@go-to-k/cdkd 0.299.8 → 0.300.1

package/dist/{program-C87Q8YFK.js → program-DVPHKsxv.js}

@@ -1,9 +1,9 @@
-import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-Bj7qH5Ph.js";
+import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-dAY3-gXJ.js";
-import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as unwrittenCreateOnlyReplacement, $c as getLegacyStateBucketName, $i as malformedExportSourceWarning, $n as formatDestructiveChange, $o as recordLogOnlyParameterValue, $r as explicitRoleArnOrThrow, $s as hasReadableExportSet, $t as replacementNeverSwapped, A as diffSecurity, Aa as refuseMalformedResourceEntriesForImport, Ac as describeDockerExecFailure, Ai as cfnRefValueFromPhysicalId, Al as absoluteAssemblyPathEscape, An as DEFAULT_RESOURCE_WARN_AFTER_MS, Ar as RollbackInlinePolicyWriters, As as recordNoEchoParameterFreshValue, At as withNestedStackContext, B as readProtection, Ba as refuseMalformedState, Bc as redactedCause, Bi as STATE_RESOURCES_MALFORMED, Bn as extractDeploymentEventError, Bo as noEchoLeavesOf, Bs as isLockInfoExpired, Ca as refuseMalformedOrphansForOrphan, Cc as readBootstrapMarkerBody, Ci as getAccountInfo, Cl as StageLoadError, Cn as isWholeDynamicReferenceValue, Cr as withPrintingSecrets, Cs as recordPhysicalNameCopy, Ct as nestedChildStackName$1, D as findServiceTokenRefusals, Da as refuseMalformedResourceEntries, Dc as buildDockerImage, Di as isNamelessDynamicReferenceError, Dl as hasPlainPrototype, Dn as isExportAliasCollision, Do as withRetry, Dr as CloudControlProvider, Ds as recordMaskOnlyValue, Dt as withNestedRevertRun, E as deferredServiceTokenWarning, Ea as refuseMalformedResourceAttributesForOrphan, Ec as buildDenyExternalAccessPolicy, Ei as carriesFetchableDynamicReference, El as hasOwnKey, En as collectPublishedOutputNames, Eo as describeTypeWithThrottleRetry, Er as customResourceResponseExpirationWarning, Es as provenPublicValue, Et as revertedNestedRowIds, F as recordedProtectionEvidence, Fa as refuseMalformedResourcePropertiesForExport, Fc as getDockerCmd, Fi as parameterInputsFor, Fl as injectAwsRegion, Fn as secretNamePrintingBag, Fo as maskAtCoordinates, Fs as STATE_SOURCED_READBACK_RULES, Ft as loadJournaledOrphans, Ga as repairMalformedResourcePropertiesForReadOnly, Gc as escapeRegExp, Gi as displayLogicalId, Gn as createPreDeleteFinalSnapshot, Go as valueAtCoordinate, Gr as INTRINSIC_KEYS, Gs as applyCrossPrefixScan, Gt as recordAfterRollbackUpdate, Ha as repairMalformedOrphansForReadOnly, Hc as runDockerForeground, Hi as UNREADABLE_RESOURCES_MAP_ROW, Hn as PRE_DELETE_SNAPSHOT_TYPES, Hs as rebuildClientForBucketRegion, I as recordedProtectionNote, Ia as refuseMalformedResourcePropertiesForOrphan, Ic as isDockerClientEnvKey, Il as injectedAwsRegionValue, In as secretNamePrintingBags, Io as maskReadbackAtCoordinates, Ir as isWaitAbandonedError, Is as TEMPLATE_SOURCED_RULES, It as makeForeignHolderScan, Ja as unreadableOrphanRecords, Jc as AssetManifestLoader, Ji as hasReadableResources, Jn as refusesFinalSnapshot, Jo as createUnionSecretMasker, Jr as producerLookupOver, Js as isNotImplemented, Jt as isReplacementOrphan, Ka as repairMalformedResourcesForReadOnly, Kc as stripControlChars, Ki as hasReadableOrphans, Kn as effectiveDeletionPolicy, Ko as liveMatchesUnresolvedTokenFrame, Kr as IntrinsicFunctionResolver, Ks as crossPrefixDeniedWarning, Kt as demoteSupersededOrphans, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourcesForDeploy, Lc as isMalformedEnvKey, Li as declaresNoEcho, Ln as secretNamedRecordNeedles, Lo as maskWholeValue, Ls as WHOLE_DYNAMIC_REFERENCE_PATTERN, Lt as sameJournaledOrphans, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceEntriesForOrphan, Mc as dockerSpawnEnvWithSensitive, Mi as refStateLookupFromResource, Ml as displayAssemblyPath, Mn as journaledOrphanPrintingBag, Mo as TemplateParser, Mr as deleteIndeterminateGuards, Ms as wholeStringLeavesOf, Mt as dropFailedHint, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourcePropertiesForDestroy, Nc as finchSecretArgvRefusal, Nl as renderAssemblyPathEscape, Nn as maskEventTextWithBoundBags, No as canonicalCoordinates, Nr as deleteLeftInPlace, Ns as STATE_SOURCED_BASELINE_RULES, Nt as isHandledOrphan, O as serviceTokenBlockingReason, Oa as refuseMalformedResourceEntriesForDeploy, Oc as resolveDockerContextDirectory, Oi as keepsSecretReferenceToken, Ol as nullPrototypeRecord, On as bindingSkippedOutputs, Or as slowCcOperationTimeoutMs, Os as recordMaskOnlyValuesIn, Ot as collectNestedChildUnaddressed, P as noEchoParameterNamesOf, Pa as refuseMalformedResourcePropertiesForDrift, Pc as formatDockerLoginError, Pi as withSharedDrainBudget, Pl as resolveAssemblyPath, Pn as orphanRecordsPrintingBag, Po as isMarkedCoordinate, Pr as deleteSkipReason, Ps as STATE_SOURCED_CROSS_GENERATION_RULES, Pt as journaledOrphanLines, Qc as getDefaultStateBucketName, Qi as malformedExportNamesWarning, Qn as findDestructiveChanges, Qo as printingCorpusOf, Qr as assertSendableRoleArn, Qs as exportNamesCarriedFrom, Qt as recordUnderIdIsNotOwn, R as isProtectionValueActive, Ra as refuseMalformedResourcesForDestroy, Rc as partitionSensitiveEnv, Ri as JSON_LISTING_HOLE_VALUE, Rl as resolveBucketRegion, Rn as stateSecretNameNeedles, Ro as maskedLeafCoordinatesOf, Rs as isSingleDynamicReferenceToken, Rt as replayFailedOperations, Sa as refuseMalformedOrphansForDestroy, Sc as parseBootstrapMarker, Si as parameterTypeMayLoseSecretIdentity, Sl as AssemblyReader, Sn as exportNameSecretExposure, T as recordRetainedForReadoption, Ta as refuseMalformedOutputsForDestroy, Tc as validateContainerRepoName, Ti as carriesDynamicReference, Tl as defineOwnKey, Tn as collectDeclaredOutputNames, To as templateResourceTypes, Tr as applyCustomResourceResponseExpiration, Ts as carriesSecretMask, Ua as repairMalformedOutputsForReadOnly, Uc as runDockerStreaming, Ui as accountArgs, Un as buildFinalSnapshotIdentifier, Uo as readbackPathFor, Us as CrossPrefixReadError, Ut as withStackRecords, Va as repairMalformedOrphanRecordsForReadOnly, Vc as redactedDockerCause, Vi as UNREADABLE_ORPHANS_CONTAINER_ROW, Vn as ATOMIC_FINAL_SNAPSHOT_TYPES, Vo as noEchoOutputsComparison, Vs as S3StateBackend, Vt as destroyStackRecordsView, Wa as repairMalformedResourceEntriesForReadOnly, Wc as warnFinchArgvExposure, Wi as deployRefusesOrphanRowsReason, Wn as ccRoutedFinalSnapshotError, Wo as readsNoEchoSource, Wr as DiffCalculator, Ws as CrossPrefixScanCache, Wt as removeProtectionTypeList, Xa as withheldAccountClause, Xc as Synthesizer, Xi as isReadableResourceEntry, Xn as maskingRetryLogger, Xo as literalSplitDelimitersOf, Xr as applyRoleArnIfSet, Xs as acceptedCreateOnlyDropsOf, Xt as planRollback, Ya as unreadableResourceEntries, Yc as getDockerImageBySourceHash, Yi as isReadableOrphanRecord, Yn as unsupportedFinalSnapshotError, Yo as hasMaskableValues, Yr as refuseUnreadableCdkCrossAccountRefs, Ys as splitImportedOps, Yt as planFailedOps, Za as findActionableSilentDrops, Zc as synthesisStatusMessage, Zi as malformedDriftResourcePropertiesWarning, Zn as constructPathOf, Zo as logOnlyValueCount, Zr as assertFlagRoleArn, Zs as describeRegionValueKind, Zt as recheckFailedPlan, _ as keptWholeReasonText, _a as refuseDivergentRecordRegionForDestroy, _c as BOOTSTRAP_MARKER_PREFIX, _i as classifyReplaySecretRegion, _l as decodeListingKey, _n as secretBearing, _r as isCustomResource, _s as identityKeyFor, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedOrphanRowsKeptWarning, ac as orphansAfterRollback, ai as envCredentialsAreAssumedRole, al as resolveStateBucketWithDefault, an as inheritProducerRegions, ao as MULTI_REGION_RECREATE_BLOCKED_TYPES, as as maskSecretsInText, at as createReadOnlyAttributeHealerFactory, ba as refuseMalformedOrphanRecordsForDestroy, bc as getBootstrapMarkerKey, bi as coerceParameterTypedValue, bl as canonicalizeRegion, bn as carriedExportAliasExposure, br as readsNoEchoDeleteValues, bt as displacedPhysicalIdShown, c as isAbsoluteAssetPath, ca as malformedOutputsRefusalMessage, cc as AssetPublisher, cl as stateBucketExistenceConfirmed, co as renderStatefulReason, ct as gray, d as templateIdentity, da as malformedResourceEntriesWarning, dc as WorkGraph, dl as CFN_TEMPLATE_BODY_LIMIT, dn as updatePartialReason, ds as withPhysicalNameCopies, dt as yellow, ea as malformedLocalOutputsWarning, ec as hasReasonlessBaselineRefusal, ei as isIamRoleArn, el as loadCdkJson, en as resolveReplacementOldType, es as recordLogOnlyValue, f as conditionFingerprint, fa as malformedResourcePropertiesWarning, fc as buildAssetRedirectMap, fl as CFN_TEMPLATE_URL_LIMIT, fn as DeploymentEventsReader, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as previewableOrphanRecords, gc as AssetModeResolver, gi as classifyRecordedSecretRegion, gl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gn as exportAliasCollisionScrubWarning, gr as ccBrokenReason, gs as pathCrossesDottedKey, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedStateRefusalMessage, hc as rewriteTemplateAssetReferences, hl as uploadCfnTemplate, hn as displayTextOrWithheld, hr as ProviderRegistry, hs as isUncertifiedBaselineMaskPosition, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedOrphanRecordsWarning, ic as isReadableBag, ii as callerEnvCredentials, il as resolveSkipPrefix, io as shownType, is as maskSecretsInError, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedResourceEntriesForImportSave, jc as describeDockerFailure, ji as isStalePlaceholderArnAttribute, jl as describeFileReadFailure, jn as completedReplayEntries, jo as DagBuilder, jr as UNSPECIFIED_SKIP_REASON, js as recordProvenPublicExpression, jt as deleteJournaledOrphans, k as withResourceDeadline, ka as refuseMalformedResourceEntriesForDestroy, kc as describeDockerCapturedOutput, ki as AWS_NO_VALUE, kl as ownValue, kn as DEFAULT_RESOURCE_TIMEOUT_MS, ks as recordNoEchoAttributeValues, l as listNestedTemplateRows, la as malformedOutputsWarning, lc as isSensitiveAttributeName, li as recordedOutputReferenceRegions, ll as warnDeprecatedNoPrefixCliFlag, ls as redactSecretsForState, lt as green, m as parentSuppliedValues, ma as malformedScrubResourceEntriesRefusalMessage, mc as loadPublishableAssetManifest, ml as findLargeInlineResources, mn as WITHHELD_NAME_DISPLAY, mr as CC_BROKEN_REASON, ms as dynamicReferenceTokens, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedLocalResourcesWarning, nc as importableOutputKeys, ni as AWS_CREDENTIAL_ENV_KEYS, nl as resolveAutoAssetStorage, nn as orphanDeleteNeedsIdentity, no as hasNoCloudControlHandlers, ns as createSecretMasker, o as childTemplateLoader, oa as malformedOrphansRefusalMessage, oc as orphansCarriedFrom, ol as resolveStateBucketWithDefaultAndSource, oo as isStatefulRecreateTargetForReplace, os as markSameGenerationBag, ot as bold, p as conditionInputsFrom, pa as malformedResourcesWarning, pc as createAssetRedirectResolver, pl as MIGRATE_TMP_PREFIX, pn as DeploymentEventsStore, ps as DYNAMIC_REFERENCE_TOKEN_SCAN, pt as namesAnyDeclaredParameter, qa as unpreviewableOrphanRecords, qc as stripForDisplay, qi as hasReadableOutputs, qn as isFinalSnapshotError, qo as carryLogOnlyValues, qr as poisonRenderedSpellingsCollidingIn, qs as isAccessDenied, qt as isJournaledOrphan, r as computeImplicitDeleteEdges, ra as malformedOrphanRecordsRefusalMessage, rc as importableOutputs, ri as applyCallerIdentityCredentials, rl as resolveCaptureObservedState, rn as findNestedStackTypeChanges, ro as findReplacedReadersOfRecreateTargets, rr as withCreateTokenLedger, rs as errorCauseChain, s as findNestedTemplateTreeDefect, sa as malformedOrphansWarning, sc as shouldRetainResource, si as keepHeldTokenProvenance, sl as resolveUseCdkBootstrapAssets, so as isStatefulRecreateTargetSync, st as cyan, t as DeployEngine, ta as malformedLocalResourceEntriesWarning, tc as hasUnverifiableParameterRefusal, ti as sendableAssumeRoleCommand, tl as resolveApp, tn as seedsDeleteFirstGuard, to as NO_CC_HANDLERS_REASON, tr as ledgerForStack, ts as shareLogOnlyValues, u as renderNestedTemplateTreeDefect, ua as malformedRenderedContainersWarning, uc as stringifyValue, ui as recordedReferenceRegions, ul as ssmResolvedValueType, un as updatePartialMessage, us as scrubResourceRecord, ut as red, v as mergeNoChangeOutputs, vc as assertAssetBucketRegion, vi as producerRegionsFromState, vl as expectedOwnerParam, vn as secretBearingStateKeyWarning, vr as wouldReturnToSdkProvider, vs as inheritNestedStackParameterAssociations, vt as NESTED_PENDING_PARENT_REASON, w as keptForReadoption, wa as refuseMalformedOutputs, wc as validateAssetBucketName, wi as isImpossibleEmptyStoredAttribute, wl as processStackMessages, wn as noEchoParameterValueSeed, wo as prefetchCreateOnlyPropertyPaths, wr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, ws as splitGetAttStringForm, wt as recordDisplacedSkips, xa as refuseMalformedOrphans, xc as isCrossRegionRedirect, xi as isUnboundTemplateParameter, xl as derivePartitionAndUrlSuffix, xn as exportNameNoEchoParameters, xr as isCustomResourceType$1, xs as physicalNameCopiesOf, xt as dropSettledNestedJournals, y as makeCanonicalizePropertiesFn, ya as refuseMalformedOrphanRecords, yc as ensureAssetStorage, yi as regionLessSecretName, yl as PARTITION_TABLE, yn as secretSafeKeyDisplay, yr as TemplateNoEchoReresolver, ys as recordNestedStackParameterExpressions, yt as displacedOpClause, z as perType, za as refuseMalformedResourcesForExport, zc as redactDockerArgvValues, zi as STATE_REGION_DIVERGED, zn as storedSecretNameNeedles, zo as noEchoCoordinatesOf, zs as LockManager, zt as replayRollback } from "./deploy-engine-BU3iY59A.js";
-import { t as getCdkdVersion } from "./version-BtTEjOpj.js";
+import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as retryClassificationText, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, cr as isThrottlingError, dn as LocalInvokeBuildError$1, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as markNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, rr as isRetryableTransientError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as isMarkedNonRetryable, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DAs3w7QW.js";
+import { a as setAssumedRoleCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
+import { $a as withheldAccountClause, $c as getDockerImageBySourceHash, $i as isReadableResourceEntry, $n as findDestructiveChanges, $o as literalSplitDelimitersOf, $r as applyRoleArnIfSet, $s as splitImportedOps, $t as recordUnderIdIsNotOwn, A as diffSecurity, Aa as refuseMalformedResourceEntries, Ac as buildDenyExternalAccessPolicy, Ai as isNamelessDynamicReferenceError, Al as hasOwnKey, An as DEFAULT_RESOURCE_TIMEOUT_MS, Ao as withRetry, Ar as CloudControlProvider, As as provenPublicValue, At as withNestedStackContext, B as readProtection, Ba as refuseMalformedResourcesForDeploy, Bc as isDockerClientEnvKey, Bi as declaresNoEcho, Bl as injectedAwsRegionValue, Bn as storedSecretNameNeedles, Bo as maskWholeValue, Bs as TEMPLATE_SOURCED_RULES, Ca as refuseMalformedOrphanRecordsForDestroy, Cc as ensureAssetStorage, Ci as coerceParameterTypedValue, Cl as PARTITION_TABLE, Cn as exportNameSecretExposure, Cr as readsNoEchoDeleteValues, Cs as recordNestedStackParameterExpressions, Ct as nestedChildStackName$1, D as findServiceTokenRefusals, Da as refuseMalformedOutputs, Dc as readBootstrapMarkerBody, Di as isImpossibleEmptyStoredAttribute, Dl as StageLoadError, Dn as collectPublishedOutputNames, Do as prefetchCreateOnlyPropertyPaths, Dr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ds as recordPhysicalNameCopy, Dt as withNestedRevertRun, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphansForOrphan, Ec as parseBootstrapMarker, Ei as getAccountInfo, El as AssemblyReader, En as collectDeclaredOutputNames, Er as withPrintingSecrets, Et as revertedNestedRowIds, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForOrphan, Fc as describeDockerFailure, Fi as refStateLookupFromResource, Fl as describeFileReadFailure, Fn as orphanRecordsPrintingBag, Fo as TemplateParser, Fr as deleteIndeterminateGuards, Fs as recordProvenPublicExpression, Ft as loadJournaledOrphans, Ga as repairMalformedOrphansForReadOnly, Gc as redactedDockerCause, Gi as UNREADABLE_RESOURCES_MAP_ROW, Gn as ccRoutedFinalSnapshotError, Gs as S3StateBackend, Ha as refuseMalformedResourcesForExport, Hc as partitionSensitiveEnv, Hi as STATE_REGION_DIVERGED, Hl as resolveBucketRegion, Hn as ATOMIC_FINAL_SNAPSHOT_TYPES, Ho as noEchoCoordinatesOf, Hs as isSingleDynamicReferenceToken, I as recordedProtectionNote, Ia as refuseMalformedResourcePropertiesForDestroy, Ic as dockerSpawnEnvWithSensitive, Il as displayAssemblyPath, In as secretNamePrintingBag, Io as canonicalCoordinates, Ir as deleteLeftInPlace, Is as wholeStringLeavesOf, It as makeForeignHolderScan, Ja as repairMalformedResourcePropertiesForReadOnly, Jc as warnFinchArgvExposure, Ji as displayLogicalId, Jn as isFinalSnapshotError, Jo as valueAtCoordinate, Jr as INTRINSIC_KEYS, Js as CrossPrefixScanCache, Jt as isJournaledOrphan, Ka as repairMalformedOutputsForReadOnly, Kc as runDockerForeground, Ki as accountArgs, Kn as createPreDeleteFinalSnapshot, Ko as readbackPathFor, Ks as rebuildClientForBucketRegion, Kt as recordAfterRollbackUpdate, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourcePropertiesForDrift, Lc as finchSecretArgvRefusal, Li as withSharedDrainBudget, Ll as renderAssemblyPathEscape, Ln as secretNamePrintingBags, Lo as isMarkedCoordinate, Lr as deleteSkipReason, Ls as STATE_SOURCED_BASELINE_RULES, Lt as sameJournaledOrphans, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceEntriesForDestroy, Mc as resolveDockerContextDirectory, Mi as AWS_NO_VALUE, Ml as nullPrototypeRecord, Mn as completedReplayEntries, Ms as recordMaskOnlyValuesIn, Mt as dropFailedHint, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntriesForImport, Nc as describeDockerCapturedOutput, Ni as cfnRefValueFromPhysicalId, Nl as ownValue, Nn as journaledOrphanPrintingBag, Nr as RollbackInlinePolicyWriters, Ns as recordNoEchoAttributeValues, Nt as isHandledOrphan, O as serviceTokenBlockingReason, Oa as refuseMalformedOutputsForDestroy, Oc as validateAssetBucketName, Oi as carriesDynamicReference, Ol as processStackMessages, On as isExportAliasCollision, Oo as templateResourceTypes, Or as applyCustomResourceResponseExpiration, Os as splitGetAttStringForm, Ot as collectNestedChildUnaddressed, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntriesForImportSave, Pc as describeDockerExecFailure, Pi as isStalePlaceholderArnAttribute, Pl as absoluteAssemblyPathEscape, Pn as maskEventTextWithBoundBags, Po as DagBuilder, Pr as UNSPECIFIED_SKIP_REASON, Ps as recordNoEchoParameterFreshValue, Pt as journaledOrphanLines, Qa as unreadableResourceEntries, Qc as AssetManifestLoader, Qi as isReadableOrphanRecord, Qn as constructPathOf, Qo as hasMaskableValues, Qr as refuseUnreadableCdkCrossAccountRefs, Qs as isNotImplemented, Qt as recheckFailedPlan, R as isProtectionValueActive, Ra as refuseMalformedResourcePropertiesForExport, Rc as formatDockerLoginError, Ri as parameterInputsFor, Rl as resolveAssemblyPath, Rn as secretNamedRecordNeedles, Ro as maskAtCoordinates, Rs as STATE_SOURCED_CROSS_GENERATION_RULES, Rt as replayFailedOperations, Sa as refuseMalformedOrphanRecords, Sc as assertAssetBucketRegion, Si as regionLessSecretName, Sl as expectedOwnerParam, Sn as exportNameNoEchoParameters, Sr as TemplateNoEchoReresolver, Ss as inheritNestedStackParameterAssociations, T as recordRetainedForReadoption, Ta as refuseMalformedOrphansForDestroy, Tc as isCrossRegionRedirect, Ti as parameterTypeMayLoseSecretIdentity, Tl as derivePartitionAndUrlSuffix, Tn as noEchoParameterValueSeed, Ts as physicalNameCopiesOf, Ua as refuseMalformedState, Uc as redactDockerArgvValues, Ui as STATE_RESOURCES_MALFORMED, Un as PRE_DELETE_SNAPSHOT_TYPES, Uo as noEchoLeavesOf, Us as LockManager, Ut as withStackRecords, Va as refuseMalformedResourcesForDestroy, Vc as isMalformedEnvKey, Vi as JSON_LISTING_HOLE_VALUE, Vn as extractDeploymentEventError, Vo as maskedLeafCoordinatesOf, Vs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Vt as destroyStackRecordsView, Wa as repairMalformedOrphanRecordsForReadOnly, Wc as redactedCause, Wi as UNREADABLE_ORPHANS_CONTAINER_ROW, Wn as buildFinalSnapshotIdentifier, Wo as noEchoOutputsComparison, Ws as isLockInfoExpired, Wt as removeProtectionTypeList, Xa as unpreviewableOrphanRecords, Xc as stripControlChars, Xi as hasReadableOutputs, Xn as unsupportedFinalSnapshotError, Xo as carryLogOnlyValues, Xr as poisonRenderedSpellingsCollidingIn, Xs as crossPrefixDeniedWarning, Xt as planFailedOps, Ya as repairMalformedResourcesForReadOnly, Yc as escapeRegExp, Yi as hasReadableOrphans, Yn as refusesFinalSnapshot, Yo as liveMatchesUnresolvedTokenFrame, Yr as IntrinsicFunctionResolver, Ys as applyCrossPrefixScan, Yt as isReplacementOrphan, Za as unreadableOrphanRecords, Zc as stripForDisplay, Zi as hasReadableResources, Zn as maskingRetryLogger, Zo as createUnionSecretMasker, Zr as producerLookupOver, Zs as isAccessDenied, Zt as planRollback, _ as keptWholeReasonText, _a as malformedScrubResourceEntriesRefusalMessage, _c as createAssetRedirectResolver, _l as MIGRATE_TMP_PREFIX, _n as exportAliasCollisionScrubWarning, _r as CC_BROKEN_REASON, _s as DYNAMIC_REFERENCE_TOKEN_SCAN, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedLocalResourcesWarning, ac as hasUnverifiableParameterRefusal, ai as AWS_CREDENTIAL_ENV_KEYS, al as resolveApp, ao as hasNoCloudControlHandlers, as as unionOfSecretBags, at as createReadOnlyAttributeHealerFactory, ba as refuseDivergentRecordRegionForDestroy, bc as AssetModeResolver, bi as classifyReplaySecretRegion, bl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as secretSafeKeyDisplay, br as isCustomResource, bs as pathCrossesDottedKey, bt as displacedPhysicalIdShown, c as isAbsoluteAssetPath, ca as malformedOrphanRowsKeptWarning, cc as isReadableBag, ci as envCredentialsAreAssumedRole, cl as resolveSkipPrefix, co as MULTI_REGION_RECREATE_BLOCKED_TYPES, cs as maskSecretsInError, ct as gray, d as templateIdentity, da as malformedOutputsRefusalMessage, dc as shouldRetainResource, dl as resolveUseCdkBootstrapAssets, dn as updatePartialMessage, do as renderStatefulReason, dt as yellow, ea as malformedDriftResourcePropertiesWarning, ec as acceptedCreateOnlyDropsOf, ei as assertFlagRoleArn, el as Synthesizer, en as replacementNeverSwapped, eo as findActionableSilentDrops, er as formatDestructiveChange, es as logOnlyValueCount, f as conditionFingerprint, fa as malformedOutputsWarning, fc as AssetPublisher, fi as recordedOutputReferenceRegions, fl as stateBucketExistenceConfirmed, fn as updatePartialReason, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedResourcesWarning, gc as buildAssetRedirectMap, gl as CFN_TEMPLATE_URL_LIMIT, gn as displayTextOrWithheld, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedResourcePropertiesWarning, hc as WorkGraph, hl as CFN_TEMPLATE_BODY_LIMIT, hn as WITHHELD_NAME_DISPLAY, hs as withPhysicalNameCopies, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedLocalResourceEntriesWarning, ic as hasReasonlessBaselineRefusal, ii as sendableAssumeRoleCommand, il as loadCdkJson, in as findNestedStackTypeChanges, io as NO_CC_HANDLERS_REASON, ir as withCreateTokenLedger, is as shareLogOnlyValues, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedResourceEntriesForDeploy, jc as buildDockerImage, ji as keepsSecretReferenceToken, jl as hasPlainPrototype, jn as DEFAULT_RESOURCE_WARN_AFTER_MS, jr as slowCcOperationTimeoutMs, js as recordMaskOnlyValue, jt as deleteJournaledOrphans, k as withResourceDeadline, ka as refuseMalformedResourceAttributesForOrphan, kc as validateContainerRepoName, ki as carriesFetchableDynamicReference, kl as defineOwnKey, kn as bindingSkippedOutputs, ko as describeTypeWithThrottleRetry, kr as customResourceResponseExpirationWarning, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, la as malformedOrphansRefusalMessage, lc as orphansAfterRollback, ll as resolveStateBucketWithDefault, lo as isStatefulRecreateTargetForReplace, ls as maskSecretsInText, lt as green, m as parentSuppliedValues, ma as malformedResourceEntriesWarning, mc as stringifyValue, ml as ssmResolvedValueType, mn as DeploymentEventsStore, ms as scrubResourceRecord, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedExportSourceWarning, nc as exportNamesCarriedFrom, ni as explicitRoleArnOrThrow, nl as getDefaultStateBucketName, nn as seedsDeleteFirstGuard, no as unwrittenCreateOnlyReplacement, nr as ledgerForStack, ns as recordLogOnlyParameterValue, o as childTemplateLoader, oa as malformedOrphanRecordsRefusalMessage, oc as importableOutputKeys, oi as applyCallerIdentityCredentials, ol as resolveAutoAssetStorage, on as inheritProducerRegions, oo as findReplacedReadersOfRecreateTargets, os as createSecretMasker, ot as bold, p as conditionInputsFrom, pa as malformedRenderedContainersWarning, pc as isSensitiveAttributeName, pi as recordedReferenceRegions, pl as warnDeprecatedNoPrefixCliFlag, pn as DeploymentEventsReader, ps as redactSecretsForState, pt as namesAnyDeclaredParameter, qa as repairMalformedResourceEntriesForReadOnly, qc as runDockerStreaming, qi as deployRefusesOrphanRowsReason, qn as effectiveDeletionPolicy, qo as readsNoEchoSource, qr as DiffCalculator, qs as CrossPrefixReadError, qt as demoteSupersededOrphans, r as computeImplicitDeleteEdges, ra as malformedLocalOutputsWarning, rc as hasReadableExportSet, ri as isIamRoleArn, rl as getLegacyStateBucketName, rn as orphanDeleteNeedsIdentity, rs as recordLogOnlyValue, s as findNestedTemplateTreeDefect, sa as malformedOrphanRecordsWarning, sc as importableOutputs, si as callerEnvCredentials, sl as resolveCaptureObservedState, so as shownType, ss as errorCauseChain, st as cyan, t as DeployEngine, ta as malformedExportNamesWarning, tc as describeRegionValueKind, ti as assertSendableRoleArn, tl as synthesisStatusMessage, tn as resolveReplacementOldType, ts as printingCorpusOf, u as renderNestedTemplateTreeDefect, ua as malformedOrphansWarning, uc as orphansCarriedFrom, ui as keepHeldTokenProvenance, ul as resolveStateBucketWithDefaultAndSource, uo as isStatefulRecreateTargetSync, us as markSameGenerationBag, ut as red, v as mergeNoChangeOutputs, va as malformedStateRefusalMessage, vc as loadPublishableAssetManifest, vl as findLargeInlineResources, vn as secretBearing, vr as ProviderRegistry, vs as dynamicReferenceTokens, vt as NESTED_PENDING_PARENT_REASON, w as keptForReadoption, wa as refuseMalformedOrphans, wc as getBootstrapMarkerKey, wi as isUnboundTemplateParameter, wl as canonicalizeRegion, wn as isWholeDynamicReferenceValue, wr as isCustomResourceType$1, wt as recordDisplacedSkips, xc as BOOTSTRAP_MARKER_PREFIX, xi as producerRegionsFromState, xl as decodeListingKey, xn as carriedExportAliasExposure, xr as wouldReturnToSdkProvider, xs as identityKeyFor, xt as dropSettledNestedJournals, y as makeCanonicalizePropertiesFn, ya as previewableOrphanRecords, yc as rewriteTemplateAssetReferences, yi as classifyRecordedSecretRegion, yl as uploadCfnTemplate, yn as secretBearingStateKeyWarning, yr as ccBrokenReason, ys as isUncertifiedBaselineMaskPosition, yt as displacedOpClause, z as perType, za as refuseMalformedResourcePropertiesForOrphan, zc as getDockerCmd, zl as injectAwsRegion, zn as stateSecretNameNeedles, zo as maskReadbackAtCoordinates, zr as isWaitAbandonedError, zs as STATE_SOURCED_READBACK_RULES, zt as replayRollback } from "./deploy-engine-BK4gG_5A.js";
+import { t as getCdkdVersion } from "./version-DTSDiQcV.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -764,7 +764,7 @@ async function bootstrapDestroyCommand(options) {
 		} catch (error) {
 			markerListingSucceeded = false;
 			if (options.includeStateBucket) throw new CdkdError(`Cannot verify which bootstrap markers the state bucket '${bucketName}' still holds (listing '${BOOTSTRAP_MARKER_PREFIX}' failed), and --include-state-bucket deletes every one of them. Grant s3:ListBucket on this bucket and re-run.`, "STATE_BUCKET_MARKER_SCAN_FAILED", error);
-			logger.warn(`Could not list bootstrap markers under '${BOOTSTRAP_MARKER_PREFIX}' (${error instanceof Error ? error.message : String(error)}). Continuing — this only means a marker for this region under another spelling of its name would not be reported.`);
+			logger.warn(`Could not list bootstrap markers under '${BOOTSTRAP_MARKER_PREFIX}' (${describeAwsFailure(error).detail}). Continuing — this only means a marker for this region under another spelling of its name would not be reported.`);
 		}
 		let marker;
 		if (markerBody === null) {
@@ -1876,7 +1876,7 @@ async function findDownstreamConsumers(input) {
 	try {
 		refs = await input.stateBackend.listStacks();
 	} catch (err) {
-		logger.debug(`findDownstreamConsumers: listStacks failed; falling back to empty enumeration. ${err instanceof Error ? err.message : String(err)}`);
+		logger.debug(`findDownstreamConsumers: listStacks failed; falling back to empty enumeration. ${describeAwsFailure(err).detail}`);
 		return [];
 	}
 	return (await Promise.all(refs.map(async (ref) => {
@@ -1917,7 +1917,7 @@ async function findDownstreamConsumers(input) {
 			}
 			return out.length > 0 ? out : null;
 		} catch (err) {
-			logger.debug(`findDownstreamConsumers: skip ${ref.stackName} (${region}); ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`findDownstreamConsumers: skip ${ref.stackName} (${region}); ${describeAwsFailure(err).detail}`);
 			return null;
 		}
 	}))).filter((r) => r !== null).flat();
@@ -2561,11 +2561,11 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DmohfhIq.js");
+	providerClasses ??= import("./provider-classes-CDzT2xg0.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
-	const { IAMRoleProvider, IAMPolicyProvider, IAMManagedPolicyProvider, IAMInstanceProfileProvider, IAMAccessKeyProvider, IAMUserGroupProvider, S3BucketProvider, S3BucketPolicyProvider, SQSQueueProvider, SQSQueuePolicyProvider, SNSTopicProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, LambdaFunctionProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaEventSourceMappingProvider, LambdaLayerVersionProvider, LambdaEventInvokeConfigProvider, LambdaMicrovmImageProvider, DynamoDBTableProvider, DynamoDBGlobalTableProvider, LogsLogGroupProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, SecretsManagerSecretProvider, SSMParameterProvider, EventBridgeRuleProvider, EventBridgeBusProvider, EC2Provider, ApiGatewayProvider, ApiGatewayV2Provider, CloudFrontOAIProvider, CloudFrontOACProvider, CloudFrontDistributionProvider, AgentCoreRuntimeProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, StepFunctionsProvider, ECSProvider, ELBv2Provider, RDSProvider, RDSDBProxyProvider, RDSDBProxyEndpointProvider, RDSDBProxyTargetGroupProvider, DocDBProvider, DocDBSubnetGroupProvider, NeptuneProvider, Route53Provider, WAFv2WebACLProvider, CognitoUserPoolProvider, ElastiCacheProvider, ServiceDiscoveryProvider, AppSyncProvider, GlueProvider, GlueWorkflowProvider, GlueSecurityConfigurationProvider, GlueJobProvider, GlueCrawlerProvider, GlueConnectionProvider, GlueTriggerProvider, KMSProvider, BudgetsBudgetProvider, KinesisStreamProvider, KinesisStreamConsumerProvider, SchedulerScheduleProvider, PipesPipeProvider, EFSProvider, FSxFileSystemProvider, EMRClusterProvider, EMRInstanceGroupConfigProvider, EMRInstanceFleetConfigProvider, FirehoseProvider, CloudTrailProvider, CodeBuildProvider, CodeCommitRepositoryProvider, DLMLifecyclePolicyProvider, S3VectorsProvider, S3DirectoryBucketProvider, S3TablesProvider, ECRProvider, ASGProvider, NestedStackProvider, WaitConditionHandleProvider, ACMCertificateProvider } = classes;
+	const { IAMRoleProvider, IAMPolicyProvider, IAMManagedPolicyProvider, IAMInstanceProfileProvider, IAMAccessKeyProvider, IAMUserGroupProvider, S3BucketProvider, S3BucketPolicyProvider, SQSQueueProvider, SQSQueuePolicyProvider, SNSTopicProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, LambdaFunctionProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaEventSourceMappingProvider, LambdaLayerVersionProvider, LambdaEventInvokeConfigProvider, LambdaMicrovmImageProvider, LambdaWebFunctionRevisionProvider, LambdaWebFunctionEndpointProvider, LambdaNetworkConnectorProvider, DynamoDBTableProvider, DynamoDBGlobalTableProvider, LogsLogGroupProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, SecretsManagerSecretProvider, SSMParameterProvider, EventBridgeRuleProvider, EventBridgeBusProvider, EC2Provider, ApiGatewayProvider, ApiGatewayV2Provider, CloudFrontOAIProvider, CloudFrontOACProvider, CloudFrontDistributionProvider, AgentCoreRuntimeProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, StepFunctionsProvider, ECSProvider, ELBv2Provider, RDSProvider, RDSDBProxyProvider, RDSDBProxyEndpointProvider, RDSDBProxyTargetGroupProvider, DocDBProvider, DocDBSubnetGroupProvider, NeptuneProvider, Route53Provider, WAFv2WebACLProvider, CognitoUserPoolProvider, ElastiCacheProvider, ServiceDiscoveryProvider, AppSyncProvider, GlueProvider, GlueWorkflowProvider, GlueSecurityConfigurationProvider, GlueJobProvider, GlueCrawlerProvider, GlueConnectionProvider, GlueTriggerProvider, KMSProvider, BudgetsBudgetProvider, KinesisStreamProvider, KinesisStreamConsumerProvider, SchedulerScheduleProvider, PipesPipeProvider, EFSProvider, FSxFileSystemProvider, EMRClusterProvider, EMRInstanceGroupConfigProvider, EMRInstanceFleetConfigProvider, FirehoseProvider, CloudTrailProvider, CodeBuildProvider, CodeCommitRepositoryProvider, DLMLifecyclePolicyProvider, S3VectorsProvider, S3DirectoryBucketProvider, S3TablesProvider, ECRProvider, ASGProvider, NestedStackProvider, WaitConditionHandleProvider, ACMCertificateProvider } = classes;
 	registry.register("AWS::IAM::Role", new IAMRoleProvider());
 	registry.register("AWS::IAM::Policy", new IAMPolicyProvider());
 	registry.register("AWS::IAM::ManagedPolicy", new IAMManagedPolicyProvider());
@@ -2590,6 +2590,9 @@ function registerAllProviders(registry, classes) {
 	registry.register("AWS::Lambda::LayerVersion", new LambdaLayerVersionProvider());
 	registry.register("AWS::Lambda::EventInvokeConfig", new LambdaEventInvokeConfigProvider());
 	registry.register("AWS::Lambda::MicrovmImage", new LambdaMicrovmImageProvider());
+	registry.register("AWS::Lambda::WebFunctionRevision", new LambdaWebFunctionRevisionProvider());
+	registry.register("AWS::Lambda::WebFunctionEndpoint", new LambdaWebFunctionEndpointProvider());
+	registry.register("AWS::Lambda::NetworkConnector", new LambdaNetworkConnectorProvider());
 	registry.register("AWS::DynamoDB::Table", new DynamoDBTableProvider());
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
@@ -3824,7 +3827,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 		try {
 			value = await resolveValue(structuredClone(output.Value));
 		} catch (error) {
-			logger.debug(`Diff could not resolve output ${stripForDisplay(outputKey)}: ${stripForDisplay(String(error))}`);
+			logger.debug(`Diff could not resolve output ${stripForDisplay(outputKey)}: ${stripForDisplay(safeStringify(error))}`);
 			resolutionFailed = true;
 			recordFailure(outputKey, output);
 			failedOutputKeys.add(outputKey);
@@ -3859,7 +3862,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			if (typeof exportName !== "string") try {
 				exportName = await (outputsPass?.resolveInto(nameBag) ?? resolveFn)(structuredClone(exportName));
 			} catch (error) {
-				logger.debug(`Diff could not resolve Export.Name of ${stripForDisplay(outputKey)}: ${stripForDisplay(String(error))}`);
+				logger.debug(`Diff could not resolve Export.Name of ${stripForDisplay(outputKey)}: ${stripForDisplay(safeStringify(error))}`);
 				resolutionFailed = true;
 				failuresMirrorDeploy = false;
 				continue;
@@ -4812,6 +4815,12 @@ function tokenValueForComparison(token, declaredType) {
 	if (!coerced.every((element) => typeof element === "string")) return token;
 	return coerced;
 }
+function standInTokensOf(byParameter) {
+	if (byParameter === void 0) return void 0;
+	const all = /* @__PURE__ */ new Set();
+	for (const tokens of byParameter.values()) for (const token of tokens) all.add(token);
+	return all.size > 0 ? all : void 0;
+}
 function diffPrintingSecrets(bags) {
 	const all = /* @__PURE__ */ new Map();
 	for (const bag of bags) {
@@ -4940,9 +4949,12 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 	return changed ? shown : change;
 }
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
-	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedDerivedNames, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
+	const { parameters, canonicalizeProperties, cfnFallback, producerLookup, consumerAccount, inheritSecretBearingTemplate, inheritedSecrets, inheritedSecretTokens, inheritedDerivedNames, attributeHealer: unboundAttributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
+	let healResources = currentState.resources ?? {};
+	const attributeHealer = unboundAttributeHealer && healerUnderRecordPrintingBag(unboundAttributeHealer, () => healResources);
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
+	const secretStandInTokens = standInTokensOf(inheritedSecretTokens);
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, {
 		cfnFallback: cfnFallback ?? true,
 		...producerLookup && { producerLookup },
@@ -5091,6 +5103,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		secretNameNeedles: stateSecretNameNeedles(currentState.resources, diffSecrets),
 		secretNameSink: derivedNames,
 		...inheritedForResolver && { inheritedSecrets: inheritedForResolver },
+		...secretStandInTokens && { secretStandInTokens },
 		template: effectiveTemplate,
 		resources: currentState.resources,
 		stateBackend,
@@ -5133,6 +5146,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 					...plan.adopted
 				}
 			};
+			healResources = stateForDiff.resources;
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
 			reportedByTheAdoptedPropertiesArm = tornAdopted;
 			if (tornAdopted.length > 0) {
@@ -5474,9 +5488,10 @@ function noEchoFedChildParameters(parentStackRow, parentNoEchoParameters, parent
 	})) fed.add(name);
 	return fed;
 }
-async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust, derivedNameSink, producerLookup, consumerAccount) {
+async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust, derivedNameSink, producerLookup, consumerAccount, secretTokens) {
 	const rawParams = parentStackRow.Properties?.["Parameters"];
 	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return {};
+	const inheritedStandIns = standInTokensOf(secretTokens?.inherited);
 	const resolver = new IntrinsicFunctionResolver(region, {
 		cfnFallback: cfnFallback ?? true,
 		...producerLookup && { producerLookup },
@@ -5485,6 +5500,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 	const resolved = {};
 	for (const [name, value] of Object.entries(rawParams)) {
 		if (trust === void 0 || !rowValueTrusted(value, parentState, parentConditions, trust)) unresolvedKeys?.add(name);
+		const skippedSecretReferences = /* @__PURE__ */ new Set();
 		try {
 			const resolvedValue = await resolver.resolve(value, {
 				template: parentTemplate,
@@ -5498,10 +5514,20 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 				...parentConditions && { conditions: parentConditions },
 				...printingSecrets && hasMaskableValues(printingSecrets) && { inheritedSecrets: printingSecrets },
 				skipDynamicReferences: true,
+				skippedSecretReferences,
+				...inheritedStandIns && { secretStandInTokens: inheritedStandIns },
 				...attributeHealer && { attributeHealer }
 			});
 			if (resolvedValue === AWS_NO_VALUE) continue;
-			resolved[name] = isScalarList(resolvedValue) ? resolvedValue.map((element) => String(element)).join(",") : resolvedValue;
+			const childValue = isScalarList(resolvedValue) ? resolvedValue.map((element) => String(element)).join(",") : resolvedValue;
+			resolved[name] = childValue;
+			if (secretTokens !== void 0 && typeof childValue === "string") {
+				const refs = /* @__PURE__ */ new Set();
+				collectRefTargets(value, refs);
+				const tokens = /* @__PURE__ */ new Set();
+				for (const token of dynamicReferenceTokens(childValue)) if (skippedSecretReferences.has(token) || [...refs].some((ref) => secretTokens.inherited?.get(ref)?.has(token) === true)) tokens.add(token);
+				if (tokens.size > 0) secretTokens.child.set(name, tokens);
+			}
 		} catch {
 			unresolvedKeys?.add(name);
 		}
@@ -5516,10 +5542,27 @@ function recordedTemplateResources(template, state) {
 	for (const [logicalId, resource] of Object.entries(resources)) if (Object.prototype.hasOwnProperty.call(stateResources, logicalId)) recorded[logicalId] = resource;
 	return recorded;
 }
+function healerUnderRecordPrintingBag(healer, resources) {
+	let judged;
+	const bagFor = (logicalId, resource) => {
+		const map = resources();
+		if (!Object.hasOwn(map, logicalId) || map[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
+			...map,
+			[logicalId]: resource
+		});
+		if (judged?.map !== map) judged = {
+			map,
+			bagOf: secretNamePrintingBags(map, void 0)
+		};
+		return judged.bagOf(logicalId);
+	};
+	return Object.assign((logicalId, resource) => withPrintingSecrets(bagFor(logicalId, resource), () => healer(logicalId, resource)), healer);
+}
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, producerLookup, consumerAccount, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery, inheritedReferenceProvenance } = args;
-	const attributeHealer = attributeHealerFor?.(stackName, region);
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, producerLookup, consumerAccount, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery, inheritedReferenceProvenance, inheritedSecretTokens } = args;
+	const unboundHealer = attributeHealerFor?.(stackName, region);
 	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
+	const attributeHealer = unboundHealer;
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
 	let stackDiff;
@@ -5537,6 +5580,7 @@ async function buildDiffTree(args) {
 			...inheritedNoEchoParameters && { inheritedNoEchoParameters },
 			...inheritedNoEchoParametersAnyVerdict && { inheritedNoEchoParametersAnyVerdict },
 			...inheritedReferenceProvenance && { inheritedReferenceProvenance },
+			...inheritedSecretTokens && { inheritedSecretTokens },
 			...attributeHealer && { attributeHealer },
 			...refusalRecovery && { refusalRecovery },
 			inheritSecretBearingTemplate: false,
@@ -5597,7 +5641,11 @@ async function buildDiffTree(args) {
 			...inheritedNoEchoParametersAnyVerdict ?? []
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount);
+		const childSecretTokens = /* @__PURE__ */ new Map();
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer && healerUnderRecordPrintingBag(attributeHealer, () => stateAfterAdoption.resources ?? {}), childUnresolvedParameters, trust, rowDerivedNames, producerLookup, consumerAccount, {
+			inherited: inheritedSecretTokens,
+			child: childSecretTokens
+		});
 		const childDerivedNames = diffPrintingSecrets([
 			inheritedDerivedNames,
 			rowDerivedNames,
@@ -5636,7 +5684,8 @@ async function buildDiffTree(args) {
 			...childNoEchoParameters.size > 0 && { inheritedNoEchoParameters: childNoEchoParameters },
 			...childNoEchoParametersAnyVerdict.size > 0 && { inheritedNoEchoParametersAnyVerdict: childNoEchoParametersAnyVerdict },
 			...refusalRecovery && { refusalRecovery },
-			...childReferenceProvenance && { inheritedReferenceProvenance: childReferenceProvenance }
+			...childReferenceProvenance && { inheritedReferenceProvenance: childReferenceProvenance },
+			...childSecretTokens.size > 0 && { inheritedSecretTokens: childSecretTokens }
 		});
 		node.children.push(await (hasMaskableValues(childDerivedNames) ? withPrintingSecrets(childDerivedNames, buildChild) : buildChild()));
 	}
@@ -9979,6 +10028,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 		const secretResolvers = new DriftSecretResolvers(region);
 		const producerRegions = await driftProducerRegionEvidence(state, stackName, region, stateBackend);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
+		const printingBagOf = secretNamePrintingBags(state.resources ?? {}, void 0);
+		const stackSecretNames = secretNamedRecordNeedles(state.resources ?? {}, void 0);
 		const consecutiveReadFailures = {
 			provider: 0,
 			ccApi: 0
@@ -10065,164 +10116,168 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 			let readReturned = false;
-			try {
-				let aws;
-				if (provider.readCurrentState) {
-					aws = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(state, logicalId));
-					readReturned = true;
-					noteReadReturned();
-				} else {
-					if (CC_API_FALLBACK_DENY_LIST[resource.resourceType]) {
+			const printing = printingBagOf(logicalId);
+			await withPrintingSecrets(printing, async () => {
+				try {
+					let aws;
+					if (provider.readCurrentState) {
+						aws = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(state, logicalId));
+						readReturned = true;
+						noteReadReturned();
+					} else {
+						if (CC_API_FALLBACK_DENY_LIST[resource.resourceType]) {
+							outcomes.push({
+								kind: "unsupported",
+								logicalId,
+								resourceType: resource.resourceType
+							});
+							return;
+						}
+						const ccApiAws = await ccApiFallback.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {});
+						readReturned = true;
+						noteReadReturned();
+						if (ccApiAws === void 0) {
+							outcomes.push({
+								kind: "unsupported",
+								logicalId,
+								resourceType: resource.resourceType
+							});
+							return;
+						}
+						aws = ccApiAws === RESOURCE_NOT_FOUND ? ccApiAws : stripCcApiAwsManagedFields(resource.resourceType, ccApiAws);
+					}
+					if (aws === RESOURCE_NOT_FOUND) {
 						outcomes.push({
-							kind: "unsupported",
+							kind: "deleted",
 							logicalId,
 							resourceType: resource.resourceType
 						});
-						continue;
+						return;
 					}
-					const ccApiAws = await ccApiFallback.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {});
-					readReturned = true;
-					noteReadReturned();
-					if (ccApiAws === void 0) {
+					if (aws === void 0) {
 						outcomes.push({
 							kind: "unsupported",
 							logicalId,
 							resourceType: resource.resourceType
 						});
-						continue;
+						return;
 					}
-					aws = ccApiAws === RESOURCE_NOT_FOUND ? ccApiAws : stripCcApiAwsManagedFields(resource.resourceType, ccApiAws);
-				}
-				if (aws === RESOURCE_NOT_FOUND) {
-					outcomes.push({
-						kind: "deleted",
-						logicalId,
-						resourceType: resource.resourceType
-					});
-					continue;
-				}
-				if (aws === void 0) {
-					outcomes.push({
-						kind: "unsupported",
-						logicalId,
-						resourceType: resource.resourceType
-					});
-					continue;
-				}
-				const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
-				const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
-				const useObserved = resource.observedProperties !== void 0;
-				const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
-				const secretPaths = /* @__PURE__ */ new Set();
-				const seededSecretPaths = /* @__PURE__ */ new Set();
-				collectDynamicReferencePaths(baseline, seededSecretPaths);
-				if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
-				const maskSecretPaths = /* @__PURE__ */ new Set();
-				collectSecretMaskPaths(baseline, maskSecretPaths);
-				if (useObserved) collectSecretMaskPaths(resource.properties ?? {}, maskSecretPaths);
-				const unresolvedTokens = /* @__PURE__ */ new Set();
-				const noteUnresolved = (tokens) => {
-					for (const token of tokens) unresolvedTokens.add(token);
-				};
-				let comparisonBaseline = baseline;
-				let secretResolutionFailed = false;
-				try {
-					comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
-						secretPaths,
-						onUnresolved: noteUnresolved,
-						logicalId,
-						consumerRegion: region,
-						record: resource,
-						producerRegions
-					});
-					if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
-						secretPaths,
-						onUnresolved: noteUnresolved,
-						logicalId,
-						consumerRegion: region,
-						record: resource,
-						producerRegions
-					});
-				} catch (err) {
-					secretResolutionFailed = true;
-					comparisonBaseline = baseline;
-					const refused = isDriftSecretRefusal(err);
-					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
-					for (const plaintext of secrets.keys()) recordLogOnlyValue(secrets, plaintext);
-					secrets.clear();
-				}
-				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched where its position can be matched against AWS's report (a list element pairs by an identity field, or by the list's own unchanged literal values). A token EMBEDDED in a longer string is left untouched the same way when the rest of that string is exactly what AWS holds. Where it cannot be matched, the revert writes the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager', 'ssm' and 'ssm-secure' references; anything else is left as written.`);
-				const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
-				const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
-				const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
-				const canonicalized = provider.canonicalizeDriftProperties ? {
-					baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
-					aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
-				} : protocolNormalized;
-				const paired = provider.canonicalizeDriftPair ? await provider.canonicalizeDriftPair(resource.resourceType, canonicalized.baseline, canonicalized.aws, resource.properties ?? {}) : canonicalized;
-				const nameBaseline = canonicalizeDerivedPatternBName(resource.resourceType, paired.baseline, paired.aws);
-				const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(nameBaseline, paired.aws, {
-					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
-					unionWalkObjects: useObserved,
-					unorderedPaths
-				}), resource, baseline);
-				const partitioned = partitionUncertifiedBaselineChanges(noEchoPartitioned.kept, resource.properties ?? {}, baseline);
-				const reported = redactDriftChanges(partitioned.kept, secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
-				const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : noEchoPartitioned.noEchoParameterPaths.length > 0 ? "noEchoParameter" : void 0;
-				if (reported.changes.length === 0) {
-					if (notComparedCause !== void 0) outcomes.push({
-						kind: "notCompared",
+					const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
+					const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
+					const useObserved = resource.observedProperties !== void 0;
+					const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+					const secretPaths = /* @__PURE__ */ new Set();
+					const seededSecretPaths = /* @__PURE__ */ new Set();
+					collectDynamicReferencePaths(baseline, seededSecretPaths);
+					if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+					const maskSecretPaths = /* @__PURE__ */ new Set();
+					collectSecretMaskPaths(baseline, maskSecretPaths);
+					if (useObserved) collectSecretMaskPaths(resource.properties ?? {}, maskSecretPaths);
+					const unresolvedTokens = /* @__PURE__ */ new Set();
+					const noteUnresolved = (tokens) => {
+						for (const token of tokens) unresolvedTokens.add(token);
+					};
+					let comparisonBaseline = baseline;
+					let secretResolutionFailed = false;
+					try {
+						comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
+							secretPaths,
+							onUnresolved: noteUnresolved,
+							logicalId,
+							consumerRegion: region,
+							record: resource,
+							producerRegions
+						});
+						if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
+							secretPaths,
+							onUnresolved: noteUnresolved,
+							logicalId,
+							consumerRegion: region,
+							record: resource,
+							producerRegions
+						});
+					} catch (err) {
+						secretResolutionFailed = true;
+						comparisonBaseline = baseline;
+						const refused = isDriftSecretRefusal(err);
+						logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
+						for (const plaintext of secrets.keys()) recordLogOnlyValue(secrets, plaintext);
+						secrets.clear();
+					}
+					if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched where its position can be matched against AWS's report (a list element pairs by an identity field, or by the list's own unchanged literal values). A token EMBEDDED in a longer string is left untouched the same way when the rest of that string is exactly what AWS holds. Where it cannot be matched, the revert writes the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager', 'ssm' and 'ssm-secure' references; anything else is left as written.`);
+					const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
+					const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
+					const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
+					const canonicalized = provider.canonicalizeDriftProperties ? {
+						baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
+						aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
+					} : protocolNormalized;
+					const paired = provider.canonicalizeDriftPair ? await provider.canonicalizeDriftPair(resource.resourceType, canonicalized.baseline, canonicalized.aws, resource.properties ?? {}) : canonicalized;
+					const nameBaseline = canonicalizeDerivedPatternBName(resource.resourceType, paired.baseline, paired.aws);
+					const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(nameBaseline, paired.aws, {
+						ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
+						unionWalkObjects: useObserved,
+						unorderedPaths
+					}), resource, baseline);
+					const partitioned = partitionUncertifiedBaselineChanges(noEchoPartitioned.kept, resource.properties ?? {}, baseline);
+					const reported = redactDriftChanges(partitioned.kept, secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
+					const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : noEchoPartitioned.noEchoParameterPaths.length > 0 ? "noEchoParameter" : void 0;
+					if (reported.changes.length === 0) {
+						if (notComparedCause !== void 0) outcomes.push({
+							kind: "notCompared",
+							logicalId,
+							resourceType: resource.resourceType,
+							notComparedCause
+						});
+						else outcomes.push({
+							kind: "clean",
+							logicalId,
+							resourceType: resource.resourceType
+						});
+					} else outcomes.push({
+						kind: "drifted",
 						logicalId,
 						resourceType: resource.resourceType,
+						...reported,
+						awsProperties: aws,
+						secrets,
+						printingNeedles: unionOfSecretBags([printing, stackSecretNames]),
+						uncertifiedPaths: partitioned.uncertifiedPaths,
+						noEchoParameterPaths: noEchoPartitioned.noEchoParameterPaths,
+						secretsIncomplete: secretResolutionFailed || unresolvedTokens.size > 0,
 						notComparedCause
 					});
-					else outcomes.push({
-						kind: "clean",
-						logicalId,
-						resourceType: resource.resourceType
-					});
-				} else outcomes.push({
-					kind: "drifted",
-					logicalId,
-					resourceType: resource.resourceType,
-					...reported,
-					awsProperties: aws,
-					secrets,
-					uncertifiedPaths: partitioned.uncertifiedPaths,
-					noEchoParameterPaths: noEchoPartitioned.noEchoParameterPaths,
-					secretsIncomplete: secretResolutionFailed || unresolvedTokens.size > 0,
-					notComparedCause
-				});
-			} catch (err) {
-				if (isNoReadHandlerError(err)) {
-					logger.debug(`${logicalId} (${resource.resourceType}): read threw with a no-READ-handler signature, reported as drift unknown — ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
-					noteReadReturned();
+				} catch (err) {
+					if (isNoReadHandlerError(err)) {
+						logger.debug(`${logicalId} (${resource.resourceType}): read threw with a no-READ-handler signature, reported as drift unknown — ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
+						noteReadReturned();
+						outcomes.push({
+							kind: "unsupported",
+							logicalId,
+							resourceType: resource.resourceType
+						});
+						return;
+					}
 					outcomes.push({
-						kind: "unsupported",
+						kind: "notCompared",
 						logicalId,
-						resourceType: resource.resourceType
+						resourceType: resource.resourceType,
+						notComparedCause: "readFailed"
 					});
-					continue;
-				}
-				outcomes.push({
-					kind: "notCompared",
-					logicalId,
-					resourceType: resource.resourceType,
-					notComparedCause: "readFailed"
-				});
-				let breakerTripped = false;
-				if (!readReturned) {
-					consecutiveReadFailures[readPath]++;
-					if (consecutiveReadFailures[readPath] === 5) {
-						trippedReadPaths.add(readPath);
-						breakerTripped = true;
+					let breakerTripped = false;
+					if (!readReturned) {
+						consecutiveReadFailures[readPath]++;
+						if (consecutiveReadFailures[readPath] === 5) {
+							trippedReadPaths.add(readPath);
+							breakerTripped = true;
+						}
 					}
+					logger.warn(`${logicalId} (${resource.resourceType}): could not be compared — the read or comparison failed, so NONE of its properties were checked. ` + (trippedReadPaths.size > 0 ? "" : `cdkd goes on with the rest of this stack. `) + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
+					if (breakerTripped) logger.warn(safeMsg`${5} reads in a row in this stack failed ` + safeMsg`${DRIFT_READ_PATH_LABELS[readPath]} — expired credentials, a revoked ` + "role, a permission all of them need, or a burst of throttling — so cdkd stops reading this stack's resources that way, and reports each one left as not compared. Fix the cause, or re-run if it was throttling.");
+					if (err instanceof Error && err.stack) logger.debug(`${logicalId} (${resource.resourceType}): comparison failure detail`, maskSecretsInError(err, secrets).stack);
+					return;
 				}
-				logger.warn(`${logicalId} (${resource.resourceType}): could not be compared — the read or comparison failed, so NONE of its properties were checked. ` + (trippedReadPaths.size > 0 ? "" : `cdkd goes on with the rest of this stack. `) + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
-				if (breakerTripped) logger.warn(safeMsg`${5} reads in a row in this stack failed ` + safeMsg`${DRIFT_READ_PATH_LABELS[readPath]} — expired credentials, a revoked ` + "role, a permission all of them need, or a burst of throttling — so cdkd stops reading this stack's resources that way, and reports each one left as not compared. Fix the cause, or re-run if it was throttling.");
-				if (err instanceof Error && err.stack) logger.debug(`${logicalId} (${resource.resourceType}): comparison failure detail`, maskSecretsInError(err, secrets).stack);
-				continue;
-			}
+			});
 		}
 		const warnings = warnIfPreV10BaselineGap(state, outcomes, logger);
 		return {
@@ -10368,7 +10423,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
 					if (refusal !== void 0) {
 						const revert = revertCommandLine(report.stackName, report.region);
-						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to ` + (revert === void 0 ? "state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed." : `state. Push the referenced value back to AWS with the command below, or re-deploy if the reference changed.\nRevert with: ${revert}`));
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${displayDriftPath(outcome, change.path)}' — ${refusal}, so cdkd will not write it to ` + (revert === void 0 ? "state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed." : `state. Push the referenced value back to AWS with the command below, or re-deploy if the reference changed.\nRevert with: ${revert}`));
 						continue;
 					}
 					setAtPath(newBaseline, change.path, change.awsValue);
@@ -10381,7 +10436,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 						recordedChanges++;
 						continue;
 					}
-					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — after redaction cdkd state holds a different value at that property. Usually an unresolved '{{resolve:...}}' reference sits there and wins over an accepted value (change the template if that reference is wrong); a readback value cdkd cannot compare is never called recorded.`);
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${displayDriftPath(outcome, change.path)}' was NOT recorded — after redaction cdkd state holds a different value at that property. Usually an unresolved '{{resolve:...}}' reference sits there and wins over an accepted value (change the template if that reference is wrong); a readback value cdkd cannot compare is never called recorded.`);
 				}
 				if (recordedChanges > 0) acceptedResourceCount++;
 				const written = maskMarkedNoEchoBaselineWithLeaves(redactedBaseline, existing, hasObserved);
@@ -11098,11 +11153,11 @@ function printAcceptPlan(reports, out) {
 			for (const change of o.changes) {
 				const refusal = acceptRefusalReason(change, o.maskedPaths);
 				if (refusal !== void 0) {
-					lines.push(`    ${reportPath(change.path)}: SKIPPED — ${refusal}\n`);
+					lines.push(`    ${reportPath(displayDriftPath(o, change.path))}: SKIPPED — ${refusal}\n`);
 					continue;
 				}
 				plannedWrites++;
-				lines.push(reportPlanChangeLine(change.path, change.stateValue, change.awsValue));
+				lines.push(reportPlanChangeLine(displayDriftPath(o, change.path), displayDriftValue(o, change.stateValue), displayDriftValue(o, change.awsValue)));
 			}
 		}
 		out.write(plannedWrites === 0 ? `\nPlan (--accept): no accepted values will be written to cdkd state for ${reportHeading(report)} — every drifted change below is refused (the run still writes the positioned re-redaction):\n` : `\nPlan (--accept): update cdkd state for ${reportHeading(report)}:\n`);
@@ -11142,7 +11197,7 @@ function printRevertPlan(reports, out, recovery) {
 			}
 			const word = o.changes.length === 1 ? "property path" : "property paths";
 			out.write(`  → provider.update on ${reportResource(o)}: revert ${o.changes.length} ${word}\n`);
-			for (const change of o.changes) out.write(reportPlanChangeLine(change.path, change.awsValue, change.stateValue));
+			for (const change of o.changes) out.write(reportPlanChangeLine(displayDriftPath(o, change.path), displayDriftValue(o, change.awsValue), displayDriftValue(o, change.stateValue)));
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
@@ -11150,7 +11205,7 @@ function printRevertPlan(reports, out, recovery) {
 				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					out.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
-					for (const path of preserved) out.write(`        ${reportPath(maskSecretsInText(path, o.secrets))}\n`);
+					for (const path of preserved) out.write(`        ${reportPath(displayDriftPath(o, maskSecretsInText(path, o.secrets)))}\n`);
 					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
 					out.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
@@ -11161,7 +11216,7 @@ function printRevertPlan(reports, out, recovery) {
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
-					for (const path of unbaselined) out.write(`        ${reportPath(maskSecretsInText(path, o.secrets))}\n`);
+					for (const path of unbaselined) out.write(`        ${reportPath(displayDriftPath(o, maskSecretsInText(path, o.secrets)))}\n`);
 					const refresh = mayNameTarget(report.stackName, report.region) ? pasteableCommand("cdkd state refresh-observed", [
 						{
 							value: report.stackName,
@@ -11212,7 +11267,12 @@ function writeJsonReport(reports) {
 				drifted.push({
 					logicalId: d.logicalId,
 					type: d.resourceType,
-					changes: d.changes,
+					changes: d.changes.map((change) => ({
+						...change,
+						path: displayDriftPath(d, change.path),
+						stateValue: displayDriftValue(d, change.stateValue),
+						awsValue: displayDriftValue(d, change.awsValue)
+					})),
 					referencesUnresolved: d.notComparedCause !== void 0
 				});
 			},
@@ -11283,6 +11343,35 @@ function reportValue(value) {
 	if (value === value.trim() && !value.startsWith("\"") && !ALTERED_BY_SAFE_MSG.test(value)) return value;
 	return escapeJsonLiterals(JSON.stringify(value));
 }
+function displayDriftValue(outcome, value) {
+	const bag = outcome.printingNeedles;
+	if (bag === void 0 || !hasMaskableValues(bag)) return value;
+	return maskDriftDisplayLeaves(value, (text) => maskSecretsInText(text, bag));
+}
+function displayDriftPath(outcome, path) {
+	const bag = outcome.printingNeedles;
+	if (bag === void 0 || !hasMaskableValues(bag)) return path;
+	return maskSecretsInText(path, bag);
+}
+function maskDriftDisplayLeaves(value, mask) {
+	if (typeof value === "string") return mask(value);
+	if (Array.isArray(value)) return value.map((entry) => maskDriftDisplayLeaves(entry, mask));
+	if (value !== null && typeof value === "object") {
+		const out = nullPrototypeRecord();
+		const entries = Object.entries(value);
+		const taken = new Set(entries.map(([key]) => key).filter((key) => mask(key) === key));
+		for (const [key, entry] of entries) {
+			let shown = mask(key);
+			if (shown !== key) {
+				for (let n = 2; taken.has(shown); n++) shown = `${mask(key)}#${n}`;
+				taken.add(shown);
+			}
+			out[shown] = maskDriftDisplayLeaves(entry, mask);
+		}
+		return out;
+	}
+	return value;
+}
 function reportChangeLine(sign, path, value) {
 	return safeMsg`    ${sign} ${reportIdent(path, 255)}: ${reportValue(value)}\n`;
 }
@@ -11345,8 +11434,8 @@ function writeHumanReport(reports) {
 			for (const o of drifted) {
 				process.stdout.write(`  ~ ${reportResource(o)}\n`);
 				for (const change of o.changes) {
-					process.stdout.write(reportChangeLine("-", change.path, change.stateValue));
-					process.stdout.write(reportChangeLine("+", change.path, change.awsValue));
+					process.stdout.write(reportChangeLine("-", displayDriftPath(o, change.path), displayDriftValue(o, change.stateValue)));
+					process.stdout.write(reportChangeLine("+", displayDriftPath(o, change.path), displayDriftValue(o, change.awsValue)));
 				}
 				process.stdout.write("\n");
 			}
@@ -11677,6 +11766,37 @@ async function releaseRegistryMarkerAfterDestroy(ctx, stackName, region, logger)
 	}
 }
 async function runDestroyForStack(stackName, state, ctx) {
+	const stackRegion = state.region;
+	if (!stackRegion || stackRegion === ctx.baseRegion) return destroyStackInRegion(stackName, state, ctx, void 0);
+	const scopeClients = new AwsClients({
+		region: stackRegion,
+		...ctx.profile && { profile: ctx.profile }
+	});
+	try {
+		const awsScope = {
+			region: stackRegion,
+			clients: scopeClients
+		};
+		const registry = new ProviderRegistry();
+		const nestedContext = getCurrentNestedStackContext();
+		const destroyInScope = () => destroyStackInRegion(stackName, state, ctx, {
+			clients: scopeClients,
+			registry
+		});
+		return await runInStackAwsScope(awsScope, () => nestedContext === void 0 ? destroyInScope() : withNestedStackContext({
+			...nestedContext,
+			providerRegistry: registry,
+			awsClients: scopeClients
+		}, destroyInScope));
+	} finally {
+		try {
+			scopeClients.destroy();
+		} catch (destroyError) {
+			getLogger().debug(`Failed to destroy region-scoped AWS clients: ${describeAwsFailure(destroyError).detail}`);
+		}
+	}
+}
+async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
 	const result = {
@@ -11829,29 +11949,20 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const restoreBaseRegionAndClients = () => {
 		if (!regionSwitched) return;
 		regionSwitched = false;
-		const switchedClients = destroyAwsClients;
 		destroyAwsClients = void 0;
 		process.env["AWS_REGION"] = ctx.baseRegion;
 		process.env["AWS_DEFAULT_REGION"] = ctx.baseRegion;
 		setAwsClients(ctx.baseAwsClients);
-		try {
-			switchedClients?.destroy();
-		} catch (destroyError) {
-			logger.debug(`Failed to destroy region-scoped AWS clients: ${describeAwsFailure(destroyError).detail}`);
-		}
 	};
-	if (stackRegion && stackRegion !== ctx.baseRegion) {
+	if (stackScope !== void 0 && stackRegion) {
 		logger.info(`Stack region: ${displaySafe(stackRegion, { asciiOnly: true })}`);
 		process.env["AWS_REGION"] = stackRegion;
 		process.env["AWS_DEFAULT_REGION"] = stackRegion;
 		regionSwitched = true;
 		try {
-			destroyAwsClients = new AwsClients({
-				region: stackRegion,
-				...ctx.profile && { profile: ctx.profile }
-			});
+			destroyAwsClients = stackScope.clients;
 			setAwsClients(destroyAwsClients);
-			destroyProviderRegistry = new ProviderRegistry();
+			destroyProviderRegistry = stackScope.registry;
 			registerAllProviders(destroyProviderRegistry, providerClasses);
 			destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
 			if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
@@ -13544,6 +13655,7 @@ async function orphanCommand(pathArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	let stackAwsClients;
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -13600,18 +13712,28 @@ async function orphanCommand(pathArgs, options) {
 				const have = displayIdentList(Object.keys(state.resources), ", ");
 				throw new Error(`Resource(s) not in state for stack ${displayStackName(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}): ${displayIdentList(missing, ", ")}.\nAvailable logical IDs: ${have}`);
 			}
-			const providerRegistry = new ProviderRegistry();
-			registerAllProviders(providerRegistry, providerClasses);
-			const rewriteResult = await rewriteResourceReferences(state, orphanLogicalIds, providerRegistry, { force: options.force });
-			printRewriteSummary(rewriteResult.rewrites, orphanLogicalIds);
-			if (rewriteResult.unresolvable.length > 0 && !options.force) {
-				printUnresolvable(rewriteResult.unresolvable);
-				throw new Error(`Orphan aborted: ${rewriteResult.unresolvable.length} reference(s) could not be resolved.\nRe-run with --force to fall back to cached attribute values from state, or fix the underlying provider/AWS issue and retry.`);
-			}
-			if (rewriteResult.unresolvable.length > 0) {
-				printUnresolvable(rewriteResult.unresolvable);
-				logger.warn(`--force: continuing despite ${rewriteResult.unresolvable.length} unresolved reference(s); the original intrinsic was left in place where the cache also lacked the value.`);
-			}
+			stackAwsClients = !targetRegion || targetRegion === awsClients.configuredRegion ? void 0 : new AwsClients({
+				region: targetRegion,
+				...options.profile && { profile: options.profile }
+			});
+			const scopeClients = stackAwsClients ?? awsClients;
+			const rewriteResult = await withPrintingSecrets(orphanPrintingBag(state), async () => {
+				const result = await runWithStackAwsClients(scopeClients, async () => {
+					const providerRegistry = new ProviderRegistry();
+					registerAllProviders(providerRegistry, providerClasses);
+					return rewriteResourceReferences(state, orphanLogicalIds, providerRegistry, { force: options.force });
+				});
+				printRewriteSummary(result.rewrites, orphanLogicalIds);
+				if (result.unresolvable.length > 0 && !options.force) {
+					printUnresolvable(result.unresolvable);
+					throw new Error(`Orphan aborted: ${result.unresolvable.length} reference(s) could not be resolved.\nRe-run with --force to fall back to cached attribute values from state, or fix the underlying provider/AWS issue and retry.`);
+				}
+				if (result.unresolvable.length > 0) {
+					printUnresolvable(result.unresolvable);
+					logger.warn(`--force: continuing despite ${result.unresolvable.length} unresolved reference(s); the original intrinsic was left in place where the cache also lacked the value.`);
+				}
+				return result;
+			});
 			if (options.dryRun) {
 				logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
 				return;
@@ -13634,6 +13756,7 @@ async function orphanCommand(pathArgs, options) {
 			});
 		}
 	} finally {
+		stackAwsClients?.destroy();
 		awsClients.destroy();
 	}
 }
@@ -13703,6 +13826,9 @@ async function pickStackRegion$1(stateBackend, stackName, synthRegion, flag) {
 	const regions = refs.map((ref) => ref.region === void 0 ? "(legacy)" : regionShown(ref.region)).join(", ");
 	throw new Error(`Stack ${plainOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Re-run with --stack-region '<region>' to disambiguate.`);
 }
+function orphanPrintingBag(state) {
+	return secretNamedRecordNeedles(state.resources, void 0);
+}
 function printRewriteSummary(rewrites, orphanLogicalIds) {
 	const logger = getLogger();
 	logger.info("");
@@ -18151,16 +18277,19 @@ async function stateOrphanResources(stackName, requested, options) {
 				registerAllProviders(scoped, providerClasses);
 				return scoped;
 			});
-			const rewriteResult = await runWithStackAwsClients(scopedClients, () => rewriteResourceReferences(state, logicalIds, registry, { force: options.force }));
-			printRewriteSummary(rewriteResult.rewrites, logicalIds);
-			if (rewriteResult.unresolvable.length > 0 && !options.force) {
-				printUnresolvable(rewriteResult.unresolvable);
-				throw new Error(`Orphan aborted: ${rewriteResult.unresolvable.length} reference(s) could not be resolved.\nRe-run with --force to fall back to cached attribute values from state, or fix the underlying provider/AWS issue and retry.`);
-			}
-			if (rewriteResult.unresolvable.length > 0) {
-				printUnresolvable(rewriteResult.unresolvable);
-				logger.warn(safeMsg`--force: continuing despite ${rewriteResult.unresolvable.length} unresolved reference(s); ` + `the original intrinsic was left in place where the cache also lacked the value.`);
-			}
+			const rewriteResult = await withPrintingSecrets(orphanPrintingBag(state), async () => {
+				const result = await runWithStackAwsClients(scopedClients, () => rewriteResourceReferences(state, logicalIds, registry, { force: options.force }));
+				printRewriteSummary(result.rewrites, logicalIds);
+				if (result.unresolvable.length > 0 && !options.force) {
+					printUnresolvable(result.unresolvable);
+					throw new Error(`Orphan aborted: ${result.unresolvable.length} reference(s) could not be resolved.\nRe-run with --force to fall back to cached attribute values from state, or fix the underlying provider/AWS issue and retry.`);
+				}
+				if (result.unresolvable.length > 0) {
+					printUnresolvable(result.unresolvable);
+					logger.warn(safeMsg`--force: continuing despite ${result.unresolvable.length} unresolved reference(s); ` + `the original intrinsic was left in place where the cache also lacked the value.`);
+				}
+				return result;
+			});
 			const idList = logicalIds.map((id) => displayIdent(id)).join(", ");
 			if (!options.yes && !options.force) {
 				process.stdout.write(`\nWARNING: This removes cdkd's state record of ${logicalIds.length} resource(s) [${idList}] from ${describedStackRef(ref)} only. AWS resources will NOT be deleted, and cdkd stops managing them. The stack's other records are kept.` + (refIsDescribed(ref) ? ` ${STATE_LIST_POINTER}` : "") + `\n\n`);
@@ -18206,6 +18335,10 @@ async function stateDestroyCommand(stackArgs, options) {
 	setResolvedResourceTimeouts(options.resourceTimeout);
 	if (stackArgs.length === 0) throw new Error(`Stack name is required. Usage: cdkd state destroy ${commandHole("stacks...")}`);
 	const setup = await setupStateBackend(options);
+	if (options.region) {
+		process.env["AWS_REGION"] = setup.region;
+		process.env["AWS_DEFAULT_REGION"] = setup.region;
+	}
 	const providerRegistry = new ProviderRegistry();
 	registerAllProviders(providerRegistry, providerClasses);
 	providerRegistry.setCustomResourceResponseBucket(setup.bucket);
@@ -18792,7 +18925,8 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		let refusedSticky = 0;
 		const publicSsmProver = new PublicSsmProver(region, () => driftProducerRegionEvidence(state, stackName, region, stateBackend), logger);
 		await withStackName(stackName, async () => {
-			const tasks = entries.map(async ([logicalId, resource]) => {
+			const printingBagOf = secretNamePrintingBags(state.resources, void 0);
+			const tasks = entries.map(([logicalId, resource]) => withPrintingSecrets(printingBagOf(logicalId), async () => {
 				if (resource.observedBaselineRefused === true && logicalId !== acceptId) {
 					refusedBaseline++;
 					if (refusedBaselineRemedy(resource) !== void 0) refusedSticky++;
@@ -18837,7 +18971,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 					failed++;
 					logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + safeMsg`readCurrentState failed — ${describeAwsFailure(err).detail}`);
 				}
-			});
+			}));
 			await Promise.all(tasks);
 		});
 		if (accept !== void 0 && refreshed === 0) {
@@ -18983,7 +19117,9 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [--orphan]`;
 		case "revert": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
-		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource, delete new]`;
+		case "reverse-replacement":
+			if (op.oldResourceMaySurvive !== void 0) return `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [the deploy did not confirm deleting the old resource: re-create it if AWS reports it gone, ` + (op.oldResourceMaySurvive === "kept" ? `re-adopt it if AWS still has it (its delete was refused or never sent), ` : `REFUSED if AWS still has it (its delete may still be running, or only partly ran), `) + `REFUSED if cdkd cannot tell; ` + (item.retainsNewResource ? `new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `delete new]`);
+			return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource, delete new]`;
 		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${safe(op.logicalId)} (${safe(op.resourceType)}) — was DELETED, unrecoverable`;
 		case "skip-mismatch": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — physical id changed, needs manual attention`;
@@ -19084,305 +19220,307 @@ async function rollbackCommand(stackArg, options) {
 		});
 		setAwsClients(stackAwsClients);
 		const finalSnapshotClients = stackAwsClients;
-		const providerRegistry = new ProviderRegistry();
-		registerAllProviders(providerRegistry, providerClasses);
-		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
-		let interrupted = false;
-		let declinedDivergentRewrite = false;
-		let declinedDivergentReason = "";
-		const sigintHandler = () => {
-			process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
-			interrupted = true;
-		};
-		process.on("SIGINT", sigintHandler);
-		const unforwardSigterm = forwardSigtermToSigint();
-		try {
-			await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
-		} catch (error) {
-			process.removeListener("SIGINT", sigintHandler);
-			unforwardSigterm();
-			throw error;
-		}
-		try {
-			const stateData = await setup.stateBackend.getState(stackName, region);
-			let journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
-			const orphanedPending = journal ? await judgeNestedPendingRecords(setup, stackName, region, journal.segments) : 0;
-			if (journal && orphanedPending > 0) journal = {
-				...journal,
-				segments: journal.segments.filter((s) => s.reason !== NESTED_PENDING_PARENT_REASON)
+		await runWithStackAwsClients(stackAwsClients, async () => {
+			const providerRegistry = new ProviderRegistry();
+			registerAllProviders(providerRegistry, providerClasses);
+			providerRegistry.setCustomResourceResponseBucket(setup.bucket);
+			let interrupted = false;
+			let declinedDivergentRewrite = false;
+			let declinedDivergentReason = "";
+			const sigintHandler = () => {
+				process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
+				interrupted = true;
 			};
-			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
-			applyCrossPrefixScan(await crossPrefixScan, {
-				stackName,
-				region,
-				bucket: setup.bucket,
-				recovery: {
-					profile: options.profile,
-					stateBucket: setup.bucket
+			process.on("SIGINT", sigintHandler);
+			const unforwardSigterm = forwardSigtermToSigint();
+			try {
+				await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
+			} catch (error) {
+				process.removeListener("SIGINT", sigintHandler);
+				unforwardSigterm();
+				throw error;
+			}
+			try {
+				const stateData = await setup.stateBackend.getState(stackName, region);
+				let journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
+				const orphanedPending = journal ? await judgeNestedPendingRecords(setup, stackName, region, journal.segments) : 0;
+				if (journal && orphanedPending > 0) journal = {
+					...journal,
+					segments: journal.segments.filter((s) => s.reason !== NESTED_PENDING_PARENT_REASON)
+				};
+				if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+				applyCrossPrefixScan(await crossPrefixScan, {
+					stackName,
+					region,
+					bucket: setup.bucket,
+					recovery: {
+						profile: options.profile,
+						stateBucket: setup.bucket
+					}
+				}, "rollback", (message) => logger.warn(message), (message) => logger.info(message));
+				if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
+				demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
+				if (!options.revertFailed) for (const segment of journal.segments) {
+					const failedRows = splitImportedOps(segment.failedOperations ?? [], segment).replay;
+					for (const logicalId of revertedNestedRowIds(failedRows)) {
+						const child = nestedChildStackName$1(stackName, logicalId);
+						if (((await setup.stateBackend.loadRollbackJournal(child, region).catch(() => null))?.segments ?? []).some((s) => s.runId === segment.runId && s.reason !== "nested-pending-parent" && splitImportedOps(s.operations, s).replay.length > 0)) throw new Error(`Nested stack ${plainOrDescribed(child, "nested stack name")} failed during a deploy this journal records, and its own journal still holds that deploy's completed operations. Re-run with --revert-failed so they are reverted in order with the parent's.`);
+					}
 				}
-			}, "rollback", (message) => logger.warn(message), (message) => logger.info(message));
-			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
-			demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
-			if (!options.revertFailed) for (const segment of journal.segments) {
-				const failedRows = splitImportedOps(segment.failedOperations ?? [], segment).replay;
-				for (const logicalId of revertedNestedRowIds(failedRows)) {
-					const child = nestedChildStackName$1(stackName, logicalId);
-					if (((await setup.stateBackend.loadRollbackJournal(child, region).catch(() => null))?.segments ?? []).some((s) => s.runId === segment.runId && s.reason !== "nested-pending-parent" && splitImportedOps(s.operations, s).replay.length > 0)) throw new Error(`Nested stack ${plainOrDescribed(child, "nested stack name")} failed during a deploy this journal records, and its own journal still holds that deploy's completed operations. Re-run with --revert-failed so they are reverted in order with the parent's.`);
+				const baseState = stateData.state;
+				const refusalRecovery = {
+					profile: options.profile,
+					stateBucket: setup.bucket,
+					statePrefix: options.statePrefix
+				};
+				refuseMalformedState(baseState, stackName, region, refusalRecovery);
+				refuseMalformedOrphans(baseState, stackName, region, refusalRecovery);
+				refuseMalformedOrphanRecords(baseState, stackName, region, refusalRecovery);
+				refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion, journal.segments.flatMap((seg) => seg.failedOperations ?? []).filter((op) => op.physicalIdRecoveredFromError === true).length);
+				const stateResources = { ...baseState.resources };
+				const mintedOrphans = [];
+				const orphanLogicalIds = new Set(options.orphan ?? []);
+				const newestSegment = journal.segments[journal.segments.length - 1];
+				if (newestSegment?.roleArn && !options.roleArn) {
+					const roleArnIsPlain = isIamRoleArn(newestSegment.roleArn) && safeRoleArn(newestSegment.roleArn) === newestSegment.roleArn;
+					logger.info((roleArnIsPlain ? `Note: the failed deploy ran with --role-arn ${safeRoleArn(newestSegment.roleArn)}; ` : "Note: the failed deploy ran with --role-arn and a role ARN that is not a plain identifier (read it from the rollback journal); ") + `this rollback is running with ambient credentials (pass --role-arn to match).`);
 				}
-			}
-			const baseState = stateData.state;
-			const refusalRecovery = {
-				profile: options.profile,
-				stateBucket: setup.bucket,
-				statePrefix: options.statePrefix
-			};
-			refuseMalformedState(baseState, stackName, region, refusalRecovery);
-			refuseMalformedOrphans(baseState, stackName, region, refusalRecovery);
-			refuseMalformedOrphanRecords(baseState, stackName, region, refusalRecovery);
-			refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion, journal.segments.flatMap((seg) => seg.failedOperations ?? []).filter((op) => op.physicalIdRecoveredFromError === true).length);
-			const stateResources = { ...baseState.resources };
-			const mintedOrphans = [];
-			const orphanLogicalIds = new Set(options.orphan ?? []);
-			const newestSegment = journal.segments[journal.segments.length - 1];
-			if (newestSegment?.roleArn && !options.roleArn) {
-				const roleArnIsPlain = isIamRoleArn(newestSegment.roleArn) && safeRoleArn(newestSegment.roleArn) === newestSegment.roleArn;
-				logger.info((roleArnIsPlain ? `Note: the failed deploy ran with --role-arn ${safeRoleArn(newestSegment.roleArn)}; ` : "Note: the failed deploy ran with --role-arn and a role ARN that is not a plain identifier (read it from the rollback journal); ") + `this rollback is running with ambient credentials (pass --role-arn to match).`);
-			}
-			let fallbackSkipPrefix;
-			const legacySkipPrefix = () => fallbackSkipPrefix ??= resolveSkipPrefix({ quiet: true });
-			const legacySegments = journal.segments.filter((s) => s.skipPrefix === void 0).length;
-			if (legacySegments > 0) logger.warn(safeMsg`${legacySegments} of ${journal.segments.length} rollback journal segment(s) ` + "were recorded by a cdkd that did not record the user-supplied-name prefix setting; replaying them with the stack-name prefix " + (legacySkipPrefix() ? "SKIPPED" : "KEPT") + " on user-supplied physical names (CDKD_PREFIX_USER_SUPPLIED_NAMES / context.cdkd.prefixUserSuppliedNames in ./cdk.json / the default). If the failed deploy ran with --prefix-user-supplied-names, re-run with CDKD_PREFIX_USER_SUPPLIED_NAMES=true instead.");
-			const createTokenLedger = ledgerForStack(setup.stateBackend, stackName, region);
-			const inSegmentScope = (segment, fn) => withSkipPrefix(segment.skipPrefix ?? legacySkipPrefix(), () => withStackName(stackName, () => withCreateTokenLedger(createTokenLedger, fn)));
-			logger.info(`\nRollback plan for ${stackRegionShown(stackName, region)}:`);
-			if (!stackRegionIsPlain(stackName, region)) logger.info(STACK_REGION_DESCRIBED_NOTE);
-			if (orphanedPending > 0) logger.info(safeMsg`\n  Discard ${orphanedPending} record(s) of nested deploys whose parent run no longer ` + `has a journal to replay them (nothing else would ever replay them).`);
-			const planStateView = { ...stateResources };
-			for (let s = journal.segments.length - 1; s >= 0; s--) {
-				const segment = journal.segments[s];
-				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${safe(segment.reason)}${segment.runId ? `, run ${safe(segment.runId)}` : ""}):`);
-				const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
-				const completedOps = splitImportedOps(segment.operations, segment, orphanLogicalIds);
-				for (const op of [...failedOps.imported, ...completedOps.imported]) logger.info(importedOpLabel(op));
-				for (const op of [...failedOps.displaced, ...completedOps.displaced]) logger.info(displacedOpLabel(op, segment));
-				const failedToReplay = failedOpsToReplay(failedOps.replay, options.revertFailed === true);
-				if (failedOps.replay.length > 0) {
-					if (failedToReplay.length > 0) {
-						const failedPlan = await inSegmentScope(segment, () => recheckFailedPlan(planFailedOps(failedToReplay, planStateView), planStateView, {
-							providerRegistry,
-							region,
-							logger
-						}));
-						for (const item of failedPlan) {
-							logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-							if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+				let fallbackSkipPrefix;
+				const legacySkipPrefix = () => fallbackSkipPrefix ??= resolveSkipPrefix({ quiet: true });
+				const legacySegments = journal.segments.filter((s) => s.skipPrefix === void 0).length;
+				if (legacySegments > 0) logger.warn(safeMsg`${legacySegments} of ${journal.segments.length} rollback journal segment(s) ` + "were recorded by a cdkd that did not record the user-supplied-name prefix setting; replaying them with the stack-name prefix " + (legacySkipPrefix() ? "SKIPPED" : "KEPT") + " on user-supplied physical names (CDKD_PREFIX_USER_SUPPLIED_NAMES / context.cdkd.prefixUserSuppliedNames in ./cdk.json / the default). If the failed deploy ran with --prefix-user-supplied-names, re-run with CDKD_PREFIX_USER_SUPPLIED_NAMES=true instead.");
+				const createTokenLedger = ledgerForStack(setup.stateBackend, stackName, region);
+				const inSegmentScope = (segment, fn) => withSkipPrefix(segment.skipPrefix ?? legacySkipPrefix(), () => withStackName(stackName, () => withCreateTokenLedger(createTokenLedger, fn)));
+				logger.info(`\nRollback plan for ${stackRegionShown(stackName, region)}:`);
+				if (!stackRegionIsPlain(stackName, region)) logger.info(STACK_REGION_DESCRIBED_NOTE);
+				if (orphanedPending > 0) logger.info(safeMsg`\n  Discard ${orphanedPending} record(s) of nested deploys whose parent run no longer ` + `has a journal to replay them (nothing else would ever replay them).`);
+				const planStateView = { ...stateResources };
+				for (let s = journal.segments.length - 1; s >= 0; s--) {
+					const segment = journal.segments[s];
+					logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${safe(segment.reason)}${segment.runId ? `, run ${safe(segment.runId)}` : ""}):`);
+					const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
+					const completedOps = splitImportedOps(segment.operations, segment, orphanLogicalIds);
+					for (const op of [...failedOps.imported, ...completedOps.imported]) logger.info(importedOpLabel(op));
+					for (const op of [...failedOps.displaced, ...completedOps.displaced]) logger.info(displacedOpLabel(op, segment));
+					const failedToReplay = failedOpsToReplay(failedOps.replay, options.revertFailed === true);
+					if (failedOps.replay.length > 0) {
+						if (failedToReplay.length > 0) {
+							const failedPlan = await inSegmentScope(segment, () => recheckFailedPlan(planFailedOps(failedToReplay, planStateView), planStateView, {
+								providerRegistry,
+								region,
+								logger
+							}));
+							for (const item of failedPlan) {
+								logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
+								if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+							}
+							applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
 						}
-						applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
+						for (const fop of failedOps.replay.filter((op) => !failedToReplay.includes(op))) logger.info(`  - (left as-is) ${logicalIdShown(fop.logicalId)} (${resourceTypeShown(fop.resourceType)}) — its ${plainOrDescribed(fop.changeType, "change type")} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 					}
-					for (const fop of failedOps.replay.filter((op) => !failedToReplay.includes(op))) logger.info(`  - (left as-is) ${logicalIdShown(fop.logicalId)} (${resourceTypeShown(fop.resourceType)}) — its ${plainOrDescribed(fop.changeType, "change type")} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+					const plan = planRollback(completedOps.replay, planStateView, orphanLogicalIds);
+					for (const item of plan) {
+						logger.info(actionLabel(item, options.skipFinalSnapshot === true));
+						if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+					}
+					applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
 				}
-				const plan = planRollback(completedOps.replay, planStateView, orphanLogicalIds);
-				for (const item of plan) {
-					logger.info(actionLabel(item, options.skipFinalSnapshot === true));
-					if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+				logger.info("");
+				if (!skipConfirmation) {
+					if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}` + (options.removeProtection === true ? ", TURNING DELETION PROTECTION OFF on the resources it deletes from this stack and the nested stacks it reverts?" : "?"))) {
+						logger.info("Rollback cancelled");
+						return;
+					}
 				}
-				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
-			}
-			logger.info("");
-			if (!skipConfirmation) {
-				if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}` + (options.removeProtection === true ? ", TURNING DELETION PROTECTION OFF on the resources it deletes from this stack and the nested stacks it reverts?" : "?"))) {
-					logger.info("Rollback cancelled");
-					return;
+				if (orphanedPending > 0) {
+					const discarded = await setup.stateBackend.dropRollbackJournalSegments(stackName, region, (s) => s.reason === NESTED_PENDING_PARENT_REASON);
+					logger.info(safeMsg`Discarded ${discarded} record(s) of nested deploys whose parent run no longer has a ` + `journal to replay them.`);
 				}
-			}
-			if (orphanedPending > 0) {
-				const discarded = await setup.stateBackend.dropRollbackJournalSegments(stackName, region, (s) => s.reason === NESTED_PENDING_PARENT_REASON);
-				logger.info(safeMsg`Discarded ${discarded} record(s) of nested deploys whose parent run no longer has a ` + `journal to replay them.`);
-			}
-			const eventRecorder = startRunRecorder({
-				backend: setup.stateBackend,
-				stackName,
-				region,
-				command: "rollback"
-			});
-			const ctx = {
-				providerRegistry,
-				region,
-				logger: logger.child("rollback"),
-				recordEvent: (e) => eventRecorder.record(maskEventTextWithBoundBags(e)),
-				finalSnapshotClients,
-				skipFinalSnapshot: options.skipFinalSnapshot === true,
-				...options.removeProtection === true && { removeProtection: true },
-				foreignHolder: makeForeignHolderScan(setup.stateBackend)({
+				const eventRecorder = startRunRecorder({
+					backend: setup.stateBackend,
 					stackName,
-					region
-				}),
-				importedProducerRegions: producerRegionsFromState(baseState),
-				...(stackName.includes("~") || baseState.parentStack !== void 0) && { producerRegionsIncomplete: true }
-			};
-			let currentEtag = stateData.etag;
-			const saveState = async () => {
-				if (declinedDivergentRewrite) return;
-				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
-				const next = () => ({
-					...carriedState,
-					version: 12,
 					region,
-					resources: { ...stateResources },
-					...orphansAfterRollback(baseState, mintedOrphans),
-					lastModified: Date.now()
+					command: "rollback"
 				});
-				try {
-					currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
-				} catch {
+				const ctx = {
+					providerRegistry,
+					region,
+					logger: logger.child("rollback"),
+					recordEvent: (e) => eventRecorder.record(maskEventTextWithBoundBags(e)),
+					finalSnapshotClients,
+					skipFinalSnapshot: options.skipFinalSnapshot === true,
+					...options.removeProtection === true && { removeProtection: true },
+					foreignHolder: makeForeignHolderScan(setup.stateBackend)({
+						stackName,
+						region
+					}),
+					importedProducerRegions: producerRegionsFromState(baseState),
+					...(stackName.includes("~") || baseState.parentStack !== void 0) && { producerRegionsIncomplete: true }
+				};
+				let currentEtag = stateData.etag;
+				const saveState = async () => {
+					if (declinedDivergentRewrite) return;
+					const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
+					const next = () => ({
+						...carriedState,
+						version: 12,
+						region,
+						resources: { ...stateResources },
+						...orphansAfterRollback(baseState, mintedOrphans),
+						lastModified: Date.now()
+					});
 					try {
-						const fresh = await setup.stateBackend.getState(stackName, region);
-						if (fresh?.divergentBodyRegion !== void 0) {
-							declinedDivergentRewrite = true;
-							declinedDivergentReason = divergedDuringRollbackMessage(fresh.divergentBodyRegion);
-							throw new Error(declinedDivergentReason);
-						}
-						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
-					} catch (retryError) {
-						if (declinedDivergentRewrite) {
-							logger.warn(`Did not persist state after a rollback operation: ${declinedDivergentReason}. The resource was reverted in AWS. Repair the record's region field to match the key it is stored under, then run the rollback again to reconcile state.`);
-							return;
+						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
+					} catch {
+						try {
+							const fresh = await setup.stateBackend.getState(stackName, region);
+							if (fresh?.divergentBodyRegion !== void 0) {
+								declinedDivergentRewrite = true;
+								declinedDivergentReason = divergedDuringRollbackMessage(fresh.divergentBodyRegion);
+								throw new Error(declinedDivergentReason);
+							}
+							currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
+						} catch (retryError) {
+							if (declinedDivergentRewrite) {
+								logger.warn(`Did not persist state after a rollback operation: ${declinedDivergentReason}. The resource was reverted in AWS. Repair the record's region field to match the key it is stored under, then run the rollback again to reconcile state.`);
+								return;
+							}
+							logger.warn(`Failed to persist state after a rollback operation: ${backendErrorText(retryError, stackName, region)}. The resource was reverted in AWS; re-run the rollback to reconcile state.` + rerunRollback(stackName));
 						}
-						logger.warn(`Failed to persist state after a rollback operation: ${backendErrorText(retryError, stackName, region)}. The resource was reverted in AWS; re-run the rollback to reconcile state.` + rerunRollback(stackName));
 					}
-				}
-			};
-			const oldestInitialDeploy = journal.segments[0]?.initialDeploy === true;
-			let totalFailures = 0;
-			let totalWarnings = 0;
-			const failedOrphanIds = [];
-			const inlinePolicyWriters = new RollbackInlinePolicyWriters();
-			const failedOpsPrinting = journaledOrphanPrintingBag(journal.segments.flatMap((s) => s.failedOperations ?? []), stateResources);
-			try {
-				while (journal.segments.length > 0) {
-					if (interrupted) break;
-					const segment = journal.segments[journal.segments.length - 1];
-					const completedSplit = splitImportedOps(segment.operations, segment, orphanLogicalIds);
-					const completedOps = completedSplit.replay;
-					const displaced = [...completedSplit.displaced, ...splitImportedOps(segment.failedOperations ?? [], segment).displaced];
-					for (const op of displaced) logger.warn(displacedOpLabel(op, segment).trim());
-					recordDisplacedSkips(ctx.recordEvent, stackName, displaced);
-					let nestedRun;
-					const result = await withNestedStackContext({
-						stateBackend: setup.stateBackend,
-						lockManager: setup.lockManager,
-						providerRegistry,
-						parentStackName: stackName,
-						parentRegion: region,
-						accountId: "unknown",
-						awsClients: setup.awsClients,
-						stateBucket: setup.bucket,
-						exportIndexStore: setup.exportIndexStore,
-						destroyOptions: {
-							...options.profile && { profile: options.profile },
-							statePrefix: options.statePrefix,
-							...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
-							...options.removeProtection === true && { removeProtection: true }
-						}
-					}, () => withNestedRevertRun(segment.runId, (run) => {
-						nestedRun = run;
-						return inSegmentScope(segment, async () => {
-							let failedOpFailures = 0;
-							let failedOpWarnings = 0;
-							const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
-							const failedForGuard = segment.failedOperations ?? [];
-							const failedToReplay = failedOpsToReplay(failedOps.replay, options.revertFailed === true);
-							if (failedToReplay.length > 0) {
-								const failedResult = await withPrintingSecrets(failedOpsPrinting, () => withPrintingSecrets(journaledOrphanPrintingBag(failedToReplay, stateResources), () => replayFailedOperations(failedToReplay, stateResources, stackName, ctx, {
+				};
+				const oldestInitialDeploy = journal.segments[0]?.initialDeploy === true;
+				let totalFailures = 0;
+				let totalWarnings = 0;
+				const failedOrphanIds = [];
+				const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+				const failedOpsPrinting = journaledOrphanPrintingBag(journal.segments.flatMap((s) => s.failedOperations ?? []), stateResources);
+				try {
+					while (journal.segments.length > 0) {
+						if (interrupted) break;
+						const segment = journal.segments[journal.segments.length - 1];
+						const completedSplit = splitImportedOps(segment.operations, segment, orphanLogicalIds);
+						const completedOps = completedSplit.replay;
+						const displaced = [...completedSplit.displaced, ...splitImportedOps(segment.failedOperations ?? [], segment).displaced];
+						for (const op of displaced) logger.warn(displacedOpLabel(op, segment).trim());
+						recordDisplacedSkips(ctx.recordEvent, stackName, displaced);
+						let nestedRun;
+						const result = await withNestedStackContext({
+							stateBackend: setup.stateBackend,
+							lockManager: setup.lockManager,
+							providerRegistry,
+							parentStackName: stackName,
+							parentRegion: region,
+							accountId: "unknown",
+							awsClients: finalSnapshotClients,
+							stateBucket: setup.bucket,
+							exportIndexStore: setup.exportIndexStore,
+							destroyOptions: {
+								...options.profile && { profile: options.profile },
+								statePrefix: options.statePrefix,
+								...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
+								...options.removeProtection === true && { removeProtection: true }
+							}
+						}, () => withNestedRevertRun(segment.runId, (run) => {
+							nestedRun = run;
+							return inSegmentScope(segment, async () => {
+								let failedOpFailures = 0;
+								let failedOpWarnings = 0;
+								const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
+								const failedForGuard = segment.failedOperations ?? [];
+								const failedToReplay = failedOpsToReplay(failedOps.replay, options.revertFailed === true);
+								if (failedToReplay.length > 0) {
+									const failedResult = await withPrintingSecrets(failedOpsPrinting, () => withPrintingSecrets(journaledOrphanPrintingBag(failedToReplay, stateResources), () => replayFailedOperations(failedToReplay, stateResources, stackName, ctx, {
+										afterOp: saveState,
+										isInterrupted: () => interrupted,
+										emitEnvelope: completedOps.length === 0,
+										onOrphan: (record) => mintedOrphans.push(record),
+										inlinePolicyWriters
+									})));
+									failedOpFailures = failedResult.failures;
+									failedOpWarnings = failedResult.warnings;
+									for (const op of failedResult.remainingFailedOps) if (isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true) failedOrphanIds.push(op.logicalId);
+									const remaining = [
+										...failedOps.imported,
+										...failedOps.displaced,
+										...failedOps.replay.filter((op) => !failedToReplay.includes(op)),
+										...failedResult.remainingFailedOps,
+										...completedOps.length > 0 ? failedToReplay.filter((op) => seedsDeleteFirstGuard(op) && !failedResult.remainingFailedOps.includes(op)) : []
+									];
+									if (!declinedDivergentRewrite && remaining.length !== (segment.failedOperations ?? []).length) try {
+										await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
+										if (remaining.length === 0) delete segment.failedOperations;
+										else segment.failedOperations = remaining;
+									} catch (stripError) {
+										logger.warn(safeMsg`Failed to strip replayed failed-ops from the journal: ${backendErrorText(stripError, stackName, region)}`);
+									}
+									if (failedResult.interrupted) return {
+										failures: failedOpFailures,
+										warnings: failedOpWarnings,
+										interrupted: true
+									};
+								}
+								const replayResult = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(completedOps), stateResources), () => replayRollback(completedOps, stateResources, stackName, ctx, {
+									orphanLogicalIds,
 									afterOp: saveState,
 									isInterrupted: () => interrupted,
-									emitEnvelope: completedOps.length === 0,
 									onOrphan: (record) => mintedOrphans.push(record),
-									inlinePolicyWriters
-								})));
-								failedOpFailures = failedResult.failures;
-								failedOpWarnings = failedResult.warnings;
-								for (const op of failedResult.remainingFailedOps) if (isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true) failedOrphanIds.push(op.logicalId);
-								const remaining = [
-									...failedOps.imported,
-									...failedOps.displaced,
-									...failedOps.replay.filter((op) => !failedToReplay.includes(op)),
-									...failedResult.remainingFailedOps,
-									...completedOps.length > 0 ? failedToReplay.filter((op) => seedsDeleteFirstGuard(op) && !failedResult.remainingFailedOps.includes(op)) : []
-								];
-								if (!declinedDivergentRewrite && remaining.length !== (segment.failedOperations ?? []).length) try {
-									await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
-									if (remaining.length === 0) delete segment.failedOperations;
-									else segment.failedOperations = remaining;
-								} catch (stripError) {
-									logger.warn(safeMsg`Failed to strip replayed failed-ops from the journal: ${backendErrorText(stripError, stackName, region)}`);
-								}
-								if (failedResult.interrupted) return {
-									failures: failedOpFailures,
-									warnings: failedOpWarnings,
-									interrupted: true
+									inlinePolicyWriters,
+									failedOperations: failedForGuard
+								}));
+								return {
+									failures: replayResult.failures + failedOpFailures,
+									warnings: replayResult.warnings + failedOpWarnings,
+									interrupted: replayResult.interrupted
 								};
-							}
-							const replayResult = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(completedOps), stateResources), () => replayRollback(completedOps, stateResources, stackName, ctx, {
-								orphanLogicalIds,
-								afterOp: saveState,
-								isInterrupted: () => interrupted,
-								onOrphan: (record) => mintedOrphans.push(record),
-								inlinePolicyWriters,
-								failedOperations: failedForGuard
-							}));
-							return {
-								failures: replayResult.failures + failedOpFailures,
-								warnings: replayResult.warnings + failedOpWarnings,
-								interrupted: replayResult.interrupted
-							};
+							});
+						}));
+						totalFailures += result.failures;
+						totalWarnings += result.warnings + (nestedRun?.warnings ?? 0) + displaced.length;
+						if (declinedDivergentRewrite) break;
+						if (result.interrupted) {
+							interrupted = true;
+							break;
+						}
+						if (result.failures > 0) break;
+						await setup.stateBackend.popRollbackJournalSegment(stackName, region);
+						journal.segments.pop();
+						await dropSettledNestedJournals({
+							stateBackend: setup.stateBackend,
+							lockManager: setup.lockManager,
+							parentStackName: stackName,
+							region,
+							settled: nestedRun?.settled ?? /* @__PURE__ */ new Map(),
+							runId: segment.runId,
+							logger
 						});
-					}));
-					totalFailures += result.failures;
-					totalWarnings += result.warnings + (nestedRun?.warnings ?? 0) + displaced.length;
-					if (declinedDivergentRewrite) break;
-					if (result.interrupted) {
-						interrupted = true;
-						break;
 					}
-					if (result.failures > 0) break;
-					await setup.stateBackend.popRollbackJournalSegment(stackName, region);
-					journal.segments.pop();
-					await dropSettledNestedJournals({
-						stateBackend: setup.stateBackend,
-						lockManager: setup.lockManager,
-						parentStackName: stackName,
-						region,
-						settled: nestedRun?.settled ?? /* @__PURE__ */ new Map(),
-						runId: segment.runId,
-						logger
-					});
+				} finally {
+					await eventRecorder.finalize(totalFailures > 0 || interrupted || declinedDivergentRewrite ? "FAILED" : "SUCCEEDED");
 				}
+				const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
+				if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
+					await setup.stateBackend.deleteState(stackName, region);
+					await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
+					await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
+					logger.info(`State for ${stackRegionShown(stackName, region)} removed (stack fully rolled back).`);
+				}
+				if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
+				if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.` + rerunRollback(stackName));
+				if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.` + dropFailedHint(stackName, region, failedOrphanIds) + rerunRollback(stackName));
+				if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
+				logger.info(`\nRollback of ${stackRegionShown(stackName, region)} complete.`);
 			} finally {
-				await eventRecorder.finalize(totalFailures > 0 || interrupted || declinedDivergentRewrite ? "FAILED" : "SUCCEEDED");
-			}
-			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
-			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
-				await setup.stateBackend.deleteState(stackName, region);
-				await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
-				await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
-				logger.info(`State for ${stackRegionShown(stackName, region)} removed (stack fully rolled back).`);
-			}
-			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
-			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.` + rerunRollback(stackName));
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.` + dropFailedHint(stackName, region, failedOrphanIds) + rerunRollback(stackName));
-			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
-			logger.info(`\nRollback of ${stackRegionShown(stackName, region)} complete.`);
-		} finally {
-			try {
-				await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-					logger.warn(`Failed to release lock for ${quotedOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}): ${backendErrorText(err, stackName, region)}`);
-				});
-			} finally {
-				process.removeListener("SIGINT", sigintHandler);
-				unforwardSigterm();
+				try {
+					await setup.lockManager.releaseLock(stackName, region).catch((err) => {
+						logger.warn(`Failed to release lock for ${quotedOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}): ${backendErrorText(err, stackName, region)}`);
+					});
+				} finally {
+					process.removeListener("SIGINT", sigintHandler);
+					unforwardSigterm();
+				}
 			}
-		}
+		});
 	} finally {
 		if (stackAwsClients) {
 			setAwsClients(setup.awsClients);
@@ -20452,7 +20590,7 @@ async function publishAssetsCommand(stacks, options) {
 				}, (node) => assetPublisher.executeNode(node));
 				logger.info(`  ✓ Published ${assetCount} asset(s) in ${((Date.now() - startedAt) / 1e3).toFixed(2)}s`);
 			} catch (err) {
-				error = err instanceof Error ? err : new Error(String(err));
+				error = err instanceof Error ? err : new Error(safeStringify(err));
 				logger.error(`  ✗ ${stack.stackName}: ${error.message}`);
 			}
 			results.push({
@@ -21179,6 +21317,11 @@ async function resolvePseudoParameterIntrinsics(value, region) {
 	};
 	return walk(value);
 }
+function shownPhysicalId(physicalId, bag) {
+	if (!hasMaskableValues(bag)) return {};
+	const shown = maskSecretsInText(physicalId, bag);
+	return shown === physicalId ? {} : { physicalIdShown: shown };
+}
 async function importOne(task) {
 	const logger = getLogger();
 	const { logicalId, resource, stackName, region, providerRegistry, override, overrides } = task;
@@ -21196,6 +21339,14 @@ async function importOne(task) {
 		outcome: "skipped-no-impl",
 		reason: `provider does not implement import (yet)`
 	};
+	const printingBagWith = (physicalId) => secretNamePrintingBag(logicalId, { [logicalId]: {
+		resourceType: resource.Type,
+		properties: resource.Properties ?? {},
+		physicalId: physicalId ?? "",
+		attributes: {},
+		dependencies: []
+	} });
+	const readBag = printingBagWith(override);
 	try {
 		const properties = substituteOverrideRefs(await resolvePseudoParameterIntrinsics(resource.Properties ?? {}, region), overrides);
 		const input = {
@@ -21206,7 +21357,7 @@ async function importOne(task) {
 			properties,
 			...override !== void 0 && { knownPhysicalId: override }
 		};
-		const result = await provider.import(input);
+		const result = await withPrintingSecrets(readBag, () => provider.import(input));
 		if (!result) return {
 			logicalId,
 			resourceType: resource.Type,
@@ -21218,11 +21369,12 @@ async function importOne(task) {
 			resourceType: resource.Type,
 			outcome: "imported",
 			physicalId: result.physicalId,
+			...shownPhysicalId(result.physicalId, printingBagWith(result.physicalId)),
 			...result.attributes !== void 0 && { attributes: result.attributes },
 			provisionedBy: route.provisionedBy
 		};
 	} catch (error) {
-		const msg = describeAwsFailure(error).detail;
+		const msg = maskSecretsInText(describeAwsFailure(error).detail, readBag);
 		logger.error(`Failed to import ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.Type)}): ${msg}`);
 		return {
 			logicalId,
@@ -21726,7 +21878,7 @@ function printSummary(rows) {
 	for (const r of rows) {
 		counts[r.outcome]++;
 		const tag = formatOutcome(r.outcome);
-		const detail = r.outcome === "imported" ? ` (${r.physicalId})` : r.reason ? ` — ${r.reason}` : "";
+		const detail = r.outcome === "imported" ? ` (${r.physicalIdShown ?? r.physicalId})` : r.reason ? ` — ${r.reason}` : "";
 		logger.info(`  ${tag} ${logicalIdShown(r.logicalId)} (${resourceTypeShown(r.resourceType)})${detail}`);
 	}
 	logger.info("");
@@ -21761,7 +21913,8 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIds) {
 	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return;
-	await Promise.all(entries.map(async ([logicalId, resource]) => {
+	const printingBagOf = secretNamePrintingBags(stackState.resources ?? {}, void 0);
+	await Promise.all(entries.map(([logicalId, resource]) => withPrintingSecrets(printingBagOf(logicalId), async () => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
 			delete resource.observedProperties;
 			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Re-import it, or deploy a change to it, to restore a baseline — unless its refusal is an unverifiable-parameter one, which only a replacement or a proving re-import discharges.`);
@@ -21792,7 +21945,7 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
-	}));
+	})));
 }
 function synthesizeNestedStackArn(childRegion, accountId, parentStackName, logicalId) {
 	return `arn:cdkd-local:${childRegion}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
@@ -22057,7 +22210,7 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
 	} catch (err) {
-		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${describeAwsFailure(err).detail}. Falling back to conventional asset-repo names.`);
 		return;
 	}
 	const clientRegion = canonicalizeRegion(opts.region) || void 0;
@@ -22085,7 +22238,7 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
 		return marker.containerRepo;
 	} catch (err) {
-		logger.debug(`${prefix}: bootstrap-marker read failed: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		logger.debug(`${prefix}: bootstrap-marker read failed: ${describeAwsFailure(err).detail}. Falling back to conventional asset-repo names.`);
 		return;
 	} finally {
 		resetAwsClients();
@@ -22140,13 +22293,13 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 						return JSON.stringify(value);
 					}
 				} catch (err) {
-					logger.debug(`${prefix}: exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to per-stack state scan`);
+					logger.debug(`${prefix}: exports index lookup failed for '${exportName}': ${describeAwsFailure(err).detail}; falling back to per-stack state scan`);
 				}
 				let refs;
 				try {
 					refs = await stateBackend.listStacks();
 				} catch (err) {
-					logger.debug(`${prefix}: failed to list stacks during Fn::ImportValue fallback for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
+					logger.debug(`${prefix}: failed to list stacks during Fn::ImportValue fallback for '${exportName}': ${describeAwsFailure(err).detail}`);
 					return;
 				}
 				const canonicalConsumerRegion = canonicalizeRegion(consumerRegion);
@@ -22163,7 +22316,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 							return JSON.stringify(value);
 						}
 					} catch (err) {
-						logger.debug(`${prefix}: state read failed for ${ref.stackName} (${region}) during Fn::ImportValue fallback: ${err instanceof Error ? err.message : String(err)}`);
+						logger.debug(`${prefix}: state read failed for ${ref.stackName} (${region}) during Fn::ImportValue fallback: ${describeAwsFailure(err).detail}`);
 						continue;
 					}
 				}
@@ -22205,7 +22358,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 					}
 					return;
 				} catch (err) {
-					logger.debug(`${prefix}: state read failed for Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}): ${err instanceof Error ? err.message : String(err)}`);
+					logger.debug(`${prefix}: state read failed for Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}): ${describeAwsFailure(err).detail}`);
 					return;
 				}
 			}
@@ -24229,7 +24382,7 @@ function attachWebSocketServer(opts) {
 		}
 		wss.handleUpgrade(req, socket, head, (ws) => {
 			onConnect(ws, req, cfg).catch((err) => {
-				logger.error(`WebSocket $connect dispatch failed: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+				logger.error(`WebSocket $connect dispatch failed: ${err instanceof Error ? err.stack ?? err.message : safeStringify(err)}`);
 				try {
 					ws.close(1011, "internal error");
 				} catch {}
@@ -24299,7 +24452,7 @@ function attachWebSocketServer(opts) {
 			const { body, isBase64Encoded } = bufferToBody$1(raw, isBinary);
 			logger.debug(`WebSocket message received for connection ${connectionId}: ${body.slice(0, 200)}`);
 			enqueueDispatch(connectionId, () => dispatchMessage(connectionId, cfg, body, isBase64Encoded, handshakeSnapshot).catch((err) => {
-				logger.error(`WebSocket message dispatch failed (connection ${connectionId}): ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+				logger.error(`WebSocket message dispatch failed (connection ${connectionId}): ${err instanceof Error ? err.stack ?? err.message : safeStringify(err)}`);
 				try {
 					ws.send(JSON.stringify({
 						message: "Internal server error",
@@ -24312,7 +24465,7 @@ function attachWebSocketServer(opts) {
 		ws.on("close", (code, reason) => {
 			const reasonText = reason.toString("utf-8");
 			const disconnectPromise = enqueueDispatch(connectionId, () => onDisconnect(connectionId, cfg, handshakeSnapshot, code, reasonText).catch((err) => {
-				logger.warn(`WebSocket $disconnect dispatch failed (connection ${connectionId}): ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket $disconnect dispatch failed (connection ${connectionId}): ${describeAwsFailure(err).detail}`);
 			}));
 			inFlightDisconnects.add(disconnectPromise);
 			disconnectPromise.finally(() => {
@@ -24325,7 +24478,7 @@ function attachWebSocketServer(opts) {
 		for (const frame of preVerdictFrames) {
 			const { body, isBase64Encoded } = bufferToBody$1(frame.raw, frame.isBinary);
 			enqueueDispatch(connectionId, () => dispatchMessage(connectionId, cfg, body, isBase64Encoded, handshakeSnapshot).catch((err) => {
-				logger.error(`WebSocket buffered-message dispatch failed (connection ${connectionId}): ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+				logger.error(`WebSocket buffered-message dispatch failed (connection ${connectionId}): ${err instanceof Error ? err.stack ?? err.message : safeStringify(err)}`);
 			}));
 		}
 		preVerdictFrames.length = 0;
@@ -24674,12 +24827,12 @@ function createContainerPool(specs, options) {
 		try {
 			handle.stopLogStream();
 		} catch (err) {
-			logger.debug(`stopLogStream(${handle.containerName}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`stopLogStream(${handle.containerName}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		try {
 			await removeContainer(handle.containerId);
 		} catch (err) {
-			logger.warn(`Failed to remove container ${handle.containerName}: ${err instanceof Error ? err.message : String(err)}. Continuing cleanup.`);
+			logger.warn(`Failed to remove container ${handle.containerName}: ${describeAwsFailure(err).detail}. Continuing cleanup.`);
 		}
 	}
 	async function removedIfDisposedOnFailure(name, run) {
@@ -24799,7 +24952,7 @@ function createContainerPool(specs, options) {
 						name
 					}), IN_FLIGHT_START_TIMEOUT_MS);
 				})]).catch((err) => {
-					logger.debug(`In-flight startOne rejected during dispose: ${err instanceof Error ? err.message : String(err)}`);
+					logger.debug(`In-flight startOne rejected during dispose: ${describeAwsFailure(err).detail}`);
 					return { kind: "rejected" };
 				}).finally(() => clearTimeout(timer));
 			});
@@ -25296,15 +25449,18 @@ async function localStartApiCommand(target, options) {
 	process.on("SIGTERM", () => {
 		shutdown("SIGTERM", 0);
 	});
+	installFatalShutdownHandlers(logger, shutdown);
+	await new Promise(() => void 0);
+}
+function installFatalShutdownHandlers(logger, shutdown) {
 	process.on("uncaughtException", (err) => {
-		logger.error(`Uncaught exception: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+		logger.error(`Uncaught exception: ${err instanceof Error ? err.stack ?? err.message : safeStringify(err)}`);
 		shutdown("uncaughtException", 1);
 	});
 	process.on("unhandledRejection", (reason) => {
-		logger.error(`Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}`);
+		logger.error(`Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : safeStringify(reason)}`);
 		shutdown("unhandledRejection", 1);
 	});
-	await new Promise(() => void 0);
 }
 function targetStackHint(target, stacks) {
 	if (target?.includes("/") !== true) return void 0;
@@ -25917,7 +26073,7 @@ async function reloadAllServers(args) {
 	try {
 		material = await synthesizeAndBuild();
 	} catch (err) {
-		logger.warn(`cdk synth failed during reload; keeping previous version. (${err instanceof Error ? err.message : String(err)})`);
+		logger.warn(`cdk synth failed during reload; keeping previous version. (${describeAwsFailure(err).detail})`);
 		return;
 	}
 	if (isClosing?.()) return;
@@ -26333,7 +26489,7 @@ async function runAfterContainersStopped(hook, logger) {
 	try {
 		await hook();
 	} catch (err) {
-		logger.debug(safeMsg`afterContainersStopped hook failed: ${err instanceof Error ? err.message : String(err)}`);
+		logger.debug(safeMsg`afterContainersStopped hook failed: ${describeAwsFailure(err).detail}`);
 	}
 }
 async function settleInFlightStep(state, logger) {
@@ -26350,7 +26506,7 @@ async function settleInFlightStep(state, logger) {
 	try {
 		await step.abandon();
 	} catch (err) {
-		logger.debug(safeMsg`in-flight step removal failed: ${err instanceof Error ? err.message : String(err)}`);
+		logger.debug(safeMsg`in-flight step removal failed: ${describeAwsFailure(err).detail}`);
 	}
 	logger.warn(safeMsg`The in-flight docker command did not finish within ${IN_FLIGHT_STEP_TIMEOUT_MS / 1e3}s; removed ${step.subject.what} if it existed, but a docker command that completes later can still create it -- run '${step.subject.remedy}' if it appears.`);
 }
@@ -26404,7 +26560,7 @@ async function cleanupEcsRun(state, options) {
 		for (const { stream } of logStreams) try {
 			stream.stop();
 		} catch (err) {
-			logger.debug(`log stream stop failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`log stream stop failed: ${describeAwsFailure(err).detail}`);
 		}
 		await runAfterContainersStopped(options.afterContainersStopped, logger);
 	} else {
@@ -26421,7 +26577,7 @@ async function cleanupEcsRun(state, options) {
 			try {
 				await stream.drain(CONTAINER_LOG_DRAIN_TIMEOUT_MS);
 			} catch (err) {
-				logger.debug(safeMsg`log stream drain failed: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(safeMsg`log stream drain failed: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		for (const c of state.startedContainers) try {
@@ -27495,7 +27651,7 @@ async function runAgentCoreWatchLoop(args) {
 				verdict = classifySourceChange(changedPaths, assetCtx);
 				logger.info(`Detected source change (${changedPaths.length} path(s)); verdict=${verdict.kind} (${verdict.reason}).`);
 			} catch (err) {
-				logger.warn(`Reload: classifier context unavailable (${err instanceof Error ? err.message : String(err)}); falling back to rebuild.`);
+				logger.warn(`Reload: classifier context unavailable (${describeAwsFailure(err).detail}); falling back to rebuild.`);
 				verdict = {
 					kind: "rebuild",
 					reason: "classifier context unavailable; falling back to rebuild"
@@ -27522,12 +27678,12 @@ async function runAgentCoreWatchLoop(args) {
 					currentAbort?.abort();
 					return;
 				}
-				logger.error(`Reload failed: ${err instanceof Error ? err.message : String(err)}. The previous container may already be torn down; exiting --watch loop. Re-run cdkd local invoke-agentcore --watch to recover.`);
+				logger.error(`Reload failed: ${describeAwsFailure(err).detail}. The previous container may already be torn down; exiting --watch loop. Re-run cdkd local invoke-agentcore --watch to recover.`);
 				reloadFailed = true;
 				currentAbort?.abort();
 			}
 		}).catch((err) => {
-			logger.error(`Reload chain threw: ${err instanceof Error ? err.message : String(err)}`);
+			logger.error(`Reload chain threw: ${describeAwsFailure(err).detail}`);
 		});
 	});
 	try {
@@ -27559,7 +27715,7 @@ async function runAgentCoreWatchLoop(args) {
 		try {
 			await watcher.close();
 		} catch (err) {
-			logger.warn(`Watcher close failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Watcher close failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 }
@@ -29449,4 +29605,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-C87Q8YFK.js.map
+//# sourceMappingURL=program-DVPHKsxv.js.map