@go-to-k/cdkd 0.284.12 → 0.284.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-nwoIJsLn.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-C2OBi4mp.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CkIFzX7p.js";
+import { t as ASGProvider } from "./asg-provider-DZAeGqBC.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33995,6 +33995,44 @@ var ECSProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
@@ -34004,6 +34042,41 @@ var ECSProvider = class {
 */
 const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
+* Depth cap for {@link maskDeep}. Bounds a self-referential bag rather than
+* hanging; `JSON.stringify` would throw on one anyway, and a throw is the
+* better failure of the two.
+*/
+const MASK_WALK_MAX_DEPTH$1 = 8;
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line (issue #2050).
+*
+* The ordering is the whole point. `maskSecretsInText` matches by literal
+* occurrence, and `JSON.stringify` escapes `"`, `\` and newlines — so a Secrets
+* Manager JSON document (the commonest real secret shape) does not occur in the
+* stringified text and survives a mask applied afterwards. Masking the leaves
+* first also hands the masker each RAW value, which reaches
+* `maskSecretsInText`'s whole-value arm at any length instead of only the
+* substring arm's 4-character floor. See the "three gaps" note in
+* `src/deployment/secret-redaction.ts`.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* `cognito-provider.ts` carries an equivalent private walk for its own
+* stringified warnings. Two copies is the current cost of keeping this a leaf;
+* a THIRD site is the point at which this should move into
+* `../masked-retry-logger.ts` (already the shared provider-side masking module)
+* and all three converge on it.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= MASK_WALK_MAX_DEPTH$1) return value;
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+/**
 * Documented AWS defaults for TargetGroup attributes, used to reset a
 * removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
 * / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
@@ -34177,28 +34250,86 @@ var ELBv2Provider = class {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.elbv2Client;
 	}
-	async create(logicalId, resourceType, properties) {
+	/**
+	* A {@link RetryLogger} for this provider's `withRetry` calls, bound to the
+	* caller's secret masker (issue #2050).
+	*
+	* Thin wrapper over the shared {@link createMaskedRetryLogger} so the two
+	* providers that need it cannot drift apart — see that module for why the
+	* factory is shared rather than hand-rolled per file, and for the full
+	* rationale on why `warn` is threaded rather than omitted.
+	*
+	* WHY NOT A `maskSecrets` OPTION ON `withRetry` (issue #2050 acceptance
+	* item 3): `RetryLogger` is a structural type any caller can already satisfy
+	* with a masking object — `drift.ts`'s revert has done exactly that since
+	* issue #1914 — so the option would be a SECOND spelling of one intent
+	* across ~50 existing call sites, and two spellings is how a later author
+	* reaches for the unmasked one.
+	*/
+	maskedRetryLogger(maskSecrets) {
+		return createMaskedRetryLogger(this.logger, maskSecrets);
+	}
+	/**
+	* Mask a caught AWS error's message before it is interpolated into the
+	* `ProvisioningError` this provider throws (issue #2050, review round 2).
+	*
+	* NOT a duplicate of {@link maskedRetryLogger}, and strictly WIDER than it.
+	* `withRetry` rethrows the RAW error, and `deploy-engine.ts` prints the
+	* resulting message at ERROR — i.e. at DEFAULT verbosity — so a masked
+	* give-up `warn` was being followed one line later by the identical text
+	* unmasked. It is also the ONLY disclosure surface for a NON-RETRYABLE
+	* rejection, where `withRetry` emits nothing at all: its give-up summary is
+	* gated on `propagationRetries > 0 || serverErrorRetries > 0`, and a
+	* validation error that fails on attempt 0 satisfies neither.
+	*
+	* Masks `error.message` rather than the assembled sentence ON PURPOSE. The
+	* two are NOT equivalent: handing the masker the raw message can reach
+	* `maskSecretsInText`'s WHOLE-VALUE arm, which matches at ANY length, while
+	* a longer assembled sentence can only ever reach the SUBSTRING arm, which
+	* ignores needles below 4 characters. See `SecretMaskingContext` in
+	* `src/types/resource.ts`.
+	*
+	* The `cause` chain is deliberately left UNMASKED and unwrapped by every
+	* caller of this helper: `isRetryableTransientError` walks `cause` for
+	* `$metadata.httpStatusCode`, and rewriting or dropping it would silently
+	* change retry classification. Only the human-readable message is rewritten.
+	*/
+	maskErrorMessage(error, maskSecrets) {
+		return maskerOrIdentity(maskSecrets)(error instanceof Error ? error.message : String(error));
+	}
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
+	* Listener create path runs a post-create `ModifyListenerAttributes` through
+	* `withRetry`, whose per-attempt `debug` line and give-up `warn` summary
+	* interpolate the AWS message verbatim — and that payload is built from
+	* RESOLVED template properties. See {@link maskedRetryLogger}.
+	*/
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties);
-			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties);
-			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties);
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
+	* update-path twin of the `create()` note above.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -34443,7 +34574,7 @@ var ELBv2Provider = class {
 			throw new ProvisioningError(`Failed to delete LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createTargetGroup(logicalId, resourceType, properties) {
+	async createTargetGroup(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating TargetGroup ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34481,7 +34612,7 @@ var ELBv2Provider = class {
 					}));
 					this.logger.debug(`Applied ${tgAttributes.length} TargetGroup attribute(s) for ${logicalId}`);
 				}
-				const targets = this.convertTargets(properties["Targets"]);
+				const targets = this.convertTargets(properties["Targets"], void 0, maskSecrets);
 				if (targets.length > 0) {
 					await this.getClient().send(new RegisterTargetsCommand({
 						TargetGroupArn: tgArn,
@@ -34494,7 +34625,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
 					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
+					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
 				}
 				throw innerError;
 			}
@@ -34508,10 +34639,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
 		const immutableChanged = (key, coerce) => {
 			const next = properties[key];
@@ -34539,7 +34670,7 @@ var ELBv2Provider = class {
 			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key, currentValue) => {
 				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
 				if (fallback === void 0) {
-					this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+					this.logger.warn(`TargetGroup attribute ${maskerOrIdentity(maskSecrets)(key)} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
 					return;
 				}
 				return currentValue === fallback ? void 0 : fallback;
@@ -34551,8 +34682,8 @@ var ELBv2Provider = class {
 				}));
 				this.logger.debug(`Applied ${tgAttrDiff.length} TargetGroupAttributes change(s) for ${logicalId}`);
 			}
-			const newTargets = this.convertTargets(properties["Targets"], properties["Port"]);
-			const oldTargets = this.convertTargets(previousProperties["Targets"], properties["Port"]);
+			const newTargets = this.convertTargets(properties["Targets"], properties["Port"], maskSecrets);
+			const oldTargets = this.convertTargets(previousProperties["Targets"], properties["Port"], maskSecrets);
 			const targetKey = (t) => JSON.stringify([
 				t.Id,
 				t.Port ?? null,
@@ -34590,7 +34721,7 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update TargetGroup ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteTargetGroup(logicalId, physicalId, resourceType, context) {
@@ -34608,7 +34739,7 @@ var ELBv2Provider = class {
 			throw new ProvisioningError(`Failed to delete TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createListener(logicalId, resourceType, properties) {
+	async createListener(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating Listener ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34636,7 +34767,7 @@ var ELBv2Provider = class {
 					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 						ListenerArn: listenerArn,
 						Attributes: listenerAttributes
-					})), logicalId, { logger: this.logger });
+					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
@@ -34644,7 +34775,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-listener --listener-arn ${listenerArn}`);
+					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-listener --listener-arn ${listenerArn}`);
 				}
 				throw innerError;
 			}
@@ -34654,10 +34785,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Listener ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Listener ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating Listener ${logicalId}: ${physicalId}`);
 		try {
 			const defaultActions = this.convertActions(properties["DefaultActions"]);
@@ -34679,7 +34810,7 @@ var ELBv2Provider = class {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
 					Attributes: submittedAttrs
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Applied ${submittedAttrs.length} ListenerAttributes change(s) for ${logicalId}`);
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -34691,7 +34822,7 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Listener ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Listener ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteListener(logicalId, physicalId, resourceType, context) {
@@ -34844,13 +34975,29 @@ var ELBv2Provider = class {
 	* Absent for a `lambda` target group (no port), where both sides stay
 	* undefined and therefore still key identically.
 	*/
-	convertTargets(raw, groupPort) {
+	/**
+	* `maskSecrets` (issue #2050) exists for the drop-warning below, which
+	* stringifies a whole REJECTED `Targets` element at DEFAULT verbosity. That
+	* element came out of the resolved `properties` bag, so a
+	* `{{resolve:secretsmanager:...}}` scalar anywhere inside it — an `Id` built
+	* by `Fn::Sub` from a secret, say — is already plaintext by the time this
+	* runs.
+	*
+	* OPTIONAL, but all three call sites supply it today (`createTargetGroup` and
+	* both `updateTargetGroup` sides). It stays optional because that is the
+	* `SecretMaskingContext` contract — absent means unmasked — not because some
+	* caller is known to omit it. An earlier revision of this comment claimed it
+	* protected "the `readCurrentState` / diff callers that have no masker";
+	* there are no such callers, and describing a defence by a consumer that does
+	* not exist is how the next author concludes the parameter is dead.
+	*/
+	convertTargets(raw, groupPort, maskSecrets) {
 		const defaultPort = groupPort === void 0 || groupPort === null || Number.isNaN(Number(groupPort)) ? void 0 : Number(groupPort);
 		if (!Array.isArray(raw)) return [];
 		const out = [];
 		for (const entry of raw) {
 			if (entry === null || typeof entry !== "object" || typeof entry.Id !== "string" || entry.Id.length === 0) {
-				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(entry)}`);
+				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(maskDeep(entry, maskerOrIdentity(maskSecrets)))}`);
 				continue;
 			}
 			const e = entry;
@@ -39887,8 +40034,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
-	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
-	if (request.MfaConfiguration === "OFF" && anyFactorBlock) warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. AWS REJECTS that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so this deploy FAILS rather than producing a pool with MFA disabled. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
+	const anyFactorBlock = hasAnyMfaFactorBlock(request);
 	const maskDeep = (v, depth = 0) => {
 		if (typeof v === "string") return maskSecrets(v);
 		if (depth >= MASK_WALK_MAX_DEPTH) return v;
@@ -39899,7 +40045,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskDeep(f)) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskDeep(properties["EnabledMfas"]))} (not a list)`);
 	if (dropped.length > 0) {
-		const consequence = request.MfaConfiguration === "OFF" && anyFactorBlock ? "MfaConfiguration is OFF while another factor block IS sent, so AWS REJECTS this call outright and the deploy fails" : request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
+		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
@@ -39928,6 +40074,248 @@ function resolveSentMfaConfiguration(properties, declaredMfaConfiguration) {
 	return declaredMfaConfiguration || void 0;
 }
 /**
+* "This `SetUserPoolMfaConfig` request carries an MFA FACTOR sub-block."
+*
+* ONE definition, shared by `buildMfaConfigRequest`'s dropped-entry warning and
+* by the pre-flight refusal below, so the message and the refusal cannot
+* disagree about the same request. It is precisely
+* `{Sms, SoftwareToken, Email}MfaConfiguration` -- `WebAuthnConfiguration` is
+* deliberately NOT a member, because WebAuthn is not an MFA factor and rides
+* alongside `MfaConfiguration: OFF` on every passkey-only pool (issue #1920).
+*/
+function hasAnyMfaFactorBlock(request) {
+	return request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+}
+/**
+* The `Policies.SignInPolicy.AllowedFirstAuthFactors` members AWS refuses to
+* combine with MFA (issue #1975).
+*
+* A DENY-list, deliberately, even though the AWS message states an ALLOW-list
+* ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth
+* factor if MFA is enabled"). Written from the allow-list, a member AWS adds
+* LATER would be refused by cdkd on the day it starts working -- the same
+* reason the unrecognized-`EnabledMfas` case in `buildMfaConfigRequest` warns
+* rather than throws, since that set is a hardcoded mirror of an AWS enum. The
+* cost of the deny-list is the reverse and is the cheaper one: a future
+* incompatible factor is simply not pre-flighted, which is the pre-#1975
+* behavior (a loud AWS rejection), not a regression.
+*
+* The two members ARE the whole of today's `AuthFactorType` enum outside the
+* allowed pair (`EMAIL_OTP`, `PASSWORD`, `SMS_OTP`, `WEB_AUTHN` --
+* `@aws-sdk/client-cognito-identity-provider`), so the deny-list and the
+* allow-list agree on every value that exists right now.
+*
+* BOTH members are MEASURED (us-east-1, 2026-08-19, issue #1975) -- neither is
+* extrapolated from the other, which is the failure mode this file's own
+* unrecognized-factor comment warns about:
+*
+*   [PASSWORD, EMAIL_OTP] + SetUserPoolMfaConfig(ON) -> REJECTED
+*   [PASSWORD, SMS_OTP]   + SetUserPoolMfaConfig(ON) -> REJECTED, same message
+*
+* The `SMS_OTP` probe needed a precondition worth recording, because without it
+* the interesting call is never reached: on a pool with NO `SmsConfiguration`,
+* `CreateUserPool` refuses the factor outright ("SMS_OTP can not be configured
+* as AuthFactor as user pool is missing valid SMS configuration"), so the probe
+* had to stand up an SNS-caller IAM role + ExternalId first. That earlier,
+* different refusal is AWS's own and is NOT something this pre-flight
+* duplicates.
+*
+* Typed `satisfies AuthFactorType[]` rather than left as `string[]`: the values
+* mirror an SDK enum, so a rename upstream should be a COMPILE error here
+* rather than a silently-never-matching deny-list.
+*/
+const MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS = ["EMAIL_OTP", "SMS_OTP"];
+/**
+* `Policies.SignInPolicy.AllowedFirstAuthFactors` as a list of STRINGS, or an
+* empty list when the template declares nothing usable there.
+*
+* Every mis-shape reads as ABSENT rather than as a violation: this feeds a
+* REFUSAL, so guessing at a container cdkd could not read would block a deploy
+* over a value it never understood. A genuinely broken `Policies` blob is AWS's
+* to reject, with its own message.
+*
+* The two containers are traversed with `?.` rather than with the
+* `typeof x === 'object' && !Array.isArray(x)` guard `config-shape.ts` uses,
+* and that is deliberate rather than sloppy: those guards are load-bearing
+* THERE because the helper REFUSES a non-object, while here the only outcome is
+* "no factors", which is exactly what indexing a string / number / array
+* already yields. The version carrying them was written first and MEASURED
+* inert -- deleting either clause failed no test and could not be made to,
+* since no template value indexes to anything at those keys. `?.` keeps the one
+* behaviour that is real (a declared `null` throws on a bare index) and leaves
+* nothing unfalsifiable behind.
+*
+* The two filters below are NOT the same kind of thing, and saying so matters
+* because an earlier revision of this comment claimed both were load-bearing and
+* "each fenced by a test" -- which was false for one of them, and a false fence
+* claim is what stops the next reader re-checking.
+*
+*  - `Array.isArray` is a RUNTIME guard and IS fenced: without it a scalar
+*    `AllowedFirstAuthFactors: 'EMAIL_OTP'` is read as a declaration and
+*    refused, and the test for that shape reds when it is dropped.
+*  - The string filter is a TYPE NARROWING and is INERT at runtime. `includes`
+*    compares by SameValueZero, so a non-string member can never equal a
+*    deny-list entry however it is spelled; deleting the filter fails NO test,
+*    and no test could be written that it would fail. It earns its place by
+*    giving the caller a `string[]`, and by keeping this function honest if a
+*    future caller ever COERCES a member instead of comparing it. The
+*    nested-list case in the suite fences that hypothetical `String(member)`
+*    implementation -- i.e. the mistake, not this code.
+*/
+function readAllowedFirstAuthFactors(properties) {
+	const factors = (properties["Policies"]?.["SignInPolicy"])?.["AllowedFirstAuthFactors"];
+	if (!Array.isArray(factors)) return [];
+	return factors.filter((factor) => typeof factor === "string");
+}
+/**
+* The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
+* all, or `undefined` when nothing is known to refuse it.
+*
+* Two rules, both for combinations AWS rejects 100% of the time, and both
+* raised BEFORE the first AWS call on BOTH the create and the update path. The
+* ordering is what makes them worth refusing rather than warning about: on the
+* UPDATE path `UpdateUserPool` lands FIRST and `SetUserPoolMfaConfig` is
+* refused afterwards, so sending the request leaves a PARTIAL APPLY behind --
+* with the security-relevant half being the half that did NOT apply (the MFA
+* configuration), while the half that did is the one loosening authentication.
+* Nothing unwinds it, and a retry cannot succeed until the user reverse-engineers
+* an AWS-worded error about a field they did not think they were changing.
+*
+* Rule 1 (issue #1977) -- `MfaConfiguration` resolves to OFF while the request
+* carries an MFA factor block. MEASURED us-east-1 2026-08-19 (issue #1968):
+*
+*   {ON,  SoftwareTokenMfaConfiguration: {Enabled: true}}   -> ACCEPTED (control)
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: true}}   -> rejected
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: false}}  -> rejected
+*   {OFF, EmailMfaConfiguration: {Message, Subject}}        -> rejected
+*
+* all with `InvalidParameterException: Invalid MFA configuration given, can't
+* turn off MFA and configure an MFA together`. The `Enabled: false` arm settles
+* the KEY: a block that enables NOTHING is still refused, so the rule is about
+* the block's PRESENCE -- exactly what `hasAnyMfaFactorBlock` tests -- and
+* since that predicate is precisely the three factor sub-blocks, no accepted
+* case survives. (Bound on the Email arm: an OPTIONAL control with that block
+* failed with a DIFFERENT error, "Cannot set EmailMfaConfiguration when user
+* pool EmailConfiguration contains an EmailSendingAccount of COGNITO_DEFAULT",
+* so it has no isolated control of its own -- informative in itself, since it
+* shows the exclusion is evaluated BEFORE the email-sending-account check.)
+*
+* Rule 2 (issue #1975) -- the `SetUserPoolMfaConfig` request resolves
+* `MfaConfiguration` to ON while `Policies.SignInPolicy.AllowedFirstAuthFactors`
+* allows `EMAIL_OTP` or `SMS_OTP`. AWS refuses with `Only PASSWORD and WEB_AUTHN
+* (if configured) can be enabled as an auth factor if MFA is enabled`. MEASURED
+* us-east-1 2026-08-19, both members and both MFA modes:
+*
+*   {[PASSWORD, EMAIL_OTP], ON}       -> rejected
+*   {[PASSWORD, EMAIL_OTP], OPTIONAL} -> ACCEPTED
+*   {[PASSWORD, SMS_OTP],   ON}       -> rejected (pool WITH a valid SmsConfiguration)
+*   {[PASSWORD, SMS_OTP],   OPTIONAL} -> ACCEPTED
+*
+* So `=== 'ON'` is MEASURED-CORRECT rather than merely conservative: OPTIONAL is
+* ACCEPTED, and widening this to `!== 'OFF'` would REFUSE A WORKING DEPLOY. An
+* earlier revision of this comment called OPTIONAL unmeasured; it is not, and
+* the measurement is what settles the narrowing rather than a cost argument.
+*
+* WHY THE MESSAGE DOES NOT OFFER `WEB_AUTHN` AS THE ESCAPE HATCH, even though
+* AWS's own error text names it as accepted. MEASURED us-east-1 2026-08-20: a
+* pool allowing `WEB_AUTHN` as a first auth factor is REJECTED by
+* `SetUserPoolMfaConfig(ON, SoftwareTokenMfa)` --
+*
+*   InvalidParameterException: Cannot set WebAuthn factor configuration to
+*   SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor
+*
+* -- with NO WebAuthn block at all, with `UserVerification: preferred`, and with
+* `required`. The only accepted shape is
+* `WebAuthnConfiguration.FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION`,
+* and the PINNED SDK (`@aws-sdk/client-cognito-identity-provider` 3.1018.0)
+* does not carry that field -- `WebAuthnConfigurationType` is exactly
+* `{RelyingPartyId?, UserVerification?}` -- so cdkd cannot reach it today.
+* Telling the user to switch to `WEB_AUTHN` would therefore be advice that
+* cannot be followed, which is why the remedy names removing the factor or
+* lowering `MfaConfiguration` instead.
+*
+* That same measurement means `WEB_AUTHN` + ON reproduces this very
+* partial-apply shape while NOT being on the deny-list. Deliberately left
+* uncovered: the correct rule there is CONDITIONAL on
+* `WebAuthnConfiguration.FactorConfiguration`, which the pinned SDK cannot
+* express, so a flat deny-list entry would be an OVER-REFUSAL of the shape that
+* becomes valid the moment the SDK gains the field. Tracked as issue #2064.
+*
+* SCOPE LIMIT, deliberate and load-bearing: rule 2 fires only when a
+* `SetUserPoolMfaConfig` request is actually BUILT (`hasMfaConfigProps`), i.e.
+* the template declares `EnabledMfas` / an email-OTP message or subject /
+* WebAuthn. With NONE of those, `MfaConfiguration` rides on the SINGLE
+* `CreateUserPool` / `UpdateUserPool` call and no second call follows -- so
+* there is no two-call window and structurally NOTHING to partly apply, which
+* is the entire harm this pre-flight exists to prevent. Refusing there would
+* ALSO be an over-refusal on a shape AWS accepts: a pool created with
+* `AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]` and no MFA configuration
+* call at all is ACCEPTED (measured, same session -- the pool came up fine and
+* only the later `SetUserPoolMfaConfig(ON)` failed). Such a template is left to
+* AWS, which answers it atomically.
+*
+* CLOUDFORMATION PARITY, settled by A/B rather than assumed -- both issues made
+* this an explicit precondition. CloudFormation hits the SAME rejections and
+* rolls the stack back:
+*
+*   {MfaConfiguration: OFF, EnabledMfas: [SOFTWARE_TOKEN_MFA]}
+*     -> ROLLBACK_COMPLETE, "Invalid MFA configuration given, can't turn off
+*        MFA and configure an MFA together"
+*   {MfaConfiguration: ON, EnabledMfas: [SOFTWARE_TOKEN_MFA],
+*    AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]}  (ESSENTIALS tier)
+*     -> ROLLBACK_COMPLETE, "Only PASSWORD and WEB_AUTHN..."
+*
+* So refusing is PARITY-PRESERVING, not a divergence: cdkd refuses the same SET
+* of templates CloudFormation refuses, only EARLIER (before the first API call
+* instead of after a partial apply) and in cdkd's own wording. Nothing that
+* deploys under CloudFormation is blocked here.
+*
+* Both rules read the value cdkd would SEND rather than the raw template value,
+* from ONE `buildMfaConfigRequest` call, so the refusal and the request can
+* never disagree about what OFF / ON means for a given bag. The build runs with
+* NO logger, so the pre-flight is silent and `applyMfaConfig`'s own warnings
+* still fire exactly once.
+*
+* WHAT THIS CANNOT SEE, stated because the message says "refuses it before
+* sending anything" and that reads as a completeness claim: the pre-flight
+* inspects the TEMPLATE, never the live pool, so two template edits reach the
+* same partial apply without tripping it -- DELETING the `SignInPolicy` block
+* while setting `MfaConfiguration: ON`, and OMITTING `MfaConfiguration` while
+* adding `EMAIL_OTP` to a pool whose live MFA is already ON. Both need a
+* live-state guard and are tracked in #2051.
+*
+* Deliberately UNCONDITIONAL -- no `CreateContext.replayingState` downgrade.
+* `.claude/rules/providers.md` says a create-path pre-flight refusal MUST
+* downgrade on a replay, so this is a STATED EXCEPTION rather than an
+* oversight, and the rule's own reasoning is what licenses it: the downgrade
+* exists because a refusal against a STATE record leaves a resource
+* un-rollbackable with no template-side remedy. That presupposes the replay
+* could otherwise SUCCEED. Here it cannot -- both combinations are rejected by
+* AWS 100% of the time (measured above, and CloudFormation rolls back on the
+* same templates), so downgrading would trade a clear cdkd-worded refusal for
+* the identical failure arriving later from AWS, on the create path with a
+* pool to roll back and on the update path with a partial apply. A state record
+* additionally cannot legitimately HOLD either combination: state is written
+* only after a SUCCESSFUL apply, and neither can be applied. Revisit this if
+* AWS ever starts accepting one of them.
+*/
+function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	if (request && request.MfaConfiguration === "OFF" && hasAnyMfaFactorBlock(request)) {
+		const blocks = [
+			...request.SmsMfaConfiguration !== void 0 ? ["SmsMfaConfiguration"] : [],
+			...request.SoftwareTokenMfaConfiguration !== void 0 ? ["SoftwareTokenMfaConfiguration"] : [],
+			...request.EmailMfaConfiguration !== void 0 ? ["EmailMfaConfiguration"] : []
+		];
+		return `${MFA_CONFIGURATION_PATH} is OFF while an MFA factor is configured (SetUserPoolMfaConfig would carry ${blocks.join(", ")}, built from EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject). AWS rejects that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Set MfaConfiguration to ON or OPTIONAL (or remove it) to enable the declared factor. (If MFA is genuinely not wanted, remove EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject instead.)`;
+	}
+	if (request && request.MfaConfiguration === "ON") {
+		const denied = MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS;
+		const offending = readAllowedFirstAuthFactors(properties).filter((factor) => denied.includes(factor));
+		if (offending.length > 0) return `${MFA_CONFIGURATION_PATH} is ON while Policies.SignInPolicy.AllowedFirstAuthFactors allows ${offending.join(", ")}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), and on an update the sign-in policy has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Remove ${offending.join(", ")} from Policies.SignInPolicy.AllowedFirstAuthFactors, leaving PASSWORD. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)`;
+	}
+}
+/**
 * Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
 * actually sends, or drop the key when nothing is sent. Returns the input
 * object unchanged when nothing applies, so the common case compares
@@ -40011,7 +40399,7 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnRelyingPartyID",
 		"WebAuthnUserVerification"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]])]]);
 	/**
 	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
 	* item 2, review round 2).
@@ -40040,6 +40428,26 @@ var CognitoUserPoolProvider = class {
 		this.logger.warn("AWS::Cognito::UserPool MfaConfiguration is an empty string, which declares no MFA mode and is treated as absent -- a collapsed Fn::Join or an empty String parameter produces this shape. The pool deploys with the default MFA configuration instead; declare ON / OPTIONAL / OFF explicitly, or omit the property, to say which was meant.");
 	}
 	/**
+	* Raise {@link describeUnsupportedMfaCombination}'s verdict as a typed
+	* refusal, or return silently when there is nothing to refuse.
+	*
+	* A `ProvisioningError` so both call sites behave the way each already does
+	* with the sibling `MfaConfiguration` shape refusal: on the create path it
+	* surfaces as the provider's own error rather than an AWS one, and on the
+	* update path `update()`'s catch re-throws an already-wrapped
+	* `ProvisioningError` unchanged, so it is not double-wrapped. Both call sites
+	* are OUTSIDE their method's try, so the throw travels untouched either way.
+	*
+	* `target` is the pool NAME on create (there is no physical id yet) and the
+	* physical id on update, matching what each path passes to its other
+	* `ProvisioningError`s.
+	*/
+	assertMfaCombinationApplicable(logicalId, resourceType, target, properties, declaredMfaConfiguration) {
+		const reason = describeUnsupportedMfaCombination(properties, declaredMfaConfiguration);
+		if (reason === void 0) return;
+		throw new ProvisioningError(reason, resourceType, logicalId, target);
+	}
+	/**
 	* The DIFF-side half of the `MfaConfiguration` substitution record.
 	*
 	* Applied by `DiffCalculator` to BOTH comparison sides, so a template that
@@ -40129,6 +40537,7 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
 		}
+		this.assertMfaCombinationApplicable(logicalId, resourceType, poolName, properties, mfaConfiguration);
 		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
@@ -40298,7 +40707,8 @@ var CognitoUserPoolProvider = class {
 	*   sub-block in the request AWS REJECTS the call; with none it accepts and
 	*   resets the pool to MFA-disabled. An EXPLICIT OFF beside a block is
 	*   rejected the same way (2026-08-19, issue #1968; the transcript lives at
-	*   the pinned-OFF warning in `buildMfaConfigRequest`).
+	*   `describeUnsupportedMfaCombination`, which since issue #1977 REFUSES that
+	*   combination before any call rather than warning about it).
 	*
 	* Nothing here licenses a claim about a field on neither list, or about one
 	* API from the other's section. Measure it.
@@ -40376,6 +40786,7 @@ var CognitoUserPoolProvider = class {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
@@ -41238,21 +41649,63 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.stsClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	/**
+	* A {@link RetryLogger} for this provider's `withRetry` calls, bound to the
+	* caller's secret masker (issue #2050).
+	*
+	* Thin wrapper over the shared {@link createMaskedRetryLogger} — see that
+	* module for why the factory is shared with `elbv2-provider.ts` rather than
+	* hand-rolled per file, and for why `warn` is threaded rather than omitted.
+	*
+	* NOT applied to `deleteNamespace`'s retry: that one sends a
+	* `DeleteNamespaceCommand` carrying a physical id only, and `delete()` has no
+	* `maskSecrets` to thread anyway (`DeleteContext` deliberately carries none).
+	*/
+	maskedRetryLogger(maskSecrets) {
+		return createMaskedRetryLogger(this.logger, maskSecrets);
+	}
+	/**
+	* Mask a caught AWS error's message before it is interpolated into the
+	* `ProvisioningError` this provider throws (issue #2050, review round 2).
+	*
+	* The twin of `ELBv2Provider.maskErrorMessage` — see that method for the full
+	* rationale. In short: `withRetry` rethrows the RAW error and the deploy
+	* engine prints the resulting message at ERROR (DEFAULT verbosity), so this
+	* is a wider disclosure surface than the retry logger, and the ONLY one for a
+	* NON-RETRYABLE rejection, where `withRetry` emits nothing at all.
+	*
+	* Masks `error.message` rather than the assembled sentence so the masker can
+	* reach `maskSecretsInText`'s WHOLE-VALUE arm (any length) instead of only
+	* the SUBSTRING arm (needles of 4+ characters). The `cause` chain is left
+	* untouched so `isRetryableTransientError`'s `$metadata` walk is unaffected.
+	*/
+	maskErrorMessage(error, maskSecrets) {
+		return maskerOrIdentity(maskSecrets)(error instanceof Error ? error.message : String(error));
+	}
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
+	* Service create path runs a post-create `UpdateServiceAttributes` through
+	* `withRetry` — see {@link maskedRetryLogger}.
+	*/
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	/**
+	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
+	* update-path twin of the `create()` note above.
+	*/
+	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -41540,7 +41993,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createService(logicalId, resourceType, properties) {
+	async createService(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating service discovery service ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -41572,7 +42025,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
 						ServiceId: serviceId,
 						Attributes: attrs
-					})), logicalId, { logger: this.logger });
+					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
@@ -41580,7 +42033,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws servicediscovery delete-service --id ${serviceId}`);
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws servicediscovery delete-service --id ${serviceId}`);
 				}
 				throw innerError;
 			}
@@ -41594,7 +42047,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -41614,7 +42067,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* full AWS-current snapshot as `properties`, so the round-trip is
 	* value-preserving.
 	*/
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const serviceChange = {};
@@ -41649,14 +42102,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
 					ServiceId: physicalId,
 					Attributes: upsertAttrs
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
 			}
 			if (hasAttrRemove) {
 				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
 					ServiceId: physicalId,
 					Attributes: removedAttrKeys
-				})), logicalId, { logger: this.logger });
+				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
 				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
@@ -41667,7 +42120,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteService(logicalId, physicalId, resourceType, context) {
@@ -82709,7 +83162,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;