@go-to-k/cdkd 0.284.40 → 0.284.42

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-B3MQFW1K.js";
+import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-8ygMMbQ8.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BeKDzUe9.js";
+import { t as ASGProvider } from "./asg-provider-Dn9oXi9c.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10324,6 +10324,121 @@ function isSqsQueueUrl(value) {
 	return value.startsWith("https://sqs.") && value.includes("/");
 }
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+/**
+* Depth cap for {@link maskDeep}.
+*
+* What it actually bounds is unbounded WORK on a pathologically deep bag — see
+* the rationale at the cap itself, which is the authority. It is NOT primarily
+* a cycle guard: a template-derived bag cannot be cyclic, so that justification
+* over-claims (issue #2176 security review). It does still terminate one, which
+* is why the walk is safe to share with a caller that might hand it something
+* other than a template bag.
+*
+* Deliberately generous. Every shape these warnings exist to describe is a
+* scalar, a list of scalars, or a small record, so the walk does not reach
+* depth 2 in practice.
+*/
+const MASK_WALK_MAX_DEPTH = 8;
+/**
+* What {@link maskDeep} substitutes for a subtree it declines to descend into.
+*
+* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
+* spelled here rather than imported so this module keeps its single-import leaf
+* property (see the module note above); the two are fenced against drift by a
+* test that imports both.
+*/
+const MASK_WALK_DEPTH_CAP_MARKER = "***";
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line or an error message (issue
+* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
+*
+* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
+* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
+*
+*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
+*     containing any of them no longer OCCURS in the stringified text and a
+*     mask applied afterwards cannot find it. That is not an exotic case — it
+*     is every Secrets Manager JSON document, the commonest real secret shape.
+*     Measured on the pre-fix tree for #2176: a plaintext of
+*     `{"user":"admin","pw":"hunter2"}` interpolated as
+*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
+*     unchanged, while masking the leaves first rendered it `"***"`.
+*  2. LENGTH. A finished message is always longer than the value inside it, so
+*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
+*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
+*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
+*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
+*
+* Neither pass subsumes the other, so providers do BOTH — this walk on the
+* value, and the assembled message through the masker as well. The masker is
+* idempotent, so the overlap is free.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
+* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
+* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
+* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
+* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
+* the point at which this should move into `../masked-retry-logger.ts` ... and
+* all three converge on it". That trigger had fired and been missed twice over,
+* and the copies had already diverged exactly as predicted: FOUR of the six
+* carried NO depth cap at all.
+*
+* Worth recording how the last two were nearly missed AGAIN, because it is the
+* same failure one level up: the first sweep for this issue grepped for
+* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
+* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
+* constant. Grep for the SHAPE, not the name. These copies encode a security
+* contract, and a hardening applied to one silently leaves the others behind.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= 8) return "***";
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+
 //#endregion
 //#region src/provisioning/providers/sns-topic-provider.ts
 /**
@@ -10979,12 +11094,7 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed, maskSe
 	const warn = (message) => {
 		getLogger().child("SNSTopicProvider").warn(maskSecrets(message));
 	};
-	const maskLeaf = (value) => {
-		if (typeof value === "string") return maskSecrets(value);
-		if (Array.isArray(value)) return value.map(maskLeaf);
-		if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
-		return value;
-	};
+	const maskLeaf = (value) => maskDeep(value, maskSecrets);
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(maskLeaf(logging))}`);
@@ -13955,10 +14065,11 @@ function idShape(segments) {
 * mis-names one value frequently mis-names its sibling too, and reporting them
 * one deploy at a time is the shape of remedy nobody finishes.
 */
-function compositeIdSeparatorRefusal(resourceType, logicalId, segments) {
+function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
 	const offending = segments.filter((segment) => String(segment.value).includes("|"));
 	if (offending.length === 0) return void 0;
-	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${String(segment.value)}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
+	const mask = maskerOrIdentity(maskSecrets);
+	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${mask(String(segment.value))}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
 }
 /**
 * Join the segments into a composite physicalId, REFUSING one that would be
@@ -13970,7 +14081,7 @@ function compositeIdSeparatorRefusal(resourceType, logicalId, segments) {
 *   behavior.
 */
 function packCompositeId(resourceType, logicalId, segments, options) {
-	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments);
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
 	if (refusal !== void 0) if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
 	else throw new ProvisioningError(refusal, resourceType, logicalId);
 	return segments.map((segment) => String(segment.value)).join("|");
@@ -14163,7 +14274,10 @@ var LambdaEventInvokeConfigProvider = class {
 			coerceNumber: true,
 			...replayWarn(this.logger, context)
 		});
-		const physicalId = this.buildPhysicalId(logicalId, functionName, qualifier, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		const physicalId = this.buildPhysicalId(logicalId, functionName, qualifier, {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
 			this.logger.debug(`Successfully created Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
@@ -16333,10 +16447,7 @@ const deleteTableRetryDelays$1 = {};
 * leaf is stringified — and escaped — identically.
 */
 function maskLeafValue$1(value, maskSecrets) {
-	if (typeof value === "string") return maskSecrets(value);
-	if (Array.isArray(value)) return value.map((v) => maskLeafValue$1(v, maskSecrets));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue$1(v, maskSecrets)]));
-	return value;
+	return maskDeep(value, maskSecrets);
 }
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
@@ -17245,7 +17356,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
-		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
+		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a non-numeric value.`);
 		return coerced.spec;
 	}
 	/**
@@ -17895,18 +18006,17 @@ const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 * by value rather than by position, so the two layers compose.
 *
 * Walks rather than testing the top level, because a secret nested in an object
-* or array leaf is stringified — and escaped — identically. The sibling
-* `dynamodb-table-provider.ts` carries the same helper; it is duplicated rather
-* than shared because these two files deliberately hold no common module today
-* beyond the narrow rule modules (`dynamodb-warm-throughput.ts`,
-* `dynamodb-index-busy-delete.ts`), each of which exists for a MEASURED
-* divergence rather than for convenience.
+* or array leaf is stringified — and escaped — identically.
+*
+* Issue #2176 hoisted the walk into `../masked-retry-logger.js`. The previous
+* note here said the helper was "duplicated rather than shared because these two
+* files deliberately hold no common module today" — that rationale expired the
+* moment a shared LEAF module existed for exactly this, and it had already cost
+* something: this copy carried NO depth cap, so it was one of SIX copies that
+* had drifted apart on the one property that matters.
 */
 function maskLeafValue(value, maskSecrets) {
-	if (typeof value === "string") return maskSecrets(value);
-	if (Array.isArray(value)) return value.map((v) => maskLeafValue(v, maskSecrets));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue(v, maskSecrets)]));
-	return value;
+	return maskDeep(value, maskSecrets);
 }
 var DynamoDBGlobalTableProvider = class {
 	dynamoDBClient;
@@ -22786,11 +22896,11 @@ var SSMParameterProvider = class {
 	* whole body is wrapped: an unexpected failure degrades to "no Arn recorded"
 	* exactly as the fabricated-account arm does.
 	*/
-	async buildParameterArn(name) {
+	async buildParameterArn(name, mask) {
 		try {
-			return await this.buildParameterArnUnguarded(name);
+			return await this.buildParameterArnUnguarded(name, mask);
 		} catch (error) {
-			this.logger.warn(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`);
+			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
 			return;
 		}
 	}
@@ -22810,10 +22920,10 @@ var SSMParameterProvider = class {
 	* import RECORDED it, so the fix belongs at the import boundary — where
 	* `import()` now refuses it — and not here. Do not re-add it.
 	*/
-	async buildParameterArnUnguarded(name) {
+	async buildParameterArnUnguarded(name, mask) {
 		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
 		if (accountInfo.fabricated) {
-			this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
 		}
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
@@ -22823,8 +22933,11 @@ var SSMParameterProvider = class {
 	/**
 	* Create an SSM parameter
 	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating SSM parameter ${logicalId}`);
+	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const warn = (message) => this.logger.warn(mask(message));
+		const debug = (message) => this.logger.debug(mask(message));
+		debug(`Creating SSM parameter ${logicalId}`);
 		const name = properties["Name"] || `/${generateResourceName(logicalId, {
 			maxLength: 1023,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
@@ -22855,14 +22968,14 @@ var SSMParameterProvider = class {
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					this.logger.debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
+					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
+					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
 				}
 				throw innerError;
 			}
-			this.logger.debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
-			const arn = await this.buildParameterArn(name);
+			debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			const arn = await this.buildParameterArn(name, mask);
 			return {
 				physicalId: name,
 				attributes: {
@@ -22873,14 +22986,16 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
 	* Update an SSM parameter
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const debug = (message) => this.logger.debug(mask(message));
+		debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId, physicalId);
@@ -22912,10 +23027,10 @@ var SSMParameterProvider = class {
 					ResourceId: physicalId,
 					Tags: newTags
 				}));
-				this.logger.debug(`Updated tags for SSM parameter ${physicalId}`);
+				debug(`Updated tags for SSM parameter ${physicalId}`);
 			}
-			this.logger.debug(`Successfully updated SSM parameter ${logicalId}`);
-			const arn = await this.buildParameterArn(physicalId);
+			debug(`Successfully updated SSM parameter ${logicalId}`);
+			const arn = await this.buildParameterArn(physicalId, mask);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -22927,7 +23042,7 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -24402,10 +24517,10 @@ var EC2Provider = class {
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
-			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0, context?.maskSecrets);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.createSubnetRouteTableAssociation(logicalId, resourceType, properties);
 			case "AWS::EC2::SecurityGroup": return this.createSecurityGroup(logicalId, resourceType, properties);
-			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0, context?.maskSecrets);
 			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NetworkAcl": return this.createNetworkAcl(logicalId, resourceType, properties);
 			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties, context);
@@ -24413,16 +24528,16 @@ var EC2Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -24431,10 +24546,10 @@ var EC2Provider = class {
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId);
 			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
-			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::NetworkAcl":
 			case "AWS::EC2::NetworkAclEntry":
@@ -24898,7 +25013,10 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 		return {
-			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, {
+				maskSecrets: context?.maskSecrets,
+				...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+			}),
 			attributes: {
 				AllocationId: allocationId,
 				PublicIp: publicIp
@@ -24980,7 +25098,10 @@ var EC2Provider = class {
 		}, {
 			name: "vpcId",
 			value: vpcId
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.ec2Client.send(new AttachInternetGatewayCommand({
 				VpcId: vpcId,
@@ -25133,7 +25254,7 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createRoute(logicalId, resourceType, properties, onMultipleDestinations) {
+	async createRoute(logicalId, resourceType, properties, onMultipleDestinations, maskSecrets) {
 		this.logger.debug(`Creating Route ${logicalId}`);
 		const routeTableId = properties["RouteTableId"];
 		const destinationCidrBlock = properties["DestinationCidrBlock"];
@@ -25157,7 +25278,10 @@ var EC2Provider = class {
 		}, {
 			name: "destination",
 			value: destination
-		}], onMultipleDestinations ? { onRefusal: onMultipleDestinations } : void 0);
+		}], {
+			maskSecrets,
+			...onMultipleDestinations && { onRefusal: onMultipleDestinations }
+		});
 		try {
 			await this.ec2Client.send(new CreateRouteCommand({
 				RouteTableId: routeTableId,
@@ -25185,7 +25309,7 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating Route ${logicalId}: ${physicalId}`);
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
 			physicalId,
@@ -25193,7 +25317,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteRoute(logicalId, physicalId, resourceType);
-			const createResult = await this.createRoute(logicalId, resourceType, properties, (message) => this.logger.warn(message));
+			const createResult = await this.createRoute(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets);
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -25476,7 +25600,7 @@ var EC2Provider = class {
 	*   and on a rollback replay the value comes from a STATE record, which no
 	*   template edit can fix. Absent (the plain CREATE dispatch) it throws.
 	*/
-	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol) {
+	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol, maskSecrets) {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
@@ -25501,7 +25625,10 @@ var EC2Provider = class {
 				name: "toPort",
 				value: toPort ?? "-1"
 			}
-		], onUnusableProtocol ? { onRefusal: onUnusableProtocol } : void 0);
+		], {
+			maskSecrets,
+			...onUnusableProtocol && { onRefusal: onUnusableProtocol }
+		});
 		try {
 			const ruleId = singleSecurityGroupRuleId((await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
@@ -25597,7 +25724,7 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
 			physicalId,
@@ -25605,7 +25732,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteSecurityGroupIngress(logicalId, physicalId, resourceType, previousProperties);
-			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message));
+			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets);
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -26289,7 +26416,10 @@ var EC2Provider = class {
 				name: "egress",
 				value: egress
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const cidrBlock = properties["CidrBlock"];
 			const ipv6CidrBlock = properties["Ipv6CidrBlock"];
@@ -28338,7 +28468,10 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				name: "httpMethod",
 				value: httpMethod
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
@@ -30382,12 +30515,7 @@ var ApiGatewayV2Provider = class {
 	*/
 	toSdkResponseParameters(value, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		const maskLeaf = (value) => {
-			if (typeof value === "string") return maskSecrets(value);
-			if (Array.isArray(value)) return value.map(maskLeaf);
-			if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
-			return value;
-		};
+		const maskLeaf = (value) => maskDeep(value, maskSecrets);
 		if (value == null) return void 0;
 		if (typeof value !== "object" || Array.isArray(value)) return value;
 		const out = {};
@@ -34956,44 +35084,6 @@ var ECSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/masked-retry-logger.ts
-/**
-* The masker a caller supplied, or the identity function when it supplied
-* none.
-*
-* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
-* mandates — `create()` / `update()` are also reached from the import path,
-* from `cdkd drift --revert`, and from tests, and a provider must not care
-* which caller it got. Centralised here so no call site re-spells the `??`
-* and accidentally makes the capability required.
-*/
-function maskerOrIdentity(maskSecrets) {
-	return maskSecrets ?? ((text) => text);
-}
-/**
-* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
-*
-* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
-* and dropping it would silence the give-up summary on the calling path only —
-* trading a disclosure for the reporting hole issue #2018 closed. It goes
-* through the SAME mask as `debug` precisely because it is the line that
-* survives a run without `--verbose`; forwarding it unmasked would defeat the
-* fence at a HIGHER log level than the one the fence was written for.
-*
-* `logger` is typed structurally rather than as the concrete `Logger` so this
-* module stays a leaf and a test can pass two spies. That matches the
-* precedent already in the tree (`buildMfaConfigRequest` in
-* `cognito-provider.ts` takes an injected `logger?: { warn }`).
-*/
-function createMaskedRetryLogger(logger, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	return {
-		debug: (message) => logger.debug(mask(message)),
-		warn: (message) => logger.warn(mask(message))
-	};
-}
-
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
@@ -35003,41 +35093,6 @@ function createMaskedRetryLogger(logger, maskSecrets) {
 */
 const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
-* Depth cap for {@link maskDeep}. Bounds a self-referential bag rather than
-* hanging; `JSON.stringify` would throw on one anyway, and a throw is the
-* better failure of the two.
-*/
-const MASK_WALK_MAX_DEPTH$1 = 8;
-/**
-* Mask every string LEAF and KEY of an arbitrary value, returning a structure
-* safe to `JSON.stringify` into a log line (issue #2050).
-*
-* The ordering is the whole point. `maskSecretsInText` matches by literal
-* occurrence, and `JSON.stringify` escapes `"`, `\` and newlines — so a Secrets
-* Manager JSON document (the commonest real secret shape) does not occur in the
-* stringified text and survives a mask applied afterwards. Masking the leaves
-* first also hands the masker each RAW value, which reaches
-* `maskSecretsInText`'s whole-value arm at any length instead of only the
-* substring arm's 4-character floor. See the "three gaps" note in
-* `src/deployment/secret-redaction.ts`.
-*
-* Keys are masked as well as values: `JSON.stringify` renders them into the
-* same line, so a resolved secret used as a map key would otherwise escape.
-*
-* `cognito-provider.ts` carries an equivalent private walk for its own
-* stringified warnings. Two copies is the current cost of keeping this a leaf;
-* a THIRD site is the point at which this should move into
-* `../masked-retry-logger.ts` (already the shared provider-side masking module)
-* and all three converge on it.
-*/
-function maskDeep(value, mask, depth = 0) {
-	if (typeof value === "string") return mask(value);
-	if (depth >= MASK_WALK_MAX_DEPTH$1) return value;
-	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
-	return value;
-}
-/**
 * Documented AWS defaults for TargetGroup attributes, used to reset a
 * removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
 * / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
@@ -39581,10 +39636,10 @@ var Route53Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties);
+			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -39902,7 +39957,10 @@ var Route53Provider = class {
 				name: "recordType",
 				value: recordType
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -39927,7 +39985,7 @@ var Route53Provider = class {
 			throw new ProvisioningError(`Failed to create record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRecordSet(logicalId, physicalId, resourceType, properties) {
+	async updateRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Updating Route 53 record set ${logicalId}: ${physicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId);
 		const recordName = properties["Name"];
@@ -39945,7 +40003,10 @@ var Route53Provider = class {
 				name: "recordType",
 				value: recordType
 			}
-		], { onRefusal: (message) => this.logger.warn(message) });
+		], {
+			onRefusal: (message) => this.logger.warn(message),
+			maskSecrets: context?.maskSecrets
+		});
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -40978,15 +41039,6 @@ function readDeclaredMfaConfiguration(raw, options) {
 	return value.trim() === "" ? "" : value;
 }
 /**
-* Depth cap for the pre-stringify secret walk in {@link buildMfaConfigRequest}.
-*
-* Only a guard against a self-referential bag, not a real bound: a resolved
-* `EnabledMfas` is a list of factor-name scalars, so the walk never reaches
-* depth 2 on any shape this warning exists to describe. Deliberately generous
-* so no plausible mis-shape is left unmasked by it.
-*/
-const MASK_WALK_MAX_DEPTH = 8;
-/**
 * Read `EnabledMfas` as the pair (recognized list, "the template asked for a
 * factor at all").
 *
@@ -41120,15 +41172,9 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
 	const anyFactorBlock = hasAnyMfaFactorBlock(request);
-	const maskDeep = (v, depth = 0) => {
-		if (typeof v === "string") return maskSecrets(v);
-		if (depth >= MASK_WALK_MAX_DEPTH) return v;
-		if (Array.isArray(v)) return v.map((e) => maskDeep(e, depth + 1));
-		if (v !== null && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [maskSecrets(k), maskDeep(x, depth + 1)]));
-		return v;
-	};
-	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskDeep(f)) ?? String(f));
-	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskDeep(properties["EnabledMfas"]))} (not a list)`);
+	const maskLeaves = (v) => maskDeep(v, maskSecrets);
+	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskLeaves(f)) ?? String(f));
+	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskLeaves(properties["EnabledMfas"]))} (not a list)`);
 	if (dropped.length > 0) {
 		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
@@ -44886,7 +44932,10 @@ var AppSyncProvider = class {
 		}, {
 			name: "name",
 			value: name
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		let reportedArn;
 		try {
 			const input = {
@@ -44952,7 +45001,10 @@ var AppSyncProvider = class {
 				name: "fieldName",
 				value: fieldName
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		let reportedArn;
 		try {
 			const input = {
@@ -45019,7 +45071,10 @@ var AppSyncProvider = class {
 		}, {
 			name: "apiKeyId",
 			value: apiKeyId
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
 		return {
 			physicalId,
@@ -45705,7 +45760,10 @@ var GlueProvider = class {
 		}, {
 			name: "tableName",
 			value: tableName
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
@@ -57185,7 +57243,10 @@ var S3TablesProvider = class {
 		}, {
 			name: "namespace",
 			value: namespaceName
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.getClient().send(new CreateNamespaceCommand({
 				tableBucketARN,
@@ -57245,7 +57306,10 @@ var S3TablesProvider = class {
 				name: "name",
 				value: name
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const response = await this.getClient().send(new CreateTableCommand$2({
 				tableBucketARN,
@@ -58883,7 +58947,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 			await saveChain;
 			logger.debug("Releasing lock...");
-			await ctx.lockManager.releaseLock(stackName, regionForState);
+			try {
+				await ctx.lockManager.releaseLock(stackName, regionForState);
+			} catch (releaseErr) {
+				logger.warn(`Failed to release lock for stack '${stackName}': ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+			}
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
 			restoreBaseRegionAndClients();
@@ -86555,7 +86623,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.40");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.42");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;