@go-to-k/cdkd 0.284.13 → 0.284.15

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-4Eh5Qqlm.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-BNujuzW5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-H-Dl8qng.js";
+import { t as ASGProvider } from "./asg-provider-BZwQzb8e.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9808,6 +9808,8 @@ var SNSTopicProvider = class {
 	* only.
 	*/
 	async create(logicalId, resourceType, properties, context) {
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
 		try {
@@ -9845,7 +9847,7 @@ var SNSTopicProvider = class {
 						AttributeValue: dataProtectionPolicy
 					}));
 				}
-				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, context?.replayingState === true ? "warn" : "throw");
+				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, context?.replayingState === true ? "warn" : "throw", maskSecrets);
 				for (const [attributeName, attributeValue] of deliveryStatusAttributes) await this.snsClient.send(new SetTopicAttributesCommand({
 					TopicArn: topicArn,
 					AttributeName: attributeName,
@@ -9860,7 +9862,7 @@ var SNSTopicProvider = class {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws sns delete-topic --topic-arn ${topicArn}`);
+					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws sns delete-topic --topic-arn ${topicArn}`);
 				}
 				throw innerError;
 			}
@@ -9894,16 +9896,16 @@ var SNSTopicProvider = class {
 	* matches those by class to decide its fallback, so swallowing one into a
 	* ProvisioningError would silently disable that path.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, properties, previousProperties, context?.maskSecrets);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating SNS topic ${logicalId}: ${physicalId}`);
 		for (const attr of [
 			{
@@ -9957,7 +9959,7 @@ var SNSTopicProvider = class {
 			}
 		}
 		if (JSON.stringify(properties["DeliveryStatusLogging"]) !== JSON.stringify(previousProperties["DeliveryStatusLogging"])) {
-			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "warn");
+			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "warn", maskSecrets);
 			const previousAttributes = buildDeliveryStatusAttributeMap(previousProperties["DeliveryStatusLogging"], logicalId, "skip");
 			for (const [attributeName, attributeValue] of desiredAttributes) {
 				if (previousAttributes.get(attributeName) === attributeValue) continue;
@@ -10386,37 +10388,63 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * while `create()` kept `'throw'`; issue #1551 then extended the downgrade to
 * a create that DECLARES a state replay, leaving the template-path create
 * strict (#1529 / #1536 deliberately left that contract unchanged).
-*/
-function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
+*
+* `maskSecrets` is the caller's secret masker (issue #1932 item 3, adopted here
+* by issue #1997), threaded from `CreateContext` / `UpdateContext` — see
+* `SecretMaskingContext` in `src/types/resource.ts`. Every warning below names a
+* RESOLVED property value: `DeliveryStatusLogging` reaches this function already
+* resolved, so a `{{resolve:secretsmanager:...}}` scalar inside it is plaintext,
+* and cdkd's other masking boundaries (the deploy engine's error / reason text
+* and the resolver's debug line) do not cover a provider's own `logger.warn`.
+* It defaults to IDENTITY so every existing caller — the diff / import paths and
+* the unit tests — keeps working unchanged.
+*
+* The `'throw'` arm is masked too, and the reason is worth stating because the
+* first cut of this change got it backwards. It claimed a thrown message travels
+* to the deploy engine "which already runs it through `maskSecretsInText`" —
+* FALSE. The engine masks an error message on ONE path only, the events store
+* (`deploy-engine.ts`'s per-event masker); its CLI path logs `error.message`
+* RAW to `logger.error`. So an unmasked throw here printed the resolved bag
+* straight to the terminal at default verbosity, which is a worse exposure than
+* the warn arms this change was written for, not a covered one. Both throw sites
+* therefore run their interpolated value through the same `maskLeaf` walk.
+*/
+function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed, maskSecrets = (text) => text) {
 	const map = /* @__PURE__ */ new Map();
 	if (logging == null) return map;
 	const warn = (message) => {
-		getLogger().child("SNSTopicProvider").warn(message);
+		getLogger().child("SNSTopicProvider").warn(maskSecrets(message));
+	};
+	const maskLeaf = (value) => {
+		if (typeof value === "string") return maskSecrets(value);
+		if (Array.isArray(value)) return value.map(maskLeaf);
+		if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
+		return value;
 	};
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
-		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
-		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty, so no delivery-status attribute is applied (on an update, any previously set one is reset). The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the operation; fix the template (or the state record on a replay) to clear this warning.`);
+		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(maskLeaf(logging))}`);
+		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(maskLeaf(logging))} — treating it as empty, so no delivery-status attribute is applied (on an update, any previously set one is reset). The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the operation; fix the template (or the state record on a replay) to clear this warning.`);
 		return map;
 	}
 	for (const entry of logging) {
 		if (entry == null || typeof entry !== "object" || Array.isArray(entry)) {
-			if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
-			if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry ${JSON.stringify(entry)} — entries must be {Protocol, ...} objects. Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+			if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(maskLeaf(entry))}`);
+			if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry ${JSON.stringify(maskLeaf(entry))} — entries must be {Protocol, ...} objects. Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
 			continue;
 		}
 		const config = entry;
 		let protocol;
-		if (onMalformed === "throw") protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
+		if (onMalformed === "throw") protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId, maskLeaf);
 		else {
 			const normalized = normalizeDeliveryStatusProtocol(config["Protocol"]);
 			if (normalized === void 0) {
-				if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry with unsupported protocol ${JSON.stringify(config["Protocol"])}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive). Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+				if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry with unsupported protocol ${JSON.stringify(maskLeaf(config["Protocol"]))}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive). Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
 				continue;
 			}
 			protocol = normalized;
 		}
-		if (onMalformed !== "skip" && seenProtocols.has(protocol)) warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
+		if (onMalformed !== "skip" && seenProtocols.has(protocol)) warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(maskLeaf(config["Protocol"]))} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
 		seenProtocols.add(protocol);
 		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
 			const value = config[suffix];
@@ -10500,9 +10528,9 @@ function normalizeDeliveryStatusProtocol(input) {
 * #1538) because its bag can be a cdkd state record on a rollback replay
 * or `drift --revert`.
 */
-function normalizeDeliveryStatusProtocolOrThrow(input, logicalId) {
+function normalizeDeliveryStatusProtocolOrThrow(input, logicalId, maskValue = (value) => value) {
 	const normalized = normalizeDeliveryStatusProtocol(input);
-	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(input)}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive).`);
+	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(maskValue(input))}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive).`);
 	return normalized;
 }
 /**
@@ -15687,6 +15715,29 @@ function desiredIndexEntriesByName(value) {
 * it meant to exercise fails silently — it just gets faster.
 */
 const deleteTableRetryDelays$1 = {};
+/**
+* Mask every string LEAF (and every KEY) of a value before it is stringified
+* into a log line (issue #1932 item 3, adopted here by issue #1997).
+*
+* This is the INNER of the two masking layers `SecretMaskingContext` prescribes,
+* and neither layer subsumes the other. The outer one — routing the assembled
+* message through the masker — can only reach `maskSecretsInText`'s SUBSTRING
+* arm, which ignores needles below `MIN_NEEDLE_LENGTH` (4) and, more
+* importantly, never matches at all once `JSON.stringify` has escaped a `"`, a
+* `\` or a newline inside the value: the secret no longer OCCURS in the finished
+* line. Handing the masker each raw string reaches the WHOLE-VALUE arm at any
+* length and runs BEFORE any escaping. The mask is idempotent and matches by
+* value rather than by position, so applying both composes.
+*
+* Walks rather than testing the top level, because a secret nested in an object
+* leaf is stringified — and escaped — identically.
+*/
+function maskLeafValue$1(value, maskSecrets) {
+	if (typeof value === "string") return maskSecrets(value);
+	if (Array.isArray(value)) return value.map((v) => maskLeafValue$1(v, maskSecrets));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue$1(v, maskSecrets)]));
+	return value;
+}
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
@@ -15756,6 +15807,9 @@ var DynamoDBTableProvider = class {
 	* Create a DynamoDB table
 	*/
 	async create(logicalId, resourceType, properties, context) {
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
 		const keySchema = properties["KeySchema"];
@@ -15779,16 +15833,16 @@ var DynamoDBTableProvider = class {
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
-			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 			if (createWarmThroughput) createParams.WarmThroughput = createWarmThroughput;
-			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 			if (properties["StreamSpecification"]) createParams.StreamSpecification = {
 				StreamEnabled: true,
 				StreamViewType: properties["StreamSpecification"]["StreamViewType"]
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -15804,7 +15858,7 @@ var DynamoDBTableProvider = class {
 			const tableInfo = await this.waitForTableActive(tableName);
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"]);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"]);
-			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"]);
+			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"]);
 			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
@@ -15819,9 +15873,9 @@ var DynamoDBTableProvider = class {
 		} catch (error) {
 			if (tableCreated) try {
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
-				this.logger.debug(`Rolled back partially-created DynamoDB table ${tableName}`);
+				debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 			} catch (cleanupError) {
-				this.logger.warn(`Failed to roll back partially-created DynamoDB table ${tableName}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+				warn(`Failed to roll back partially-created DynamoDB table ${tableName}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -15835,8 +15889,11 @@ var DynamoDBTableProvider = class {
 	* For immutable property changes (KeySchema, etc.), the deployment layer
 	* handles replacement via DELETE + CREATE.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating DynamoDB table ${logicalId}: ${physicalId}`);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		debug(`Updating DynamoDB table ${logicalId}: ${maskSecrets(physicalId)}`);
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			let latestStreamArn = table?.LatestStreamArn;
@@ -15847,11 +15904,11 @@ var DynamoDBTableProvider = class {
 			const recordedPrevBillingMode = previousProperties["BillingMode"];
 			const recordedPrevBillingModeUsable = recordedPrevBillingMode === void 0 || typeof recordedPrevBillingMode === "string" && recordedPrevBillingMode.trim() !== "";
 			const prevBillingMode = recordedPrevBillingModeUsable ? recordedPrevBillingMode ?? (properties["BillingMode"] !== void 0 ? liveBillingMode : "PROVISIONED") : liveBillingMode;
-			if (!recordedPrevBillingModeUsable) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedPrevBillingMode)}) — using the table's actual billing mode (${prevBillingMode}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			if (!recordedPrevBillingModeUsable) warn(`AWS::DynamoDB::Table ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(maskLeafValue$1(recordedPrevBillingMode, maskSecrets))}) — using the table's actual billing mode (${prevBillingMode}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingModeUnusable = false;
 			const requestedBillingMode = properties["BillingMode"] === void 0 ? "PROVISIONED" : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
 				billingModeUnusable = true;
-				this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: ${message} The mode this update compared against (${prevBillingMode}) is kept rather than flipped to the default.`);
+				warn(`AWS::DynamoDB::Table ${logicalId}: ${message} The mode this update compared against (${prevBillingMode}) is kept rather than flipped to the default.`);
 			} });
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
@@ -15883,7 +15940,7 @@ var DynamoDBTableProvider = class {
 					const reasons = [];
 					if (remainingWithoutCapacity.length > 0) reasons.push(`index(es) ${remainingWithoutCapacity.join(", ")} stay live and declare no usable per-index ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits are required there)`);
 					if (tableCapacityUnusable) reasons.push(`the template declares no usable table-level ProvisionedThroughput`);
-					this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
+					warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.map((n) => maskSecrets(n)).join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
 				} else if (removable.length > 0) {
 					this.logger.debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
 					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0);
@@ -15929,7 +15986,7 @@ var DynamoDBTableProvider = class {
 						gsiHandledByBillingFlip.add(indexName);
 					}
 					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
-					if (unspecified.length > 0) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically (issue #1617), so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
+					if (unspecified.length > 0) warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.map((n) => maskSecrets(n)).join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically (issue #1617), so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
@@ -15947,9 +16004,9 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["WarmThroughput"]) !== JSON.stringify(previousProperties["WarmThroughput"])) {
-				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
-				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
-				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput)) {
+				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
+				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
+				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput, maskSecrets)) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						WarmThroughput: warmThroughputToSend
@@ -16009,7 +16066,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -16019,7 +16076,7 @@ var DynamoDBTableProvider = class {
 				if (!table?.TableArn) throw new ProvisioningError(`Cannot apply ResourcePolicy change for DynamoDB table ${logicalId}: DescribeTable returned no TableArn`, resourceType, logicalId, physicalId);
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
-			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"]);
+			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
 			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"]);
 			return {
 				physicalId,
@@ -16317,11 +16374,11 @@ var DynamoDBTableProvider = class {
 	* pre-existing WarmThroughput "no clean remap" stance; precision changes flow
 	* through on the create / first-enable path.
 	*/
-	async applyKinesisStreamingDestination(tableName, spec, previousSpec) {
+	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets = (text) => text) {
 		const newArn = this.extractKinesisStreamArn(spec);
 		const prevArn = this.extractKinesisStreamArn(previousSpec);
 		if (newArn === prevArn) {
-			if (newArn && JSON.stringify(spec?.["ApproximateCreationDateTimePrecision"]) !== JSON.stringify(previousSpec?.["ApproximateCreationDateTimePrecision"])) this.logger.warn(`Kinesis streaming ApproximateCreationDateTimePrecision change on ${tableName} was not applied (same stream ARN; precision-only updates are not yet supported)`);
+			if (newArn && JSON.stringify(spec?.["ApproximateCreationDateTimePrecision"]) !== JSON.stringify(previousSpec?.["ApproximateCreationDateTimePrecision"])) this.logger.warn(maskSecrets(`Kinesis streaming ApproximateCreationDateTimePrecision change on ${tableName} was not applied (same stream ARN; precision-only updates are not yet supported)`));
 			return;
 		}
 		if (prevArn) {
@@ -16507,7 +16564,8 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -16525,24 +16583,24 @@ var DynamoDBTableProvider = class {
 			const live = liveIndexByName?.get(name);
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			if (live !== void 0 && live.IndexStatus !== "DELETING") {
-				this.logger.warn(`GSI ${name} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+				warn(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
 				const adopted = { IndexName: name };
 				let adoptedHasMember = false;
-				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
 					adopted.ProvisionedThroughput = gsi.ProvisionedThroughput;
 					adoptedHasMember = true;
 				}
-				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live);
+				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live, maskSecrets);
 				if (adoptedWarm) {
 					adopted.WarmThroughput = adoptedWarm;
 					adoptedHasMember = true;
 				}
 				if (adoptedHasMember) ops.push({ Update: adopted });
-				this.logger.warn(`GSI ${name} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
+				warn(`GSI ${maskSecrets(name)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
-			this.warnRefusedWarmThroughput(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
-			const createWarm = this.coerceWarmThroughputForSend(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
+			this.warnRefusedWarmThroughput(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
+			const createWarm = this.coerceWarmThroughputForSend(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
@@ -16558,12 +16616,12 @@ var DynamoDBTableProvider = class {
 			let updateHasMember = false;
 			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
 				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
-				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
 					update.ProvisionedThroughput = gsi.ProvisionedThroughput;
 					updateHasMember = true;
 				}
 			}
-			const warm = this.warmThroughputOpFor(name, physicalId, gsi, before, liveIndexByName?.get(name));
+			const warm = this.warmThroughputOpFor(name, physicalId, gsi, before, liveIndexByName?.get(name), maskSecrets);
 			if (warm) {
 				update.WarmThroughput = warm;
 				updateHasMember = true;
@@ -16583,10 +16641,11 @@ var DynamoDBTableProvider = class {
 	* two messages are disjoint by construction: this one fires only when
 	* something DID resolve.
 	*/
-	coerceWarmThroughputForSend(scope, value) {
+	coerceWarmThroughputForSend(scope, value, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
-		if (coerced.dropped.length > 0) this.logger.warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(value)} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
+		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
 		return coerced.spec;
 	}
 	/**
@@ -16604,14 +16663,14 @@ var DynamoDBTableProvider = class {
 	* is returned UNCHANGED — including the identity of the object, so the
 	* common case allocates nothing.
 	*/
-	coerceIndexWarmThroughputForCreate(logicalId, entry) {
+	coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const declared = entry["WarmThroughput"];
 		if (declared === void 0) return entry;
-		const scope = `GSI ${entry.IndexName ?? "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
-		const coerced = this.coerceWarmThroughputForSend(scope, declared);
+		const scope = `GSI ${entry.IndexName === void 0 ? "<unnamed>" : maskSecrets(entry.IndexName)} on AWS::DynamoDB::Table ${logicalId}`;
+		const coerced = this.coerceWarmThroughputForSend(scope, declared, maskSecrets);
 		if (coerced === void 0) {
-			this.warnRefusedWarmThroughput(scope, declared);
+			this.warnRefusedWarmThroughput(scope, declared, maskSecrets);
 			const { WarmThroughput: _dropped, ...rest } = entry;
 			return rest;
 		}
@@ -16632,9 +16691,10 @@ var DynamoDBTableProvider = class {
 	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
 	* for why those two are not this warning's business.
 	*/
-	warnRefusedWarmThroughput(scope, value) {
+	warnRefusedWarmThroughput(scope, value, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isRefusedWarmThroughput(value)) return;
-		this.logger.warn(`${scope}: the declared WarmThroughput ${JSON.stringify(value)} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
+		warn(`${scope}: the declared WarmThroughput ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
 	}
 	/**
 	* Should this per-index capacity `Update` be SKIPPED because the value is
@@ -16689,10 +16749,11 @@ var DynamoDBTableProvider = class {
 	*    `DescribeTable` reports for every index anyway, so there is no divergence
 	*    to hide.
 	*/
-	skipZeroCapacityIndexUpdate(indexName, physicalId, requested) {
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets = (text) => text) {
 		if (requested === void 0) return false;
 		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
-		this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		warn(`GSI ${maskSecrets(indexName)} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
 	/**
@@ -16721,20 +16782,23 @@ var DynamoDBTableProvider = class {
 	*    lower than current WarmThroughput, decreasing WarmThroughput is not
 	*    supported`.
 	*/
-	warmThroughputOpFor(indexName, physicalId, desired, previous, live) {
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const safeIndexName = maskSecrets(indexName);
 		const requested = desired.WarmThroughput;
 		if (previous !== void 0 && JSON.stringify(previous.WarmThroughput) === JSON.stringify(requested)) return;
-		const sendable = this.coerceWarmThroughputForSend(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+		const sendable = this.coerceWarmThroughputForSend(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
 		if (sendable === void 0) {
-			this.warnRefusedWarmThroughput(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+			this.warnRefusedWarmThroughput(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
 			return;
 		}
 		if (warmThroughputAlreadyMatches(sendable, live?.WarmThroughput)) {
-			this.logger.debug(`GSI ${indexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
+			debug(`GSI ${safeIndexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
 			return;
 		}
 		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
-			this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(sendable)} is lower than the ${JSON.stringify({
+			warn(`GSI ${safeIndexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(sendable)} is lower than the ${JSON.stringify({
 				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
 				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
 			})} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
@@ -16810,9 +16874,10 @@ var DynamoDBTableProvider = class {
 	* resource clean. The message therefore says the warning may be the only
 	* signal, and names both numbers so the template edit needs no second look.
 	*/
-	skipWarmThroughputDecrease(logicalId, physicalId, desired, live) {
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
-		this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(desired)} is lower than the ${JSON.stringify({
+		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(desired)} is lower than the ${JSON.stringify({
 			ReadUnitsPerSecond: live?.ReadUnitsPerSecond,
 			WriteUnitsPerSecond: live?.WriteUnitsPerSecond
 		})} DynamoDB currently holds for table ${physicalId}. Warm throughput only ever RISES with a table's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this resource still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline, so the next 'cdkd drift' reports this table clean (a 'cdkd drift --revert' records nothing and keeps reporting it). To make cdkd and AWS agree, set WarmThroughput to the value AWS holds (or remove the property, which AWS treats as keeping the last-set value).`);
@@ -17215,6 +17280,34 @@ const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 *    client. The shared helper `applyCrossRegionReplicaTagsDiff`
 *    centralizes the diff + best-effort WARN-on-failure contract.
 */
+/**
+* Mask every string LEAF (and every KEY) of a value before it is stringified
+* into a log line (issue #1932 item 3, adopted here by issue #1997).
+*
+* The INNER of the two masking layers `SecretMaskingContext` prescribes, and
+* neither layer subsumes the other. The outer one — routing the assembled
+* message through the masker — can only reach `maskSecretsInText`'s SUBSTRING
+* arm, which ignores needles below `MIN_NEEDLE_LENGTH` (4) and, more
+* importantly, never matches at all once `JSON.stringify` has escaped a `"`, a
+* `\` or a newline inside the value: the secret no longer OCCURS in the
+* finished line. Handing the masker each raw string reaches the WHOLE-VALUE arm
+* at any length and runs BEFORE any escaping. The mask is idempotent and matches
+* by value rather than by position, so the two layers compose.
+*
+* Walks rather than testing the top level, because a secret nested in an object
+* or array leaf is stringified — and escaped — identically. The sibling
+* `dynamodb-table-provider.ts` carries the same helper; it is duplicated rather
+* than shared because these two files deliberately hold no common module today
+* beyond the narrow rule modules (`dynamodb-warm-throughput.ts`,
+* `dynamodb-index-busy-delete.ts`), each of which exists for a MEASURED
+* divergence rather than for convenience.
+*/
+function maskLeafValue(value, maskSecrets) {
+	if (typeof value === "string") return maskSecrets(value);
+	if (Array.isArray(value)) return value.map((v) => maskLeafValue(v, maskSecrets));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue(v, maskSecrets)]));
+	return value;
+}
 var DynamoDBGlobalTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBGlobalTableProvider");
@@ -17400,6 +17493,8 @@ var DynamoDBGlobalTableProvider = class {
 	* command.
 	*/
 	async create(logicalId, resourceType, properties, context) {
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		this.logger.debug(`Creating DynamoDB GlobalTable ${logicalId}`);
 		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
 		const keySchema = properties["KeySchema"];
@@ -17417,7 +17512,7 @@ var DynamoDBGlobalTableProvider = class {
 			} } : {});
 			if (billingReplayWarn && properties["BillingMode"] === void 0) {
 				billingModeAbsentOnReplay = true;
-				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
+				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
 			}
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
@@ -17527,7 +17622,7 @@ var DynamoDBGlobalTableProvider = class {
 			toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics);
 			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {});
 		}
-		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName);
+		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName, maskSecrets);
 		try {
 			await this.dynamoDBClient.send(new CreateTableCommand(createParams));
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE`);
@@ -17547,7 +17642,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (!region || region === currentRegion) continue;
 				const replicaTags = replica["Tags"];
 				if (!replicaTags || replicaTags.length === 0) continue;
-				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, tableName);
+				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, tableName, maskSecrets);
 			}
 			if (properties["TimeToLiveSpecification"]) {
 				const ttl = properties["TimeToLiveSpecification"];
@@ -17562,9 +17657,9 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 			}
 			if (billingMode === "PROVISIONED") try {
-				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion);
+				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
-				this.logger.warn(`Auto-scaling registration failed for ${tableName}: ${autoScalingErr instanceof Error ? autoScalingErr.message : String(autoScalingErr)}. The table was created successfully; re-run the deploy to register the scaling targets.`);
+				warn(`Auto-scaling registration failed for ${tableName}: ${autoScalingErr instanceof Error ? autoScalingErr.message : String(autoScalingErr)}. The table was created successfully; re-run the deploy to register the scaling targets.`);
 			}
 			this.logger.debug(`Successfully created DynamoDB GlobalTable ${logicalId}: ${tableName}`);
 			return {
@@ -17578,7 +17673,7 @@ var DynamoDBGlobalTableProvider = class {
 				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (wiringError) {
-			this.logger.warn(`Wiring failed after CreateTable for ${tableName}; attempting best-effort cleanup`);
+			warn(`Wiring failed after CreateTable for ${tableName}; attempting best-effort cleanup`);
 			try {
 				const replicasForCleanup = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas ?? [];
 				for (const replica of replicasForCleanup) {
@@ -17591,14 +17686,12 @@ var DynamoDBGlobalTableProvider = class {
 						}));
 						await this.waitForReplicaGone(tableName, region, logicalId);
 					} catch (replicaCleanupErr) {
-						const msg = replicaCleanupErr instanceof Error ? replicaCleanupErr.message : String(replicaCleanupErr);
-						this.logger.warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${msg}. Run: aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName=${region}}' --region ${currentRegion}`);
+						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${replicaCleanupErr instanceof Error ? replicaCleanupErr.message : String(replicaCleanupErr)}. Run: aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName=${region}}' --region ${currentRegion}`);
 					}
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 			} catch (cleanupErr) {
-				const cleanupMsg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				this.logger.warn(`Partial-create cleanup failed for ${tableName}: ${cleanupMsg}. Run: aws dynamodb delete-table --table-name ${tableName} to remove the orphaned AWS-side table.`);
+				warn(`Partial-create cleanup failed for ${tableName}: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}. Run: aws dynamodb delete-table --table-name ${tableName} to remove the orphaned AWS-side table.`);
 			}
 			const cause = wiringError instanceof Error ? wiringError : void 0;
 			throw new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${wiringError instanceof Error ? wiringError.message : String(wiringError)}`, resourceType, logicalId, tableName, cause);
@@ -17613,13 +17706,14 @@ var DynamoDBGlobalTableProvider = class {
 	* useless. Kept as ONE formatter so the five translation call sites cannot
 	* word the same defect differently.
 	*/
-	reportThroughputDiagnostics(diagnostics, logicalId, physicalId) {
+	reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const seen = /* @__PURE__ */ new Set();
 		for (const diagnostic of diagnostics) {
-			const line = `DynamoDB GlobalTable ${logicalId}: ${diagnostic.indexName ? `GSI '${diagnostic.indexName}' on ${physicalId}` : physicalId}: ${diagnostic.message}`;
+			const line = `DynamoDB GlobalTable ${logicalId}: ${diagnostic.indexName ? `GSI '${maskSecrets(diagnostic.indexName)}' on ${physicalId}` : physicalId}: ${diagnostic.message}`;
 			if (seen.has(line)) continue;
 			seen.add(line);
-			this.logger.warn(line);
+			warn(line);
 		}
 	}
 	/**
@@ -17644,12 +17738,13 @@ var DynamoDBGlobalTableProvider = class {
 	* there is no template edit that "fixes" it other than raising a number the
 	* user never chose.
 	*/
-	warmThroughputForSend(indexName, desired, liveWarmByIndexName, logicalId, physicalId) {
+	warmThroughputForSend(indexName, desired, liveWarmByIndexName, logicalId, physicalId, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!desired) return void 0;
 		const live = liveWarmByIndexName.get(indexName);
 		if (!isWarmThroughputDecrease(desired, live)) return desired;
 		const format = (spec) => WARM_THROUGHPUT_MEMBERS.filter((m) => spec?.[m] !== void 0).map((m) => `${m}=${spec?.[m]}`).join(", ");
-		this.logger.warn(`DynamoDB GlobalTable ${logicalId}: GSI '${indexName}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
+		warn(`DynamoDB GlobalTable ${logicalId}: GSI '${maskSecrets(indexName)}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
 	}
 	/**
 	* Add a single replica region. Issues one `UpdateTableCommand` with
@@ -17717,8 +17812,11 @@ var DynamoDBGlobalTableProvider = class {
 	* should catch these as REPLACEMENT before ever calling `update()`,
 	* but the guard is defense-in-depth.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating DynamoDB GlobalTable ${logicalId}: ${physicalId}`);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		debug(`Updating DynamoDB GlobalTable ${logicalId}: ${maskSecrets(physicalId)}`);
 		if (properties["TableName"] !== void 0 && previousProperties["TableName"] !== void 0 && properties["TableName"] !== previousProperties["TableName"]) throw new ProvisioningError(`TableName is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
 		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual$1(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
 		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
@@ -17730,7 +17828,7 @@ var DynamoDBGlobalTableProvider = class {
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		let effectiveProperties;
 		try {
-			await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+			await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
 			const extractLocalTags = (props) => {
@@ -17756,12 +17854,12 @@ var DynamoDBGlobalTableProvider = class {
 			const desiredDeclaresBillingMode = properties["BillingMode"] !== void 0;
 			const seedAbsentFromLive = recordedOldBillingAbsent && desiredDeclaresBillingMode;
 			const oldBilling = recordedOldBillingUsable ? recordedOldBilling : recordedOldBillingAbsent ? seedAbsentFromLive ? liveBillingMode : "PAY_PER_REQUEST" : liveBillingMode;
-			if (!recordedOldBillingUsable && !recordedOldBillingAbsent) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
-			if (seedAbsentFromLive && oldBilling !== "PAY_PER_REQUEST") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the cdkd state record declares no BillingMode — using ${oldBilling} as the comparison baseline for this update (${reportedBillingMode !== void 0 ? "the mode DescribeTable reports" : "inferred: DescribeTable reports no BillingModeSummary, which means the table was created without an explicit mode"}), so a template declaring a different mode still applies the flip instead of comparing equal to the create-path default.`);
+			if (!recordedOldBillingUsable && !recordedOldBillingAbsent) warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(maskLeafValue(recordedOldBilling, maskSecrets))}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			if (seedAbsentFromLive && oldBilling !== "PAY_PER_REQUEST") warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the cdkd state record declares no BillingMode — using ${oldBilling} as the comparison baseline for this update (${reportedBillingMode !== void 0 ? "the mode DescribeTable reports" : "inferred: DescribeTable reports no BillingModeSummary, which means the table was created without an explicit mode"}), so a template declaring a different mode still applies the flip instead of comparing equal to the create-path default.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
-				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The mode this update compared against (${oldBilling}) is kept for this update rather than flipped to the default.`);
+				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The mode this update compared against (${oldBilling}) is kept for this update rather than flipped to the default.`);
 			} });
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
@@ -17772,12 +17870,12 @@ var DynamoDBGlobalTableProvider = class {
 			let desiredGsiUnusable = false;
 			const onUnusableGsiBlock = (message) => {
 				desiredGsiUnusable = true;
-				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
+				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
 			};
 			let previousGsiUnusable = false;
 			const onUnusablePreviousGsiBlock = (message) => {
 				previousGsiUnusable = true;
-				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
+				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
 			};
 			const liveIndexNames = new Set((describeResp.Table?.GlobalSecondaryIndexes ?? []).map((live) => live.IndexName).filter((name) => typeof name === "string"));
 			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock);
@@ -17788,14 +17886,14 @@ var DynamoDBGlobalTableProvider = class {
 				toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, diagnostics);
 				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {});
 			}
-			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId);
+			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets);
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
 			const oldDpe = extractLocalDeletionProtection(previousProperties, currentRegion);
 			const awsDpe = describeResp.Table?.DeletionProtectionEnabled;
 			const flatUpdate = { TableName: physicalId };
 			let flatChanged = false;
 			if (newDpe !== oldDpe || newDpe !== void 0 && typeof awsDpe === "boolean" && Boolean(newDpe) !== awsDpe) {
-				if ((oldDpe === true || awsDpe === true) && Boolean(newDpe ?? false) === false && !(newDpe !== void 0)) this.logger.warn(`Auto-disabling DeletionProtectionEnabled on ${physicalId}: the CDK code does not set 'deletionProtection: true' but AWS has it enabled. AWS will accept DeleteTable on this resource after this deploy. If you meant to keep protection on, set 'deletionProtection: true' in your CDK code; if you meant to disable it explicitly, set 'deletionProtection: false' to silence this warning.`);
+				if ((oldDpe === true || awsDpe === true) && Boolean(newDpe ?? false) === false && !(newDpe !== void 0)) warn(`Auto-disabling DeletionProtectionEnabled on ${physicalId}: the CDK code does not set 'deletionProtection: true' but AWS has it enabled. AWS will accept DeleteTable on this resource after this deploy. If you meant to keep protection on, set 'deletionProtection: true' in your CDK code; if you meant to disable it explicitly, set 'deletionProtection: false' to silence this warning.`);
 				flatUpdate.DeletionProtectionEnabled = Boolean(newDpe ?? false);
 				flatChanged = true;
 			}
@@ -17815,7 +17913,7 @@ var DynamoDBGlobalTableProvider = class {
 				let streamSpecUnusable = false;
 				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
 					streamSpecUnusable = true;
-					this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
+					warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
 				} });
 				if (!streamSpecUnusable) {
 					flatUpdate.StreamSpecification = {
@@ -17867,7 +17965,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			if (flatChanged) {
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (oldBilling !== newBilling) {
@@ -17896,7 +17994,7 @@ var DynamoDBGlobalTableProvider = class {
 						const gsi = byIndexName.get(indexName);
 						if (!gsi?.ProvisionedThroughput) continue;
 						const previousWarm = previousByIndexName.get(indexName)?.WarmThroughput;
-						const warmToSend = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm) ? this.warmThroughputForSend(indexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId) : void 0;
+						const warmToSend = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm) ? this.warmThroughputForSend(indexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId, maskSecrets) : void 0;
 						indexUpdates.push({ Update: {
 							IndexName: indexName,
 							ProvisionedThroughput: gsi.ProvisionedThroughput,
@@ -17907,21 +18005,21 @@ var DynamoDBGlobalTableProvider = class {
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			if (deferCeilingsPastFlip) {
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					OnDemandThroughput: onDemandPayload
 				}));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
 			const autoScalingApplied = /* @__PURE__ */ new Set();
 			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(writeAutoScalingOld, effectiveNewAutoScaling)) {
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling, void 0, void 0, void 0, maskSecrets);
 				autoScalingApplied.add(autoScalingTargetKey({
 					dimension: "dynamodb:table:WriteCapacityUnits",
 					region: currentRegion
@@ -17934,7 +18032,7 @@ var DynamoDBGlobalTableProvider = class {
 				const removedReadAutoScaling = (replica["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
 				if (removedReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", removedReadAutoScaling, void 0, regionalAutoScalingClient);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", removedReadAutoScaling, void 0, regionalAutoScalingClient, void 0, void 0, maskSecrets);
 					autoScalingApplied.add(autoScalingTargetKey({
 						dimension: "dynamodb:table:ReadCapacityUnits",
 						region
@@ -17951,11 +18049,11 @@ var DynamoDBGlobalTableProvider = class {
 				if (!region || region === currentRegion) continue;
 				await this.addReplica(physicalId, replica, region, logicalId, newBilling);
 				const newReplicaTags = replica["Tags"];
-				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, void 0, newReplicaTags, physicalId);
+				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, void 0, newReplicaTags, physicalId, maskSecrets);
 				const newReadAutoScaling = (replica["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
 				if (newBilling === "PROVISIONED" && newReadAutoScaling) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", void 0, newReadAutoScaling, regionalAutoScalingClient);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", void 0, newReadAutoScaling, regionalAutoScalingClient, void 0, void 0, maskSecrets);
 					autoScalingApplied.add(autoScalingTargetKey({
 						dimension: "dynamodb:table:ReadCapacityUnits",
 						region
@@ -17968,13 +18066,13 @@ var DynamoDBGlobalTableProvider = class {
 				const oldReplica = (previousProperties["Replicas"] ?? []).find((r) => r["Region"] === region);
 				const oldReplicaTags = oldReplica?.["Tags"];
 				const newReplicaTags = replica["Tags"];
-				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, oldReplicaTags, newReplicaTags, physicalId);
+				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, oldReplicaTags, newReplicaTags, physicalId, maskSecrets);
 				const oldReadAutoScaling = (oldReplica?.["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
 				const newReadAutoScaling = (replica["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
 				const effectiveNewReadAutoScaling = newBilling === "PAY_PER_REQUEST" ? void 0 : newReadAutoScaling;
 				if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual$1(oldReadAutoScaling, effectiveNewReadAutoScaling)) {
 					const regionalAutoScalingClient = this.getRegionalAutoScalingClient(region);
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", oldReadAutoScaling, effectiveNewReadAutoScaling, regionalAutoScalingClient);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", oldReadAutoScaling, effectiveNewReadAutoScaling, regionalAutoScalingClient, void 0, void 0, maskSecrets);
 					autoScalingApplied.add(autoScalingTargetKey({
 						dimension: "dynamodb:table:ReadCapacityUnits",
 						region
@@ -17992,7 +18090,7 @@ var DynamoDBGlobalTableProvider = class {
 					const droppedOverrides = [];
 					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
-					if (droppedOverrides.length > 0) this.logger.warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
+					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
@@ -18014,7 +18112,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (previousGsiUnusable) {
 				const desiredNames = new Set(desiredSdkIndexes.map((gsi) => gsi.IndexName).filter((name) => typeof name === "string"));
 				const liveOnly = [...liveIndexNames].filter((name) => !desiredNames.has(name));
-				if (liveOnly.length > 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them, and an index delete is irreversible. This does NOT self-heal, and no later cdkd deploy will remove them: delete the index directly, e.g. aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"<name>"}}]'.`);
+				if (liveOnly.length > 0) warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.map((n) => maskSecrets(n)).join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them, and an index delete is irreversible. This does NOT self-heal, and no later cdkd deploy will remove them: delete the index directly, e.g. aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"<name>"}}]'.`);
 			}
 			const gsiDiff = desiredGsiUnusable ? {
 				added: [],
@@ -18031,11 +18129,11 @@ var DynamoDBGlobalTableProvider = class {
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
 				}));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			for (const gsi of gsiDiff.added) {
 				if (!gsi.IndexName || !gsi.KeySchema || !gsi.Projection) continue;
-				const addedWarmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
+				const addedWarmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId, maskSecrets);
 				const gsiUpdate = { Create: {
 					IndexName: gsi.IndexName,
 					KeySchema: gsi.KeySchema,
@@ -18049,7 +18147,7 @@ var DynamoDBGlobalTableProvider = class {
 					AttributeDefinitions: newAttrs,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
 				}));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			for (const gsi of gsiDiff.modified) {
 				if (typeof gsi.IndexName !== "string" || gsi.IndexName.length === 0) continue;
@@ -18071,12 +18169,12 @@ var DynamoDBGlobalTableProvider = class {
 				const previousSdk = previousSdkByName.get(gsi.IndexName);
 				let warmDecreaseRefused = false;
 				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) {
-					const warmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
+					const warmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId, maskSecrets);
 					if (warmToSend) update.WarmThroughput = warmToSend;
 					else warmDecreaseRefused = true;
 				}
 				if (!update.ProvisionedThroughput && !update.OnDemandThroughput && !update.WarmThroughput) {
-					if (!billingFlipped && unresolvedMembers.length === 0 && !warmDecreaseRefused) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
+					if (!billingFlipped && unresolvedMembers.length === 0 && !warmDecreaseRefused) warn(`GSI '${maskSecrets(gsi.IndexName ?? "")}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
 					continue;
 				}
 				const gsiUpdate = { Update: update };
@@ -18084,14 +18182,14 @@ var DynamoDBGlobalTableProvider = class {
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
 				}));
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			const skipAutoScalingForUnusableGsi = desiredGsiUnusable && newBilling !== "PAY_PER_REQUEST";
 			const autoScalingMeaningfulForIndexes = (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !skipAutoScalingForUnusableGsi;
-			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
+			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
 			if (autoScalingMeaningfulForIndexes) {
 				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId);
-				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied);
+				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied, maskSecrets);
 			}
 			if (!deepEqual$1(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
@@ -18172,22 +18270,23 @@ var DynamoDBGlobalTableProvider = class {
 	* No-op when `oldTags` deep-equals `newTags` — the caller is allowed
 	* to invoke unconditionally without first diffing.
 	*/
-	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, physicalIdForLogs) {
+	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, physicalIdForLogs, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (deepEqual$1(oldTags, newTags)) return;
 		if (!tableArn) {
-			this.logger.warn(`Local DescribeTable returned no TableArn — cannot propagate Tags to cross-region replica ${region} of ${physicalIdForLogs}`);
+			warn(`Local DescribeTable returned no TableArn — cannot propagate Tags to cross-region replica ${region} of ${physicalIdForLogs}`);
 			return;
 		}
 		const replicaArn = this.replicaArnForRegion(tableArn, region);
 		if (!replicaArn) {
-			this.logger.warn(`Could not derive replica ARN for region ${region} from ${tableArn} — skipping Tags propagation for ${physicalIdForLogs}`);
+			warn(`Could not derive replica ARN for region ${region} from ${tableArn} — skipping Tags propagation for ${physicalIdForLogs}`);
 			return;
 		}
 		try {
 			const regionalClient = this.getRegionalClient(region);
 			await this.applyTagDiffOnClient(regionalClient, replicaArn, oldTags, newTags);
 		} catch (tagErr) {
-			this.logger.warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}. The replica's Tags state will surface as drift until the next successful deploy.`);
+			warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}. The replica's Tags state will surface as drift until the next successful deploy.`);
 		}
 	}
 	/**
@@ -18264,7 +18363,8 @@ var DynamoDBGlobalTableProvider = class {
 	* create-only field with no corresponding `RegisterScalableTarget`
 	* surface; `readAutoScalingSettings` also explicitly skips it.
 	*/
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget) {
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
 		const resourceId = autoScalingResourceId(tableName, indexName);
@@ -18277,7 +18377,7 @@ var DynamoDBGlobalTableProvider = class {
 			const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
 			const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
 			if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-				this.logger.warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${String(newSettings["MinCapacity"])} / ${String(newSettings["MaxCapacity"])}`);
+				warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
 				return;
 			}
 			try {
@@ -18293,13 +18393,13 @@ var DynamoDBGlobalTableProvider = class {
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 			} catch (err) {
-				this.logger.warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
+				warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
 				return;
 			}
 			const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
 			const targetValue = Number(tttCfg["TargetValue"]);
 			if (!Number.isFinite(targetValue)) {
-				this.logger.warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
+				warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
 				return;
 			}
 			const targetTrackingConfig = {
@@ -18324,7 +18424,7 @@ var DynamoDBGlobalTableProvider = class {
 				});
 				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
 			} catch (err) {
-				this.logger.warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
 			}
 			return;
 		}
@@ -18346,7 +18446,7 @@ var DynamoDBGlobalTableProvider = class {
 				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 			});
 		} catch (err) {
-			if (!isObjectNotFound(err)) this.logger.warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+			if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 		}
 		try {
 			await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
@@ -18360,7 +18460,7 @@ var DynamoDBGlobalTableProvider = class {
 			});
 			this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 		} catch (err) {
-			if (!isObjectNotFound(err)) this.logger.warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+			if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 		}
 	}
 	/**
@@ -18466,7 +18566,7 @@ var DynamoDBGlobalTableProvider = class {
 	* skipped. When the probe fails, presence is unknown and everything is
 	* upserted — the correct direction to fail.
 	*/
-	async reconcileAutoScalingTargets(tableName, previousSpecs, desiredSpecs, localRegion, alreadyApplied = /* @__PURE__ */ new Set()) {
+	async reconcileAutoScalingTargets(tableName, previousSpecs, desiredSpecs, localRegion, alreadyApplied = /* @__PURE__ */ new Set(), maskSecrets = (text) => text) {
 		const previousSpecsToUse = previousSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
 		const desiredSpecsToUse = desiredSpecs.filter((s) => !alreadyApplied.has(autoScalingTargetKey(s)));
 		const previousByKey = /* @__PURE__ */ new Map();
@@ -18479,12 +18579,12 @@ var DynamoDBGlobalTableProvider = class {
 			const previous = previousByKey.get(key);
 			if (registered?.has(key) && previous !== void 0 && deepEqual$1(previous.settings, spec.settings)) continue;
 			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
-			await this.applyAutoScalingDiff(tableName, spec.dimension, previous?.settings, spec.settings, client, spec.indexName);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, previous?.settings, spec.settings, client, spec.indexName, void 0, maskSecrets);
 		}
 		for (const [key, spec] of previousByKey) {
 			if (handled.has(key)) continue;
 			const client = await this.autoScalingClientForRegion(spec.region, localRegion);
-			await this.applyAutoScalingDiff(tableName, spec.dimension, spec.settings, void 0, client, spec.indexName);
+			await this.applyAutoScalingDiff(tableName, spec.dimension, spec.settings, void 0, client, spec.indexName, void 0, maskSecrets);
 		}
 	}
 	/**
@@ -19171,7 +19271,7 @@ var DynamoDBGlobalTableProvider = class {
 	* rejection as the backstop, which is the behavior it had before #1521 for
 	* every case except the one the wait exists to fix.
 	*/
-	async waitForTableActiveAfterUpdate(tableName, logicalId, maxAttempts = 600, budget) {
+	async waitForTableActiveAfterUpdate(tableName, logicalId, maxAttempts = 600, budget, maskSecrets = (text) => text) {
 		const wait = beginDeleteWait(maxAttempts, budget);
 		let tableReachedActive = false;
 		while (wait.nextPoll()) {
@@ -19184,10 +19284,10 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		const budgetNote = wait.note();
 		if (tableReachedActive) {
-			this.logger.warn(`Indexes on ${tableName} (${logicalId}) were still transitioning after ${wait.pollsRun}s — a large index backfill can outlive this wait. Proceeding; AWS rejects the next call if it is still too early.${budgetNote}`);
+			this.logger.warn(maskSecrets(`Indexes on ${tableName} (${logicalId}) were still transitioning after ${wait.pollsRun}s — a large index backfill can outlive this wait. Proceeding; AWS rejects the next call if it is still too early.${budgetNote}`));
 			return;
 		}
-		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${wait.pollsRun}s after UpdateTable${budgetNote}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(maskSecrets(`Table ${tableName} did not reach ACTIVE within ${wait.pollsRun}s after UpdateTable${budgetNote}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
 	* Wait until every GSI reports `IndexStatus: ACTIVE` (Issue #1419).
@@ -28277,11 +28377,19 @@ var ApiGatewayV2Provider = class {
 		if (!this.client) this.client = new ApiGatewayV2Client(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	/**
+	* The `context` parameter is read for ONE thing today: `maskSecrets` (issue
+	* #1932 item 3, adopted here by issue #1997). `createIntegration` is the only
+	* arm that interpolates a RESOLVED property value into a log line, so it is
+	* the only arm the masker is threaded into; the rest name nothing but the
+	* logical id. Read defensively — `create()` is also called by the import path
+	* and by tests, neither of which supplies a context.
+	*/
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.createApi(logicalId, resourceType, properties);
 			case "AWS::ApiGatewayV2::Stage": return this.createStage(logicalId, resourceType, properties);
-			case "AWS::ApiGatewayV2::Integration": return this.createIntegration(logicalId, resourceType, properties);
+			case "AWS::ApiGatewayV2::Integration": return this.createIntegration(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ApiGatewayV2::Route": return this.createRoute(logicalId, resourceType, properties);
 			case "AWS::ApiGatewayV2::Authorizer": return this.createAuthorizer(logicalId, resourceType, properties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
@@ -28297,12 +28405,19 @@ var ApiGatewayV2Provider = class {
 	* on Api; `StageName` on Stage) are not part of the Update input shape
 	* and are handled by the deploy engine's immutable-property
 	* replacement path.
+	*
+	* The `context` parameter mirrors {@link create}'s: read only for
+	* `maskSecrets`, and only `updateIntegration` needs it. The update path
+	* carries the same RESOLVED bag as the create path, so the masking
+	* requirement is identical on both — a masker present on one and absent from
+	* the other is not a partial fix, it is a fix with a hole in the shape of
+	* whichever path a given deploy takes.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
@@ -28433,7 +28548,7 @@ var ApiGatewayV2Provider = class {
 	getStageAttribute(physicalId, attributeName) {
 		if (attributeName === "StageName") return physicalId;
 	}
-	async createIntegration(logicalId, resourceType, properties) {
+	async createIntegration(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating API Gateway V2 Integration ${logicalId}`);
 		const apiId = properties["ApiId"];
 		const integrationType = properties["IntegrationType"];
@@ -28456,7 +28571,7 @@ var ApiGatewayV2Provider = class {
 				IntegrationSubtype: properties["IntegrationSubtype"],
 				PassthroughBehavior: properties["PassthroughBehavior"],
 				RequestTemplates: properties["RequestTemplates"],
-				ResponseParameters: this.toSdkResponseParameters(properties["ResponseParameters"]),
+				ResponseParameters: this.toSdkResponseParameters(properties["ResponseParameters"], maskSecrets),
 				TemplateSelectionExpression: properties["TemplateSelectionExpression"],
 				TlsConfig: properties["TlsConfig"]
 			}))).IntegrationId;
@@ -28999,7 +29114,7 @@ var ApiGatewayV2Provider = class {
 	* `RequestTemplates` / `ResponseParameters` / `TemplateSelectionExpression`
 	* / `TlsConfig`).
 	*/
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -29075,7 +29190,7 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		if (properties["ResponseParameters"] != null && !this.deepEqual(properties["ResponseParameters"], previousProperties["ResponseParameters"])) {
-			input.ResponseParameters = this.toSdkResponseParameters(properties["ResponseParameters"]);
+			input.ResponseParameters = this.toSdkResponseParameters(properties["ResponseParameters"], maskSecrets);
 			changed = true;
 		}
 		if (properties["TemplateSelectionExpression"] != null && properties["TemplateSelectionExpression"] !== previousProperties["TemplateSelectionExpression"]) {
@@ -29475,8 +29590,25 @@ var ApiGatewayV2Provider = class {
 	* Skipping it would re-introduce the silent drop this method exists to close.
 	* A `Destination` is never coerced — it becomes an SDK map KEY, and a
 	* non-string there is a malformed template, not a scalar shorthand.
-	*/
-	toSdkResponseParameters(value) {
+	*
+	* `maskSecrets` is the caller's secret masker (issue #1932 item 3, adopted
+	* here by issue #1997), threaded from `CreateContext` / `UpdateContext` via
+	* `createIntegration` / `updateIntegration`. The warning below names the
+	* offending `Destination` / `Source`, which come out of the RESOLVED
+	* `properties` bag — a `{{resolve:secretsmanager:...}}` scalar is plaintext by
+	* the time a provider sees it, and neither the deploy engine's error text nor
+	* the resolver's debug line covers a provider's own `logger.warn`. It defaults
+	* to IDENTITY so `readCurrentState`'s inverse mapper and every unit test keep
+	* working unchanged.
+	*/
+	toSdkResponseParameters(value, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const maskLeaf = (value) => {
+			if (typeof value === "string") return maskSecrets(value);
+			if (Array.isArray(value)) return value.map(maskLeaf);
+			if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
+			return value;
+		};
 		if (value == null) return void 0;
 		if (typeof value !== "object" || Array.isArray(value)) return value;
 		const out = {};
@@ -29496,7 +29628,7 @@ var ApiGatewayV2Provider = class {
 				const source = entry != null && typeof entry === "object" && !Array.isArray(entry) ? entry["Source"] : void 0;
 				const coerced = typeof source === "string" ? source : typeof source === "number" || typeof source === "boolean" ? String(source) : void 0;
 				if (typeof destination !== "string" || coerced === void 0) {
-					this.logger.warn(`AWS::ApiGatewayV2::Integration ResponseParameters['${statusCode}'] has an entry cdkd cannot deliver (Destination must be a string and Source a string / number / boolean; got ${JSON.stringify(destination)} / ${JSON.stringify(source)}); skipping that entry.`);
+					warn(`AWS::ApiGatewayV2::Integration ResponseParameters['${maskSecrets(statusCode)}'] has an entry cdkd cannot deliver (Destination must be a string and Source a string / number / boolean; got ${JSON.stringify(maskLeaf(destination))} / ${JSON.stringify(maskLeaf(source))}); skipping that entry.`);
 					continue;
 				}
 				mapped[destination] = coerced;
@@ -40034,8 +40166,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
-	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
-	if (request.MfaConfiguration === "OFF" && anyFactorBlock) warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. AWS REJECTS that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so this deploy FAILS rather than producing a pool with MFA disabled. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
+	const anyFactorBlock = hasAnyMfaFactorBlock(request);
 	const maskDeep = (v, depth = 0) => {
 		if (typeof v === "string") return maskSecrets(v);
 		if (depth >= MASK_WALK_MAX_DEPTH) return v;
@@ -40046,7 +40177,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskDeep(f)) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskDeep(properties["EnabledMfas"]))} (not a list)`);
 	if (dropped.length > 0) {
-		const consequence = request.MfaConfiguration === "OFF" && anyFactorBlock ? "MfaConfiguration is OFF while another factor block IS sent, so AWS REJECTS this call outright and the deploy fails" : request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
+		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
@@ -40075,6 +40206,248 @@ function resolveSentMfaConfiguration(properties, declaredMfaConfiguration) {
 	return declaredMfaConfiguration || void 0;
 }
 /**
+* "This `SetUserPoolMfaConfig` request carries an MFA FACTOR sub-block."
+*
+* ONE definition, shared by `buildMfaConfigRequest`'s dropped-entry warning and
+* by the pre-flight refusal below, so the message and the refusal cannot
+* disagree about the same request. It is precisely
+* `{Sms, SoftwareToken, Email}MfaConfiguration` -- `WebAuthnConfiguration` is
+* deliberately NOT a member, because WebAuthn is not an MFA factor and rides
+* alongside `MfaConfiguration: OFF` on every passkey-only pool (issue #1920).
+*/
+function hasAnyMfaFactorBlock(request) {
+	return request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+}
+/**
+* The `Policies.SignInPolicy.AllowedFirstAuthFactors` members AWS refuses to
+* combine with MFA (issue #1975).
+*
+* A DENY-list, deliberately, even though the AWS message states an ALLOW-list
+* ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth
+* factor if MFA is enabled"). Written from the allow-list, a member AWS adds
+* LATER would be refused by cdkd on the day it starts working -- the same
+* reason the unrecognized-`EnabledMfas` case in `buildMfaConfigRequest` warns
+* rather than throws, since that set is a hardcoded mirror of an AWS enum. The
+* cost of the deny-list is the reverse and is the cheaper one: a future
+* incompatible factor is simply not pre-flighted, which is the pre-#1975
+* behavior (a loud AWS rejection), not a regression.
+*
+* The two members ARE the whole of today's `AuthFactorType` enum outside the
+* allowed pair (`EMAIL_OTP`, `PASSWORD`, `SMS_OTP`, `WEB_AUTHN` --
+* `@aws-sdk/client-cognito-identity-provider`), so the deny-list and the
+* allow-list agree on every value that exists right now.
+*
+* BOTH members are MEASURED (us-east-1, 2026-08-19, issue #1975) -- neither is
+* extrapolated from the other, which is the failure mode this file's own
+* unrecognized-factor comment warns about:
+*
+*   [PASSWORD, EMAIL_OTP] + SetUserPoolMfaConfig(ON) -> REJECTED
+*   [PASSWORD, SMS_OTP]   + SetUserPoolMfaConfig(ON) -> REJECTED, same message
+*
+* The `SMS_OTP` probe needed a precondition worth recording, because without it
+* the interesting call is never reached: on a pool with NO `SmsConfiguration`,
+* `CreateUserPool` refuses the factor outright ("SMS_OTP can not be configured
+* as AuthFactor as user pool is missing valid SMS configuration"), so the probe
+* had to stand up an SNS-caller IAM role + ExternalId first. That earlier,
+* different refusal is AWS's own and is NOT something this pre-flight
+* duplicates.
+*
+* Typed `satisfies AuthFactorType[]` rather than left as `string[]`: the values
+* mirror an SDK enum, so a rename upstream should be a COMPILE error here
+* rather than a silently-never-matching deny-list.
+*/
+const MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS = ["EMAIL_OTP", "SMS_OTP"];
+/**
+* `Policies.SignInPolicy.AllowedFirstAuthFactors` as a list of STRINGS, or an
+* empty list when the template declares nothing usable there.
+*
+* Every mis-shape reads as ABSENT rather than as a violation: this feeds a
+* REFUSAL, so guessing at a container cdkd could not read would block a deploy
+* over a value it never understood. A genuinely broken `Policies` blob is AWS's
+* to reject, with its own message.
+*
+* The two containers are traversed with `?.` rather than with the
+* `typeof x === 'object' && !Array.isArray(x)` guard `config-shape.ts` uses,
+* and that is deliberate rather than sloppy: those guards are load-bearing
+* THERE because the helper REFUSES a non-object, while here the only outcome is
+* "no factors", which is exactly what indexing a string / number / array
+* already yields. The version carrying them was written first and MEASURED
+* inert -- deleting either clause failed no test and could not be made to,
+* since no template value indexes to anything at those keys. `?.` keeps the one
+* behaviour that is real (a declared `null` throws on a bare index) and leaves
+* nothing unfalsifiable behind.
+*
+* The two filters below are NOT the same kind of thing, and saying so matters
+* because an earlier revision of this comment claimed both were load-bearing and
+* "each fenced by a test" -- which was false for one of them, and a false fence
+* claim is what stops the next reader re-checking.
+*
+*  - `Array.isArray` is a RUNTIME guard and IS fenced: without it a scalar
+*    `AllowedFirstAuthFactors: 'EMAIL_OTP'` is read as a declaration and
+*    refused, and the test for that shape reds when it is dropped.
+*  - The string filter is a TYPE NARROWING and is INERT at runtime. `includes`
+*    compares by SameValueZero, so a non-string member can never equal a
+*    deny-list entry however it is spelled; deleting the filter fails NO test,
+*    and no test could be written that it would fail. It earns its place by
+*    giving the caller a `string[]`, and by keeping this function honest if a
+*    future caller ever COERCES a member instead of comparing it. The
+*    nested-list case in the suite fences that hypothetical `String(member)`
+*    implementation -- i.e. the mistake, not this code.
+*/
+function readAllowedFirstAuthFactors(properties) {
+	const factors = (properties["Policies"]?.["SignInPolicy"])?.["AllowedFirstAuthFactors"];
+	if (!Array.isArray(factors)) return [];
+	return factors.filter((factor) => typeof factor === "string");
+}
+/**
+* The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
+* all, or `undefined` when nothing is known to refuse it.
+*
+* Two rules, both for combinations AWS rejects 100% of the time, and both
+* raised BEFORE the first AWS call on BOTH the create and the update path. The
+* ordering is what makes them worth refusing rather than warning about: on the
+* UPDATE path `UpdateUserPool` lands FIRST and `SetUserPoolMfaConfig` is
+* refused afterwards, so sending the request leaves a PARTIAL APPLY behind --
+* with the security-relevant half being the half that did NOT apply (the MFA
+* configuration), while the half that did is the one loosening authentication.
+* Nothing unwinds it, and a retry cannot succeed until the user reverse-engineers
+* an AWS-worded error about a field they did not think they were changing.
+*
+* Rule 1 (issue #1977) -- `MfaConfiguration` resolves to OFF while the request
+* carries an MFA factor block. MEASURED us-east-1 2026-08-19 (issue #1968):
+*
+*   {ON,  SoftwareTokenMfaConfiguration: {Enabled: true}}   -> ACCEPTED (control)
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: true}}   -> rejected
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: false}}  -> rejected
+*   {OFF, EmailMfaConfiguration: {Message, Subject}}        -> rejected
+*
+* all with `InvalidParameterException: Invalid MFA configuration given, can't
+* turn off MFA and configure an MFA together`. The `Enabled: false` arm settles
+* the KEY: a block that enables NOTHING is still refused, so the rule is about
+* the block's PRESENCE -- exactly what `hasAnyMfaFactorBlock` tests -- and
+* since that predicate is precisely the three factor sub-blocks, no accepted
+* case survives. (Bound on the Email arm: an OPTIONAL control with that block
+* failed with a DIFFERENT error, "Cannot set EmailMfaConfiguration when user
+* pool EmailConfiguration contains an EmailSendingAccount of COGNITO_DEFAULT",
+* so it has no isolated control of its own -- informative in itself, since it
+* shows the exclusion is evaluated BEFORE the email-sending-account check.)
+*
+* Rule 2 (issue #1975) -- the `SetUserPoolMfaConfig` request resolves
+* `MfaConfiguration` to ON while `Policies.SignInPolicy.AllowedFirstAuthFactors`
+* allows `EMAIL_OTP` or `SMS_OTP`. AWS refuses with `Only PASSWORD and WEB_AUTHN
+* (if configured) can be enabled as an auth factor if MFA is enabled`. MEASURED
+* us-east-1 2026-08-19, both members and both MFA modes:
+*
+*   {[PASSWORD, EMAIL_OTP], ON}       -> rejected
+*   {[PASSWORD, EMAIL_OTP], OPTIONAL} -> ACCEPTED
+*   {[PASSWORD, SMS_OTP],   ON}       -> rejected (pool WITH a valid SmsConfiguration)
+*   {[PASSWORD, SMS_OTP],   OPTIONAL} -> ACCEPTED
+*
+* So `=== 'ON'` is MEASURED-CORRECT rather than merely conservative: OPTIONAL is
+* ACCEPTED, and widening this to `!== 'OFF'` would REFUSE A WORKING DEPLOY. An
+* earlier revision of this comment called OPTIONAL unmeasured; it is not, and
+* the measurement is what settles the narrowing rather than a cost argument.
+*
+* WHY THE MESSAGE DOES NOT OFFER `WEB_AUTHN` AS THE ESCAPE HATCH, even though
+* AWS's own error text names it as accepted. MEASURED us-east-1 2026-08-20: a
+* pool allowing `WEB_AUTHN` as a first auth factor is REJECTED by
+* `SetUserPoolMfaConfig(ON, SoftwareTokenMfa)` --
+*
+*   InvalidParameterException: Cannot set WebAuthn factor configuration to
+*   SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor
+*
+* -- with NO WebAuthn block at all, with `UserVerification: preferred`, and with
+* `required`. The only accepted shape is
+* `WebAuthnConfiguration.FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION`,
+* and the PINNED SDK (`@aws-sdk/client-cognito-identity-provider` 3.1018.0)
+* does not carry that field -- `WebAuthnConfigurationType` is exactly
+* `{RelyingPartyId?, UserVerification?}` -- so cdkd cannot reach it today.
+* Telling the user to switch to `WEB_AUTHN` would therefore be advice that
+* cannot be followed, which is why the remedy names removing the factor or
+* lowering `MfaConfiguration` instead.
+*
+* That same measurement means `WEB_AUTHN` + ON reproduces this very
+* partial-apply shape while NOT being on the deny-list. Deliberately left
+* uncovered: the correct rule there is CONDITIONAL on
+* `WebAuthnConfiguration.FactorConfiguration`, which the pinned SDK cannot
+* express, so a flat deny-list entry would be an OVER-REFUSAL of the shape that
+* becomes valid the moment the SDK gains the field. Tracked as issue #2064.
+*
+* SCOPE LIMIT, deliberate and load-bearing: rule 2 fires only when a
+* `SetUserPoolMfaConfig` request is actually BUILT (`hasMfaConfigProps`), i.e.
+* the template declares `EnabledMfas` / an email-OTP message or subject /
+* WebAuthn. With NONE of those, `MfaConfiguration` rides on the SINGLE
+* `CreateUserPool` / `UpdateUserPool` call and no second call follows -- so
+* there is no two-call window and structurally NOTHING to partly apply, which
+* is the entire harm this pre-flight exists to prevent. Refusing there would
+* ALSO be an over-refusal on a shape AWS accepts: a pool created with
+* `AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]` and no MFA configuration
+* call at all is ACCEPTED (measured, same session -- the pool came up fine and
+* only the later `SetUserPoolMfaConfig(ON)` failed). Such a template is left to
+* AWS, which answers it atomically.
+*
+* CLOUDFORMATION PARITY, settled by A/B rather than assumed -- both issues made
+* this an explicit precondition. CloudFormation hits the SAME rejections and
+* rolls the stack back:
+*
+*   {MfaConfiguration: OFF, EnabledMfas: [SOFTWARE_TOKEN_MFA]}
+*     -> ROLLBACK_COMPLETE, "Invalid MFA configuration given, can't turn off
+*        MFA and configure an MFA together"
+*   {MfaConfiguration: ON, EnabledMfas: [SOFTWARE_TOKEN_MFA],
+*    AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]}  (ESSENTIALS tier)
+*     -> ROLLBACK_COMPLETE, "Only PASSWORD and WEB_AUTHN..."
+*
+* So refusing is PARITY-PRESERVING, not a divergence: cdkd refuses the same SET
+* of templates CloudFormation refuses, only EARLIER (before the first API call
+* instead of after a partial apply) and in cdkd's own wording. Nothing that
+* deploys under CloudFormation is blocked here.
+*
+* Both rules read the value cdkd would SEND rather than the raw template value,
+* from ONE `buildMfaConfigRequest` call, so the refusal and the request can
+* never disagree about what OFF / ON means for a given bag. The build runs with
+* NO logger, so the pre-flight is silent and `applyMfaConfig`'s own warnings
+* still fire exactly once.
+*
+* WHAT THIS CANNOT SEE, stated because the message says "refuses it before
+* sending anything" and that reads as a completeness claim: the pre-flight
+* inspects the TEMPLATE, never the live pool, so two template edits reach the
+* same partial apply without tripping it -- DELETING the `SignInPolicy` block
+* while setting `MfaConfiguration: ON`, and OMITTING `MfaConfiguration` while
+* adding `EMAIL_OTP` to a pool whose live MFA is already ON. Both need a
+* live-state guard and are tracked in #2051.
+*
+* Deliberately UNCONDITIONAL -- no `CreateContext.replayingState` downgrade.
+* `.claude/rules/providers.md` says a create-path pre-flight refusal MUST
+* downgrade on a replay, so this is a STATED EXCEPTION rather than an
+* oversight, and the rule's own reasoning is what licenses it: the downgrade
+* exists because a refusal against a STATE record leaves a resource
+* un-rollbackable with no template-side remedy. That presupposes the replay
+* could otherwise SUCCEED. Here it cannot -- both combinations are rejected by
+* AWS 100% of the time (measured above, and CloudFormation rolls back on the
+* same templates), so downgrading would trade a clear cdkd-worded refusal for
+* the identical failure arriving later from AWS, on the create path with a
+* pool to roll back and on the update path with a partial apply. A state record
+* additionally cannot legitimately HOLD either combination: state is written
+* only after a SUCCESSFUL apply, and neither can be applied. Revisit this if
+* AWS ever starts accepting one of them.
+*/
+function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	if (request && request.MfaConfiguration === "OFF" && hasAnyMfaFactorBlock(request)) {
+		const blocks = [
+			...request.SmsMfaConfiguration !== void 0 ? ["SmsMfaConfiguration"] : [],
+			...request.SoftwareTokenMfaConfiguration !== void 0 ? ["SoftwareTokenMfaConfiguration"] : [],
+			...request.EmailMfaConfiguration !== void 0 ? ["EmailMfaConfiguration"] : []
+		];
+		return `${MFA_CONFIGURATION_PATH} is OFF while an MFA factor is configured (SetUserPoolMfaConfig would carry ${blocks.join(", ")}, built from EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject). AWS rejects that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Set MfaConfiguration to ON or OPTIONAL (or remove it) to enable the declared factor. (If MFA is genuinely not wanted, remove EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject instead.)`;
+	}
+	if (request && request.MfaConfiguration === "ON") {
+		const denied = MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS;
+		const offending = readAllowedFirstAuthFactors(properties).filter((factor) => denied.includes(factor));
+		if (offending.length > 0) return `${MFA_CONFIGURATION_PATH} is ON while Policies.SignInPolicy.AllowedFirstAuthFactors allows ${offending.join(", ")}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), and on an update the sign-in policy has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Remove ${offending.join(", ")} from Policies.SignInPolicy.AllowedFirstAuthFactors, leaving PASSWORD. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)`;
+	}
+}
+/**
 * Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
 * actually sends, or drop the key when nothing is sent. Returns the input
 * object unchanged when nothing applies, so the common case compares
@@ -40158,7 +40531,7 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnRelyingPartyID",
 		"WebAuthnUserVerification"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]])]]);
 	/**
 	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
 	* item 2, review round 2).
@@ -40187,6 +40560,26 @@ var CognitoUserPoolProvider = class {
 		this.logger.warn("AWS::Cognito::UserPool MfaConfiguration is an empty string, which declares no MFA mode and is treated as absent -- a collapsed Fn::Join or an empty String parameter produces this shape. The pool deploys with the default MFA configuration instead; declare ON / OPTIONAL / OFF explicitly, or omit the property, to say which was meant.");
 	}
 	/**
+	* Raise {@link describeUnsupportedMfaCombination}'s verdict as a typed
+	* refusal, or return silently when there is nothing to refuse.
+	*
+	* A `ProvisioningError` so both call sites behave the way each already does
+	* with the sibling `MfaConfiguration` shape refusal: on the create path it
+	* surfaces as the provider's own error rather than an AWS one, and on the
+	* update path `update()`'s catch re-throws an already-wrapped
+	* `ProvisioningError` unchanged, so it is not double-wrapped. Both call sites
+	* are OUTSIDE their method's try, so the throw travels untouched either way.
+	*
+	* `target` is the pool NAME on create (there is no physical id yet) and the
+	* physical id on update, matching what each path passes to its other
+	* `ProvisioningError`s.
+	*/
+	assertMfaCombinationApplicable(logicalId, resourceType, target, properties, declaredMfaConfiguration) {
+		const reason = describeUnsupportedMfaCombination(properties, declaredMfaConfiguration);
+		if (reason === void 0) return;
+		throw new ProvisioningError(reason, resourceType, logicalId, target);
+	}
+	/**
 	* The DIFF-side half of the `MfaConfiguration` substitution record.
 	*
 	* Applied by `DiffCalculator` to BOTH comparison sides, so a template that
@@ -40276,6 +40669,7 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
 		}
+		this.assertMfaCombinationApplicable(logicalId, resourceType, poolName, properties, mfaConfiguration);
 		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
@@ -40445,7 +40839,8 @@ var CognitoUserPoolProvider = class {
 	*   sub-block in the request AWS REJECTS the call; with none it accepts and
 	*   resets the pool to MFA-disabled. An EXPLICIT OFF beside a block is
 	*   rejected the same way (2026-08-19, issue #1968; the transcript lives at
-	*   the pinned-OFF warning in `buildMfaConfigRequest`).
+	*   `describeUnsupportedMfaCombination`, which since issue #1977 REFUSES that
+	*   combination before any call rather than warning about it).
 	*
 	* Nothing here licenses a claim about a field on neither list, or about one
 	* API from the other's section. Measure it.
@@ -40523,6 +40918,7 @@ var CognitoUserPoolProvider = class {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
@@ -82898,7 +83294,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.13");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.15");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;