the command LAST and UNWRAPPED on its own labelled
+*   line. `shellQuote` is only as good as the quote context around it: inside
+*   prose `'...'` a quoted value turns the quoting inside out and a pasted span
+*   RUNS (measured in go-to-k/cdkd#3363; the class is go-to-k/cdkd#3436).
+* - REFUSE a name the COMMAND would read as something other than a name. A
+*   leading `-` is refused CONSERVATIVELY: `--all` survives sanitizing, the cap
+*   and quoting and is then parsed by Commander as the flag, addressing every
+*   stack. (A BARE `-` Commander takes positionally, so the refusal is wider
+*   than the parse — the gate is "starts with `-`", not "parses as an option".)
+*   And `cdkd deploy` matches its argument as a PATTERN
+*   (`src/cli/stack-matcher.ts`), where `*` is a wildcard and `/` selects by
+*   display path. `patternMatched` asks for the last two; `/` cannot arrive
+*   through a key (`listStacks` splits keys on it), so that half is defensive.
+*
+* **`region` and `flags` have NO production caller today, and neither does
+* `stackIdentityLine`'s `indent`** (M16 / m17 of the go-to-k/cdkd#3486 review;
+* the one call site is the legacy region-less refusal, which has no region by
+* definition and passes only `patternMatched`). They are kept, with their
+* cases, as the landing place for the three `cdkd drift` sites
+* go-to-k/cdkd#3436 owns — the `--stack-region` requirement go-to-k/cdkd#3307
+* states for `:6139` is exactly what `region` exists to satisfy. Read their
+* hazard-matrix cases as a SPECIFICATION for that landing, not as coverage of
+* a live path. `region` takes the same gates as the NAME — sanitize,
+* exactness, the cap, emptiness and the leading `-` — because a region is a
+* key SEGMENT, no more trusted than the name.
+*
+* Exported for `tests/unit/cli/drift.test.ts`, which drives the hazard matrix
+* through it directly; the one call site is driven through the CLI separately,
+* since what a site PASSES is not something a helper test can see.
+*/
+function stackCommandFor(command, stackName, opts = {}) {
+	if (!rendersExactly(stackName) || stackName.startsWith("-")) return void 0;
+	if (opts.patternMatched && (stackName.includes("*") || stackName.includes("/"))) return void 0;
+	if (opts.region !== void 0 && (!rendersExactly(opts.region) || opts.region.startsWith("-"))) return;
+	const parts = [command, shellQuote(stackName)];
+	if (opts.flags !== void 0) parts.push(opts.flags);
+	if (opts.region !== void 0) parts.push(`--stack-region ${shellQuote(opts.region)}`);
+	return parts.join(" ");
+}
+/**
 * Reusable `--stack-region <region>` option (mirrors `state show`).
 */
 function stackRegionOption$2() {
@@ -98139,4 +98272,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CAdTYHWf.js.map
+//# sourceMappingURL=program-Cy-pVgf_.js.map