@go-to-k/cdkd 0.284.17 → 0.284.19

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-Bnu1WuRI.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceTimeoutError, $t as readBootstrapMarkerBody, A as renderStatefulReason, An as canonicalizeRegion, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_BODY_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as uploadCfnTemplate, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as findLargeInlineResources, Et as s3BucketRegionalDomainName, F as green, Fn as resolveBucketRegion, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalInvokeBuildError$1, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as AwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalMigrateError, Kt as escapeRegExp, L as yellow, Ln as getAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as AssemblyReader, Mt as withRetry, N as cyan, Nn as processStackMessages, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as expectedOwnerParam, Ot as applyRoleArnIfSet, P as gray, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ProvisioningError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as resetAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as warnDeprecatedNoPrefixCliFlag, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as MIGRATE_TMP_PREFIX, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vn as CdkdError, Vt as WorkGraph, W as IAMRoleProvider, Wn as DeployCancelledError, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as NestedStackChildDirectDestroyError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as MissingCdkCliError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as PartialFailureError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveSkipPrefix, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as getDockerCmd, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as resolveUseCdkBootstrapAssets, bt as maskSecretsInText, c as replayFailedOperations, cn as AssetManifestLoader, cr as withErrorHandling, ct as coerceCfnBoolean, d as updatePartialReason, dn as synthesisStatusMessage, dr as isThrottlingError, dt as readConfigString, en as validateAssetBucketName, er as ResourceUpdateNotSupportedError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getDefaultStateBucketName, fr as markNonRetryable, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveCaptureObservedState, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveAutoAssetStorage, ht as requireConfigString, i as DeploymentEventsReader, in as formatDockerLoginError, it as WAFv2WebACLProvider, j as formatResourceLine, jn as derivePartitionAndUrlSuffix, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as PARTITION_TABLE, kt as DiffCalculator, l as replayRollback, ln as getDockerImageBySourceHash, lr as isMarkedNonRetryable, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveApp, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDenyExternalAccessPolicy, nr as StackTerminationProtectionError, nt as getAccountInfo, o as planFailedOps, on as runDockerForeground, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as getLegacyStateBucketName, pt as requireConfigArray, q as ProviderRegistry, qn as LocalStartServiceError, qt as stripControlChars, r as DeployEngine, rn as buildDockerImage, rt as refStateLookupFromResource, s as planRollback, sn as runDockerStreaming, sr as normalizeAwsError, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as validateContainerRepoName, tr as StackHasActiveImportsError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as Synthesizer, ur as isRetryableTransientError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefault, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as CFN_TEMPLATE_URL_LIMIT, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as stateBucketExistenceConfirmed, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveStateBucketWithDefaultAndSource, yt as createSecretMasker, z as collectPublishedOutputNames, zn as setAwsClients, zt as AssetPublisher } from "./deploy-engine-Bh_LPdju.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BbLu5LGL.js";
+import { t as ASGProvider } from "./asg-provider-CuSoYdf6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1096,14 +1096,9 @@ async function bootstrapDestroyCommand(options) {
 		let markerBody;
 		let resolvedMarkerKey = markerKey;
 		try {
-			markerBody = await stateBackend.getRawObject(markerKey);
-			if (markerBody === null && rawMarkerKey !== markerKey) {
-				markerBody = await stateBackend.getRawObject(rawMarkerKey);
-				if (markerBody !== null) {
-					resolvedMarkerKey = rawMarkerKey;
-					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
-				}
-			}
+			const read = await readBootstrapMarkerBody(stateBackend, rawRegion);
+			markerBody = read.body;
+			resolvedMarkerKey = read.resolvedKey;
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account/region was never bootstrapped; nothing to delete.`);
@@ -34753,10 +34748,18 @@ var ELBv2Provider = class {
 	* `withRetry`, whose per-attempt `debug` line and give-up `warn` summary
 	* interpolate the AWS message verbatim — and that payload is built from
 	* RESOLVED template properties. See {@link maskedRetryLogger}.
+	*
+	* The LoadBalancer arm receives it too (issue #2063). It runs no `withRetry`,
+	* but it has the two surfaces that do not need one: the `ProvisioningError`
+	* its catch throws (printed at ERROR — DEFAULT verbosity — by
+	* `deploy-engine.ts`) and its partial-create cleanup `warn`. Its payload is
+	* `Name` / `Subnets` / `SecurityGroups` / `LoadBalancerAttributes` values /
+	* `Tags` values straight out of the resolved bag, and AWS quotes a rejected
+	* value back.
 	*/
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties);
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
@@ -34765,6 +34768,15 @@ var ELBv2Provider = class {
 	/**
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
 	* update-path twin of the `create()` note above.
+	*
+	* The catch below is the LoadBalancer arm's masking site (issue #2063), and
+	* the reason that arm needs no `maskSecrets` parameter of its own.
+	* `updateLoadBalancer` has no try/catch: its `ModifyLoadBalancerAttributes` /
+	* `SetSubnets` / `SetSecurityGroups` / `AddTags` rejections — every one of
+	* them built from the resolved `properties` bag — propagate RAW to here.
+	* The sibling arms wrap their own errors into a `ProvisioningError` first,
+	* so the `CdkdError` passthrough short-circuits them and this frame masks
+	* only what actually escapes unwrapped.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
@@ -34772,12 +34784,12 @@ var ELBv2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${this.maskErrorMessage(error, context?.maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
@@ -34791,7 +34803,7 @@ var ELBv2Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createLoadBalancer(logicalId, resourceType, properties) {
+	async createLoadBalancer(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating LoadBalancer ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34838,7 +34850,7 @@ var ELBv2Provider = class {
 						SecurityGroups: properties["SecurityGroups"] ?? [],
 						EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: enforcePrivateLink
 					}));
-					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${enforcePrivateLink} for ${logicalId}`);
+					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${maskerOrIdentity(maskSecrets)(String(enforcePrivateLink))} for ${logicalId}`);
 				}
 				const minCapacity = properties["MinimumLoadBalancerCapacity"];
 				if (minCapacity?.CapacityUnits !== void 0) {
@@ -34846,7 +34858,7 @@ var ELBv2Provider = class {
 						LoadBalancerArn: lbArn,
 						MinimumLoadBalancerCapacity: { CapacityUnits: Number(minCapacity.CapacityUnits) }
 					}));
-					this.logger.debug(`Requested capacity reservation of ${minCapacity.CapacityUnits} LCU for ${logicalId}`);
+					this.logger.debug(`Requested capacity reservation of ${maskerOrIdentity(maskSecrets)(String(minCapacity.CapacityUnits))} LCU for ${logicalId}`);
 					if (isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(lbArn, logicalId);
 				}
 			} catch (innerError) {
@@ -34854,7 +34866,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
 					this.logger.debug(`Cleaned up partially-created LoadBalancer ${logicalId} (${lbArn}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created LoadBalancer ${logicalId} (${lbArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`);
+					this.logger.warn(`Failed to clean up partially-created LoadBalancer ${logicalId} (${lbArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`);
 				}
 				throw innerError;
 			}
@@ -34870,10 +34882,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateLoadBalancer(logicalId, physicalId, _resourceType, properties, previousProperties) {
+	async updateLoadBalancer(logicalId, physicalId, _resourceType, properties, previousProperties, maskSecrets) {
 		const handledKeys = /* @__PURE__ */ new Set([
 			"LoadBalancerAttributes",
 			"Subnets",
@@ -34955,7 +34967,7 @@ var ELBv2Provider = class {
 				LoadBalancerArn: physicalId,
 				...newCapacityUnits !== void 0 ? { MinimumLoadBalancerCapacity: { CapacityUnits: newCapacityUnits } } : { ResetCapacityReservation: true }
 			}));
-			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${newCapacityUnits} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
+			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${maskerOrIdentity(maskSecrets)(String(newCapacity?.CapacityUnits))} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
 			if (newCapacityUnits !== void 0 && isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(physicalId, logicalId);
 		}
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -34973,6 +34985,16 @@ var ELBv2Provider = class {
 	* a timeout WARNS and continues (the reservation keeps provisioning
 	* asynchronously and the ModifyCapacityReservation was accepted), while a
 	* `failed` zonal state throws — that reservation will never provision.
+	*
+	* Takes NO masker, deliberately (issue #2063 audit). Its only request is
+	* `DescribeCapacityReservation({ LoadBalancerArn })` with an AWS-issued ARN,
+	* so no resolved template value is in the payload for AWS to quote back into
+	* the transient-failure `debug` line; the timeout `warn` and the `failed`
+	* throw are assembled from a logical id, a count and an AWS-supplied zonal
+	* reason. A structural reason, not a likelihood judgement — add the
+	* parameter if this ever sends a template-derived member. The `failed` throw
+	* is an ordinary `Error`, so it lands in `createLoadBalancer`'s masked catch
+	* on the create path and in `update()`'s on the update path either way.
 	*/
 	async waitForCapacityReservationProvisioned(lbArn, logicalId) {
 		const maxAttempts = 40;
@@ -42214,25 +42236,38 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
 	* Service create path runs a post-create `UpdateServiceAttributes` through
 	* `withRetry` — see {@link maskedRetryLogger}.
+	*
+	* EVERY arm receives it, not just the Service one (issue #2063). The three
+	* namespace arms build their `Create*NamespaceCommand` payload out of the
+	* RESOLVED `properties` bag — `Name`, `Description`, `Tags` — and each has
+	* two disclosure surfaces for it: the `ProvisioningError` its catch throws
+	* (printed at ERROR, i.e. DEFAULT verbosity, by `deploy-engine.ts`) and the
+	* AWS `ErrorMessage` that {@link pollOperation} raises for a FAILED
+	* operation. Cloud Map's create is operation-based, so the second one is the
+	* NORMAL rejection path for those arms, not an edge case.
 	*/
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	/**
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
-	* update-path twin of the `create()` note above.
+	* update-path twin of the `create()` note above, and threaded into every arm
+	* for the same reason (issue #2063). The namespace update arms carry one
+	* payload surface the create arms do not: {@link syncNamespaceTags} sends
+	* `TagResource` with the resolved `Tags` VALUES, whose rejection lands in
+	* the arm's own catch.
 	*/
 	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -42246,7 +42281,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createNamespace(logicalId, resourceType, properties) {
+	async createNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating private DNS namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -42265,7 +42300,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...inputProperties && { Properties: inputProperties }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePrivateDnsNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			const arn = await this.buildNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created private DNS namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -42278,7 +42313,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -42304,7 +42339,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* kind's Cloud Map default ({@link PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
 	* the CFn-parity shape, live A/B'd 2026-08-11 on the private kind itself.
 	*/
-	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
@@ -42318,7 +42353,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			} else this.logger.debug(`No mutable namespace-body diff for PrivateDnsNamespace ${logicalId}`);
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
@@ -42329,7 +42364,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -42363,7 +42398,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createHttpNamespace(logicalId, resourceType, properties) {
+	async createHttpNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating HTTP namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -42377,7 +42412,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...tags && tags.length > 0 && { Tags: tags }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			const arn = await this.resolveNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -42390,7 +42425,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -42411,7 +42446,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* the template must be cleared explicitly via the `''` sentinel — the
 	* CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
-	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
@@ -42422,7 +42457,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated HTTP namespace ${logicalId}`);
@@ -42433,10 +42468,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createPublicDnsNamespace(logicalId, resourceType, properties) {
+	async createPublicDnsNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating public DNS namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -42452,7 +42487,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...inputProperties && { Properties: inputProperties }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			let arn;
 			let hostedZoneId;
 			try {
@@ -42475,7 +42510,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -42493,7 +42528,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* kind's Cloud Map default ({@link PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
 	* the CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
-	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
@@ -42507,7 +42542,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated public DNS namespace ${logicalId}`);
@@ -42518,7 +42553,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createService(logicalId, resourceType, properties, maskSecrets) {
@@ -42624,7 +42659,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Service: serviceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			if (hasAttrUpsert) {
 				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
@@ -42695,6 +42730,15 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
 	* deterministic STS-based construction as fallback so a transient read
 	* failure right after create does not fail the whole resource.
+	*
+	* Takes NO masker, deliberately (issue #2063 audit). Its request is
+	* `GetNamespace({ Id })` with an AWS-issued namespace id — no resolved
+	* template value is in the payload, so the AWS error text it logs cannot
+	* echo one back. That is a structural reason, not an assessment of
+	* likelihood; add the parameter if this call ever grows a template-derived
+	* member. The `TagResource` / `UntagResource` calls in
+	* {@link syncNamespaceTags} DO carry resolved values, but they throw rather
+	* than log, and the throw lands in the calling arm's masked catch.
 	*/
 	async resolveNamespaceArn(namespaceId) {
 		try {
@@ -42737,8 +42781,39 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/**
 	* Poll a Service Discovery operation until it completes.
 	* Returns the target resource ID from the operation result.
-	*/
-	async pollOperation(operationId, logicalId, resourceType) {
+	*
+	* MASKS `Operation.ErrorMessage` (issue #2063), and this is the only place
+	* that can. Cloud Map's create / update are operation-based: the caller's
+	* `Create*Namespace` / `Update*` request carried the RESOLVED `properties`
+	* bag — `Name`, `Description`, `Tags`, `DnsConfig` — and AWS reports its
+	* rejection here rather than by rejecting the submit call, quoting the
+	* offending value back in `ErrorMessage`. A FAILED operation is therefore
+	* the NORMAL rejection path for these arms, not an edge case.
+	*
+	* Why not leave it to the arms' own catch: every namespace arm and
+	* `updateService` open with `if (error instanceof ProvisioningError) throw
+	* error;`, so a `ProvisioningError` raised here is re-thrown VERBATIM and
+	* never reaches their `maskErrorMessage`. `deploy-engine.ts` then prints it
+	* at ERROR — DEFAULT verbosity. That passthrough is correct (it preserves
+	* the resource/logical-id context this frame added), which is exactly why
+	* the mask has to be applied at the point of construction.
+	*
+	* `errorMessage` is masked RAW, before any interpolation. Stating precisely
+	* what that buys, because the obvious phrasing over-claims (issue #2063
+	* review): `maskSecretsInText`'s WHOLE-VALUE arm fires only when
+	* `secrets.has(text)` — i.e. when the text IS the secret in its entirety —
+	* so masking raw covers the case where AWS returns the offending value as
+	* the whole `ErrorMessage`, at ANY length, including below the substring
+	* arm's 4-character `MIN_NEEDLE_LENGTH` floor. When AWS instead quotes the
+	* value INSIDE a sentence, the substring arm handles it and that floor
+	* applies either way, raw or not. So masking here is strictly better than
+	* masking the assembled message, but it is not general sub-4-character
+	* coverage. See `SecretMaskingContext` in `src/types/resource.ts`.
+	*
+	* The `operationId` / timeout message below carries no template-derived
+	* value (an AWS-issued opaque id), so it is left as-is.
+	*/
+	async pollOperation(operationId, logicalId, resourceType, maskSecrets) {
 		const client = this.getClient();
 		const maxAttempts = 60;
 		let delay = 1e3;
@@ -42750,7 +42825,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				if (targets) return targets["NAMESPACE"] || targets["SERVICE"] || operationId;
 				return operationId;
 			}
-			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${result.Operation?.ErrorMessage || "Unknown error"}`, resourceType, logicalId);
+			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error")}`, resourceType, logicalId);
 			await new Promise((resolve) => setTimeout(resolve, delay));
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -71839,14 +71914,9 @@ async function gcCommand(options) {
 		let markerBody;
 		let resolvedMarkerKey = markerKey;
 		try {
-			markerBody = await stateBackend.getRawObject(markerKey);
-			if (markerBody === null && rawMarkerKey !== markerKey) {
-				markerBody = await stateBackend.getRawObject(rawMarkerKey);
-				if (markerBody !== null) {
-					resolvedMarkerKey = rawMarkerKey;
-					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
-				}
-			}
+			const read = await readBootstrapMarkerBody(stateBackend, rawRegion);
+			markerBody = read.body;
+			resolvedMarkerKey = read.resolvedKey;
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account was never bootstrapped; nothing to garbage-collect.`);
@@ -74046,23 +74116,13 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			bucket: stateBucket,
 			prefix: opts.statePrefix
 		};
-		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+		const { body, resolvedKey } = await readBootstrapMarkerBody(new S3StateBackend(awsClients.s3, stateConfig, {
 			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
-		});
-		const markerKey = getBootstrapMarkerKey(region);
-		let resolvedKey = markerKey;
-		let body = await stateBackend.getRawObject(markerKey);
-		if (body === null && rawRegion !== region) {
-			const rawKey = getBootstrapMarkerKey(rawRegion);
-			body = await stateBackend.getRawObject(rawKey);
-			if (body !== null) {
-				resolvedKey = rawKey;
-				logger.debug(`${prefix}: bootstrap marker found at the un-folded key '${rawKey}' (no '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
-			}
-		}
+		}), rawRegion, { logPrefix: prefix });
 		if (body === null) {
-			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}'${rawRegion !== region ? ` (nor '${getBootstrapMarkerKey(rawRegion)}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			const rawKey = getBootstrapMarkerKey(rawRegion);
+			logger.debug(`${prefix}: no bootstrap marker at '${resolvedKey}'${rawKey !== resolvedKey ? ` (nor '${rawKey}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
 			return;
 		}
 		const marker = parseBootstrapMarker(body, resolvedKey);
@@ -83690,7 +83750,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.17");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.19");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;