@go-to-k/cdkd 0.284.11 → 0.284.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-K5kHzsB-.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-4Eh5Qqlm.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-C9OlqHee.js";
+import { t as ASGProvider } from "./asg-provider-H-Dl8qng.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33995,6 +33995,44 @@ var ECSProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
@@ -34004,6 +34042,41 @@ var ECSProvider = class {
 */
 const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
+* Depth cap for {@link maskDeep}. Bounds a self-referential bag rather than
+* hanging; `JSON.stringify` would throw on one anyway, and a throw is the
+* better failure of the two.
+*/
+const MASK_WALK_MAX_DEPTH$1 = 8;
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line (issue #2050).
+*
+* The ordering is the whole point. `maskSecretsInText` matches by literal
+* occurrence, and `JSON.stringify` escapes `"`, `\` and newlines — so a Secrets
+* Manager JSON document (the commonest real secret shape) does not occur in the
+* stringified text and survives a mask applied afterwards. Masking the leaves
+* first also hands the masker each RAW value, which reaches
+* `maskSecretsInText`'s whole-value arm at any length instead of only the
+* substring arm's 4-character floor. See the "three gaps" note in
+* `src/deployment/secret-redaction.ts`.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* `cognito-provider.ts` carries an equivalent private walk for its own
+* stringified warnings. Two copies is the current cost of keeping this a leaf;
+* a THIRD site is the point at which this should move into
+* `../masked-retry-logger.ts` (already the shared provider-side masking module)
+* and all three converge on it.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= MASK_WALK_MAX_DEPTH$1) return value;
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+/**
 * Documented AWS defaults for TargetGroup attributes, used to reset a
 * removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
 * / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
@@ -34177,28 +34250,86 @@ var ELBv2Provider = class {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.elbv2Client;
 	}
-	async create(logicalId, resourceType, properties) {
+	/**
+	* A {@link RetryLogger} for this provider's `withRetry` calls, bound to the
+	* caller's secret masker (issue #2050).
+	*
+	* Thin wrapper over the shared {@link createMaskedRetryLogger} so the two
+	* providers that need it cannot drift apart — see that module for why the
+	* factory is shared rather than hand-rolled per file, and for the full
+	* rationale on why `warn` is threaded rather than omitted.
+	*
+	* WHY NOT A `maskSecrets` OPTION ON `withRetry` (issue #2050 acceptance
+	* item 3): `RetryLogger` is a structural type any caller can already satisfy
+	* with a masking object — `drift.ts`'s revert has done exactly that since
+	* issue #1914 — so the option would be a SECOND spelling of one intent
+	* across ~50 existing call sites, and two spellings is how a later author
+	* reaches for the unmasked one.
+	*/
+	maskedRetryLogger(maskSecrets) {
+		return createMaskedRetryLogger(this.logger, maskSecrets);
+	}
+	/**
+	* Mask a caught AWS error's message before it is interpolated into the
+	* `ProvisioningError` this provider throws (issue #2050, review round 2).
+	*
+	* NOT a duplicate of {@link maskedRetryLogger}, and strictly WIDER than it.
+	* `withRetry` rethrows the RAW error, and `deploy-engine.ts` prints the
+	* resulting message at ERROR — i.e. at DEFAULT verbosity — so a masked
+	* give-up `warn` was being followed one line later by the identical text
+	* unmasked. It is also the ONLY disclosure surface for a NON-RETRYABLE
+	* rejection, where `withRetry` emits nothing at all: its give-up summary is
+	* gated on `propagationRetries > 0 || serverErrorRetries > 0`, and a
+	* validation error that fails on attempt 0 satisfies neither.
+	*
+	* Masks `error.message` rather than the assembled sentence ON PURPOSE. The
+	* two are NOT equivalent: handing the masker the raw message can reach
+	* `maskSecretsInText`'s WHOLE-VALUE arm, which matches at ANY length, while
+	* a longer assembled sentence can only ever reach the SUBSTRING arm, which
+	* ignores needles below 4 characters. See `SecretMaskingContext` in
+	* `src/types/resource.ts`.
+	*
+	* The `cause` chain is deliberately left UNMASKED and unwrapped by every
+	* caller of this helper: `isRetryableTransientError` walks `cause` for
+	* `$metadata.httpStatusCode`, and rewriting or dropping it would silently
+	* change retry classification. Only the human-readable message is rewritten.
+	*/
+	maskErrorMessage(error, maskSecrets) {
+		return maskerOrIdentity(maskSecrets)(error instanceof Error ? error.message : String(error));
+	}
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
+	* Listener create path runs a post-create `ModifyListenerAttributes` through
+	* `withRetry`, whose per-attempt `debug` line and give-up `warn` summary
+	* interpolate the AWS message verbatim — and that payload is built from
+	* RESOLVED template properties. See {@link maskedRetryLogger}.
+	*/
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties);
-			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties);
-			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties);
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
+	* update-path twin of the `create()` note above.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -34443,7 +34574,7 @@ var ELBv2Provider = class {
 			throw new ProvisioningError(`Failed to delete LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createTargetGroup(logicalId, resourceType, properties) {
+	async createTargetGroup(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating TargetGroup ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34481,7 +34612,7 @@ var ELBv2Provider = class {
 					}));
 					this.logger.debug(`Applied ${tgAttributes.length} TargetGroup attribute(s) for ${logicalId}`);
 				}
-				const targets = this.convertTargets(properties["Targets"]);
+				const targets = this.convertTargets(properties["Targets"], void 0, maskSecrets);
 				if (targets.length > 0) {
 					await this.getClient().send(new RegisterTargetsCommand({
 						TargetGroupArn: tgArn,
@@ -34494,7 +34625,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
 					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
+					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
 				}
 				throw innerError;
 			}
@@ -34508,10 +34639,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
 		const immutableChanged = (key, coerce) => {
 			const next = properties[key];
@@ -34539,7 +34670,7 @@ var ELBv2Provider = class {
 			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key, currentValue) => {
 				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
 				if (fallback === void 0) {
-					this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+					this.logger.warn(`TargetGroup attribute ${maskerOrIdentity(maskSecrets)(key)} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
 					return;
 				}
 				return currentValue === fallback ? void 0 : fallback;
@@ -34551,8 +34682,8 @@ var ELBv2Provider = class {
 				}));
 				this.logger.debug(`Applied ${tgAttrDiff.length} TargetGroupAttributes change(s) for ${logicalId}`);
 			}
-			const newTargets = this.convertTargets(properties["Targets"], properties["Port"]);
-			const oldTargets = this.convertTargets(previousProperties["Targets"], properties["Port"]);
+			const newTargets = this.convertTargets(properties["Targets"], properties["Port"], maskSecrets);
+			const oldTargets = this.convertTargets(previousProperties["Targets"], properties["Port"], maskSecrets);
 			const targetKey = (t) => JSON.stringify([
 				t.Id,
 				t.Port ?? null,
@@ -34590,7 +34721,7 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update TargetGroup ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteTargetGroup(logicalId, physicalId, resourceType, context) {
@@ -34608,7 +34739,7 @@ var ELBv2Provider = class {
 			throw new ProvisioningError(`Failed to delete TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createListener(logicalId, resourceType, properties) {
+	async createListener(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating Listener ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34636,7 +34767,7 @@ var ELBv2Provider = class {
 					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 						ListenerArn: listenerArn,
 						Attributes: listenerAttributes
-					})), logicalId, { logger: this.logger });
+					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
@@ -34644,7 +34775,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-listener --listener-arn ${listenerArn}`);
+					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-listener --listener-arn ${listenerArn}`);
 				}
 				throw innerError;
 			}
@@ -34654,10 +34785,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Listener ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Listener ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating Listener ${logicalId}: ${physicalId}`);
 		try {
 			const defaultActions = this.convertActions(properties["DefaultActions"]);
@@ -34679,7 +34810,7 @@ var ELBv2Provider = class {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
 					Attributes: submittedAttrs
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Applied ${submittedAttrs.length} ListenerAttributes change(s) for ${logicalId}`);
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -34691,7 +34822,7 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Listener ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Listener ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteListener(logicalId, physicalId, resourceType, context) {
@@ -34844,13 +34975,29 @@ var ELBv2Provider = class {
 	* Absent for a `lambda` target group (no port), where both sides stay
 	* undefined and therefore still key identically.
 	*/
-	convertTargets(raw, groupPort) {
+	/**
+	* `maskSecrets` (issue #2050) exists for the drop-warning below, which
+	* stringifies a whole REJECTED `Targets` element at DEFAULT verbosity. That
+	* element came out of the resolved `properties` bag, so a
+	* `{{resolve:secretsmanager:...}}` scalar anywhere inside it — an `Id` built
+	* by `Fn::Sub` from a secret, say — is already plaintext by the time this
+	* runs.
+	*
+	* OPTIONAL, but all three call sites supply it today (`createTargetGroup` and
+	* both `updateTargetGroup` sides). It stays optional because that is the
+	* `SecretMaskingContext` contract — absent means unmasked — not because some
+	* caller is known to omit it. An earlier revision of this comment claimed it
+	* protected "the `readCurrentState` / diff callers that have no masker";
+	* there are no such callers, and describing a defence by a consumer that does
+	* not exist is how the next author concludes the parameter is dead.
+	*/
+	convertTargets(raw, groupPort, maskSecrets) {
 		const defaultPort = groupPort === void 0 || groupPort === null || Number.isNaN(Number(groupPort)) ? void 0 : Number(groupPort);
 		if (!Array.isArray(raw)) return [];
 		const out = [];
 		for (const entry of raw) {
 			if (entry === null || typeof entry !== "object" || typeof entry.Id !== "string" || entry.Id.length === 0) {
-				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(entry)}`);
+				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(maskDeep(entry, maskerOrIdentity(maskSecrets)))}`);
 				continue;
 			}
 			const e = entry;
@@ -41238,21 +41385,63 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.stsClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	/**
+	* A {@link RetryLogger} for this provider's `withRetry` calls, bound to the
+	* caller's secret masker (issue #2050).
+	*
+	* Thin wrapper over the shared {@link createMaskedRetryLogger} — see that
+	* module for why the factory is shared with `elbv2-provider.ts` rather than
+	* hand-rolled per file, and for why `warn` is threaded rather than omitted.
+	*
+	* NOT applied to `deleteNamespace`'s retry: that one sends a
+	* `DeleteNamespaceCommand` carrying a physical id only, and `delete()` has no
+	* `maskSecrets` to thread anyway (`DeleteContext` deliberately carries none).
+	*/
+	maskedRetryLogger(maskSecrets) {
+		return createMaskedRetryLogger(this.logger, maskSecrets);
+	}
+	/**
+	* Mask a caught AWS error's message before it is interpolated into the
+	* `ProvisioningError` this provider throws (issue #2050, review round 2).
+	*
+	* The twin of `ELBv2Provider.maskErrorMessage` — see that method for the full
+	* rationale. In short: `withRetry` rethrows the RAW error and the deploy
+	* engine prints the resulting message at ERROR (DEFAULT verbosity), so this
+	* is a wider disclosure surface than the retry logger, and the ONLY one for a
+	* NON-RETRYABLE rejection, where `withRetry` emits nothing at all.
+	*
+	* Masks `error.message` rather than the assembled sentence so the masker can
+	* reach `maskSecretsInText`'s WHOLE-VALUE arm (any length) instead of only
+	* the SUBSTRING arm (needles of 4+ characters). The `cause` chain is left
+	* untouched so `isRetryableTransientError`'s `$metadata` walk is unaffected.
+	*/
+	maskErrorMessage(error, maskSecrets) {
+		return maskerOrIdentity(maskSecrets)(error instanceof Error ? error.message : String(error));
+	}
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
+	* Service create path runs a post-create `UpdateServiceAttributes` through
+	* `withRetry` — see {@link maskedRetryLogger}.
+	*/
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
+	* update-path twin of the `create()` note above.
+	*/
+	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -41540,7 +41729,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createService(logicalId, resourceType, properties) {
+	async createService(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating service discovery service ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -41572,7 +41761,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
 						ServiceId: serviceId,
 						Attributes: attrs
-					})), logicalId, { logger: this.logger });
+					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
@@ -41580,7 +41769,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws servicediscovery delete-service --id ${serviceId}`);
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws servicediscovery delete-service --id ${serviceId}`);
 				}
 				throw innerError;
 			}
@@ -41594,7 +41783,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -41614,7 +41803,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* full AWS-current snapshot as `properties`, so the round-trip is
 	* value-preserving.
 	*/
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const serviceChange = {};
@@ -41649,14 +41838,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
 					ServiceId: physicalId,
 					Attributes: upsertAttrs
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
 			}
 			if (hasAttrRemove) {
 				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
 					ServiceId: physicalId,
 					Attributes: removedAttrKeys
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
@@ -41667,7 +41856,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteService(logicalId, physicalId, resourceType, context) {
@@ -63483,10 +63672,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
 						desiredFromAwsReadback: true,
 						maskSecrets: createSecretMasker(secrets)
-					}), outcome.logicalId, { logger: {
-						debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
-						warn: (msg) => logger.warn(maskSecretsInText(msg, secrets))
-					} });
+					}), outcome.logicalId, { logger: maskingRetryLogger(logger, secrets) });
 					totalSucceeded++;
 					const revertPartial = updatePartialReason(updateResult);
 					if (revertPartial !== void 0) logger.warn(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, ${maskSecretsInText(updatePartialMessage(revertPartial), secrets)}`);
@@ -82712,7 +82898,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.11");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;