@go-to-k/cdkd 0.284.64 → 0.284.65

package/dist/{program-I-xR_ceK.js → program-BfK9a98r.js}

@@ -1,7 +1,7 @@
-import { $ as beginCommandInterruptScope, $n as PARTITION_TABLE, $t as S3StateBackend, A as renderStatefulReason, An as runDockerForeground, At as dynamicReferenceTokens, B as exportAliasCollisionScrubWarning, Bn as resolveCaptureObservedState, Bt as s3BucketDomainName, C as isFinalSnapshotError, Cn as validateContainerRepoName, Cr as PartialFailureError, Ct as requireConfigArray, D as extractDeploymentEventError, Dn as formatDockerLoginError, Dr as StackHasActiveImportsError, Dt as STATE_SOURCED_READBACK_RULES, E as makeCanonicalizePropertiesFn, En as dockerSpawnEnvWithSensitive, Er as ResourceUpdateNotSupportedError, Et as STATE_SOURCED_CROSS_GENERATION_RULES, F as green, Fn as synthesisStatusMessage, Fr as isMarkedNonRetryable, Ft as redactSecretsForState, G as IAMRoleProvider, Gn as stateBucketExistenceConfirmed, Gt as DiffCalculator, H as secretBearingStateKeyWarning, Hn as resolveStateBucketWithDefault, Ht as s3BucketRegionalDomainName, I as red, In as getDefaultStateBucketName, Ir as isRetryableTransientError, It as scrubResourceRecord, J as ProviderRegistry, Jn as CFN_TEMPLATE_URL_LIMIT, Jt as withRetry, K as collectInlinePolicyNamesManagedBySiblings, Kn as warnDeprecatedNoPrefixCliFlag, Kt as INTRINSIC_KEYS, L as yellow, Ln as getLegacyStateBucketName, Lr as isThrottlingError, Lt as classifyReplaySecretRegion, M as bold, Mn as AssetManifestLoader, Mt as isSingleDynamicReferenceToken, N as cyan, Nn as getDockerImageBySourceHash, Nr as normalizeAwsError, Nt as maskSecretsInError, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerCmd, Or as StackTerminationProtectionError, Ot as TEMPLATE_SOURCED_RULES, P as gray, Pn as Synthesizer, Pr as withErrorHandling, Pt as maskSecretsInText, Q as DEFAULT_STATE_PREFIX, Qn as expectedOwnerParam, Qt as displaySafe, R as collectDeclaredOutputNames, Rn as resolveApp, Rr as markNonRetryable, Rt as producerRegionsFromState, S as createPreDeleteFinalSnapshot, Sn as validateAssetBucketName, Sr as NestedStackChildDirectDestroyError, St as replayWarn, T as unsupportedFinalSnapshotError, Tn as buildDockerImage, Tr as ResourceTimeoutError, Tt as requireConfigString, U as stateKeySecretExposure, Un as resolveStateBucketWithDefaultAndSource, Ut as s3BucketWebsiteUrl, V as isExportAliasCollision, Vn as resolveSkipPrefix, Vt as s3BucketDualStackDomainName, W as getCurrentResourceSecrets, Wn as resolveUseCdkBootstrapAssets, Wt as applyRoleArnIfSet, X as findSilentDropProperties, Xn as findLargeInlineResources, Xt as TemplateParser, Y as findActionableSilentDrops, Yn as MIGRATE_TMP_PREFIX, Yt as DagBuilder, Z as CUSTOM_RESOURCE_RESPONSE_PREFIX, Zn as uploadCfnTemplate, Zt as LockManager, _ as computeImplicitDeleteEdges, _n as ensureAssetStorage, _r as LocalInvokeBuildError$1, _t as assertRegionMatch, a as DeploymentEventsStore, an as AssetPublisher, ar as resolveBucketRegion, at as slowCcOperationTimeoutMs, b as buildFinalSnapshotIdentifier, bn as parseBootstrapMarker, bt as configStringRefusal, c as replayFailedOperations, cn as buildAssetRedirectMap, cr as resetAwsClients, ct as IntrinsicFunctionResolver, d as updatePartialReason, dn as rewriteTemplateAssetReferences, dr as CdkdError, dt as getAccountInfo, en as rebuildClientForBucketRegion, er as canonicalizeRegion, et as endCommandInterruptScope, f as UNSPECIFIED_SKIP_REASON, fn as escapeRegExp, ft as parameterTypeMayLoseSecretIdentity, g as IMPLICIT_DELETE_DEPENDENCIES, gn as assertAssetBucketRegion, gr as DynamicReferenceRegionAmbiguousError, gt as resolveExplicitPhysicalId, h as maskingRetryLogger, hn as BOOTSTRAP_MARKER_PREFIX, hr as DeployCancelledError, ht as normalizeAwsTagsToCfn, i as DeploymentEventsReader, in as shouldRetainResource, it as CloudControlProvider, j as formatResourceLine, jn as runDockerStreaming, jt as errorCauseChain, k as isStatefulRecreateTargetSync, kn as partitionSensitiveEnv, kt as createSecretMasker, l as replayRollback, ln as createAssetRedirectResolver, lr as setAwsClients, lt as carriesDynamicReference, m as withResourceDeadline, mn as AssetModeResolver, mt as WAFv2WebACLProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as importableOutputKeys, nr as AssemblyReader, nt as isInterruptedWaitError, o as planFailedOps, on as stringifyValue, or as AwsClients, ot as disableInstanceApiTermination, p as deleteSkipReason, pn as stripControlChars, pr as CrossAccountSecretRefusalError, pt as refStateLookupFromResource, q as clearOnUpdateRemoval, qn as CFN_TEMPLATE_BODY_LIMIT, qt as describeTypeWithThrottleRetry, r as DeployEngine, rn as importableOutputs, rr as processStackMessages, rt as startInterruptWatch, s as planRollback, sn as WorkGraph, sr as getAwsClients, st as isTerminationProtectionPropagationError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as exportNamesCarriedFrom, tr as derivePartitionAndUrlSuffix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as loadPublishableAssetManifest, ut as cfnRefValueFromPhysicalId, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getBootstrapMarkerKey, vr as LocalMigrateError, vt as coerceCfnBoolean, w as refusesFinalSnapshot, wn as buildDenyExternalAccessPolicy, wr as ProvisioningError, wt as requireConfigObject, x as ccRoutedFinalSnapshotError, xn as readBootstrapMarkerBody, xr as MissingCdkCliError, xt as readConfigString, y as PRE_DELETE_SNAPSHOT_TYPES, yn as isCrossRegionRedirect, yr as LocalStartServiceError, yt as configBooleanRefusal, z as collectPublishedOutputNames, zn as resolveAutoAssetStorage, zt as s3BucketArn } from "./deploy-engine-BtqjWvh5.js";
+import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as TemplateParser, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as STATE_SOURCED_READBACK_RULES, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as classifyReplaySecretRegion, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as isSingleDynamicReferenceToken, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as s3BucketRegionalDomainName, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as s3BucketArn, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as maskSecretsInError, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as DiffCalculator, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as s3BucketWebsiteUrl, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as maskSecretsInText, M as bold, Mn as partitionSensitiveEnv, Mt as createSecretMasker, N as cyan, Nn as runDockerForeground, Nt as dynamicReferenceTokens, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as errorCauseChain, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as DagBuilder, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as redactSecretsForState, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as s3BucketDomainName, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as producerRegionsFromState, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as s3BucketDualStackDomainName, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as describeTypeWithThrottleRetry, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as INTRINSIC_KEYS, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as withRetry, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as TEMPLATE_SOURCED_RULES, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as STATE_SOURCED_CROSS_GENERATION_RULES, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as applyRoleArnIfSet, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as scrubResourceRecord } from "./deploy-engine-52VBVCWI.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-BtSUTHs5.js";
-import { t as ASGProvider } from "./asg-provider-DGJz_iFy.js";
+import { t as getCdkdVersion } from "./version-BtkYYOb6.js";
+import { t as ASGProvider } from "./asg-provider-CNwOmQGg.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6879,12 +6879,12 @@ function canonicalizeItemList(properties, key, fold) {
 * exported from there because `resolveS3BucketDestination` is S3-specific
 * branch selection, not a shared shape guard — the two only share the wording.
 */
-function describeValue$1(value) {
+function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
-	if (typeof value === "string") return `a string ${JSON.stringify(value)}`;
-	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).join(", ")}]`;
-	return `a ${typeof value} (${String(value)})`;
+	if (typeof value === "string") return `a string ${JSON.stringify(maskDeep(value, maskSecrets))}`;
+	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
+	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 /**
 * Coerce a CFn numeric to a finite number. CloudFormation is stringly typed —
@@ -7602,7 +7602,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*   refused on a warn-only path. The caller distinguishes the two by testing
 	*   its own `Destination` value — see the `continue` at each call site.
 	*/
-	resolveS3BucketDestination(dest, destinationPath, onUnusable) {
+	resolveS3BucketDestination(dest, destinationPath, onUnusable, maskSecrets = (text) => text) {
 		const nestedPath = `${destinationPath}.S3BucketDestination`;
 		const drop = (message) => {
 			if (onUnusable) {
@@ -7612,11 +7612,11 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
-		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag)}) — the request would be rejected by S3, or silently carry no destination`);
+		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest, maskSecrets)}) — the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
 		return bag;
 	}
 	/**
@@ -7632,7 +7632,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*   substituted default, so the item is recorded as SENT rather than as
 	*   declared.
 	*/
-	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
+	async applyAnalyticsConfigurations(bucketName, configs, onUnusable, maskSecrets = (text) => text) {
 		const skipped = [];
 		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
@@ -7673,7 +7673,7 @@ var S3BucketProvider = class S3BucketProvider {
 				const dataExport = rawDataExport;
 				const analyticsDestPath = "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination";
 				const rawDest = dataExport["Destination"];
-				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable);
+				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable, maskSecrets);
 				if (s3Dest === void 0 && rawDest != null) {
 					skipped.push(index);
 					continue;
@@ -7783,7 +7783,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*   / the destination guard SKIP the item, while the destination `Format` read
 	*   warns and SENDS a substituted default.
 	*/
-	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
+	async applyInventoryConfigurations(bucketName, configs, onUnusable, maskSecrets = (text) => text) {
 		const skipped = [];
 		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
@@ -7803,7 +7803,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
 			const rawDest = config["Destination"];
-			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
+			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable, maskSecrets);
 			if (s3Dest === void 0 && rawDest != null) {
 				skipped.push(index);
 				continue;
@@ -8396,6 +8396,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	async applySubConfigDiffs(bucketName, properties, previousProperties, context) {
 		const overrides = /* @__PURE__ */ new Map();
+		const maskSecrets = maskerOrIdentity(context?.maskSecrets);
 		/** Record a WHOLE-BLOCK skip: the effective value is the previous one. */
 		const retainPrevious = (key) => {
 			overrides.set(key, previousProperties[key]);
@@ -8553,7 +8554,7 @@ var S3BucketProvider = class S3BucketProvider {
 		retainPreviousItems("MetricsConfigurations", metricsOutcomes);
 		const analyticsOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (id, cfg) => {
-			const outcome = await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			const outcome = await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m), maskSecrets);
 			analyticsOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
@@ -8577,7 +8578,7 @@ var S3BucketProvider = class S3BucketProvider {
 		retainPreviousItems("IntelligentTieringConfigurations", intelligentTieringOutcomes);
 		const inventoryOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (id, cfg) => {
-			const outcome = await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			const outcome = await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m), maskSecrets);
 			inventoryOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
@@ -8613,6 +8614,7 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
 		const overrides = /* @__PURE__ */ new Map();
+		const maskSecrets = maskerOrIdentity(context?.maskSecrets);
 		/**
 		* Record a WHOLE-BLOCK fold: the effective value is what was SENT (issue
 		* #1748). The create-path twin of `applySubConfigDiffs`'s helper of the same
@@ -8662,11 +8664,11 @@ var S3BucketProvider = class S3BucketProvider {
 		const metricsConfigs = properties["MetricsConfigurations"];
 		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) recordItemOutcome("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) recordItemOutcome("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) recordItemOutcome("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable, maskSecrets));
 		const itConfigs = properties["IntelligentTieringConfigurations"];
 		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) recordItemOutcome("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) recordItemOutcome("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) recordItemOutcome("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable, maskSecrets));
 		const replConfig = properties["ReplicationConfiguration"];
 		if (replConfig) {
 			if (!await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable)) overrides.set("ReplicationConfiguration", void 0);
@@ -10627,121 +10629,6 @@ function isSqsQueueUrl(value) {
 	return value.startsWith("https://sqs.") && value.includes("/");
 }
 
-//#endregion
-//#region src/provisioning/masked-retry-logger.ts
-/**
-* The masker a caller supplied, or the identity function when it supplied
-* none.
-*
-* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
-* mandates — `create()` / `update()` are also reached from the import path,
-* from `cdkd drift --revert`, and from tests, and a provider must not care
-* which caller it got. Centralised here so no call site re-spells the `??`
-* and accidentally makes the capability required.
-*/
-function maskerOrIdentity(maskSecrets) {
-	return maskSecrets ?? ((text) => text);
-}
-/**
-* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
-*
-* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
-* and dropping it would silence the give-up summary on the calling path only —
-* trading a disclosure for the reporting hole issue #2018 closed. It goes
-* through the SAME mask as `debug` precisely because it is the line that
-* survives a run without `--verbose`; forwarding it unmasked would defeat the
-* fence at a HIGHER log level than the one the fence was written for.
-*
-* `logger` is typed structurally rather than as the concrete `Logger` so this
-* module stays a leaf and a test can pass two spies. That matches the
-* precedent already in the tree (`buildMfaConfigRequest` in
-* `cognito-provider.ts` takes an injected `logger?: { warn }`).
-*/
-function createMaskedRetryLogger(logger, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	return {
-		debug: (message) => logger.debug(mask(message)),
-		warn: (message) => logger.warn(mask(message))
-	};
-}
-/**
-* Depth cap for {@link maskDeep}.
-*
-* What it actually bounds is unbounded WORK on a pathologically deep bag — see
-* the rationale at the cap itself, which is the authority. It is NOT primarily
-* a cycle guard: a template-derived bag cannot be cyclic, so that justification
-* over-claims (issue #2176 security review). It does still terminate one, which
-* is why the walk is safe to share with a caller that might hand it something
-* other than a template bag.
-*
-* Deliberately generous. Every shape these warnings exist to describe is a
-* scalar, a list of scalars, or a small record, so the walk does not reach
-* depth 2 in practice.
-*/
-const MASK_WALK_MAX_DEPTH = 8;
-/**
-* What {@link maskDeep} substitutes for a subtree it declines to descend into.
-*
-* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
-* spelled here rather than imported so this module keeps its single-import leaf
-* property (see the module note above); the two are fenced against drift by a
-* test that imports both.
-*/
-const MASK_WALK_DEPTH_CAP_MARKER = "***";
-/**
-* Mask every string LEAF and KEY of an arbitrary value, returning a structure
-* safe to `JSON.stringify` into a log line or an error message (issue
-* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
-*
-* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
-* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
-*
-*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
-*     containing any of them no longer OCCURS in the stringified text and a
-*     mask applied afterwards cannot find it. That is not an exotic case — it
-*     is every Secrets Manager JSON document, the commonest real secret shape.
-*     Measured on the pre-fix tree for #2176: a plaintext of
-*     `{"user":"admin","pw":"hunter2"}` interpolated as
-*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
-*     unchanged, while masking the leaves first rendered it `"***"`.
-*  2. LENGTH. A finished message is always longer than the value inside it, so
-*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
-*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
-*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
-*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
-*
-* Neither pass subsumes the other, so providers do BOTH — this walk on the
-* value, and the assembled message through the masker as well. The masker is
-* idempotent, so the overlap is free.
-*
-* Keys are masked as well as values: `JSON.stringify` renders them into the
-* same line, so a resolved secret used as a map key would otherwise escape.
-*
-* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
-* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
-* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
-* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
-* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
-* the point at which this should move into `../masked-retry-logger.ts` ... and
-* all three converge on it". That trigger had fired and been missed twice over,
-* and the copies had already diverged exactly as predicted: FOUR of the six
-* carried NO depth cap at all.
-*
-* Worth recording how the last two were nearly missed AGAIN, because it is the
-* same failure one level up: the first sweep for this issue grepped for
-* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
-* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
-* constant. Grep for the SHAPE, not the name. These copies encode a security
-* contract, and a hardening applied to one silently leaves the others behind.
-*/
-function maskDeep(value, mask, depth = 0) {
-	if (typeof value === "string") return mask(value);
-	if (depth >= 8) return "***";
-	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
-	return value;
-}
-
 //#endregion
 //#region src/provisioning/providers/sns-topic-provider.ts
 /**
@@ -10837,7 +10724,7 @@ var SNSTopicProvider = class {
 				}));
 				if (Array.isArray(properties["Subscription"])) {
 					const subscriptions = properties["Subscription"];
-					for (const sub of subscriptions) await this.subscribeInline(topicArn, sub, logicalId);
+					for (const sub of subscriptions) await this.subscribeInline(topicArn, sub, logicalId, maskSecrets);
 				}
 			} catch (innerError) {
 				try {
@@ -10961,7 +10848,7 @@ var SNSTopicProvider = class {
 				this.logger.debug(`Reset removed delivery status attribute ${attributeName} for topic ${physicalId}`);
 			}
 		}
-		if (JSON.stringify(properties["Subscription"]) !== JSON.stringify(previousProperties["Subscription"])) await this.reconcileInlineSubscriptions(physicalId, previousProperties["Subscription"] || [], properties["Subscription"] || [], logicalId);
+		if (JSON.stringify(properties["Subscription"]) !== JSON.stringify(previousProperties["Subscription"])) await this.reconcileInlineSubscriptions(physicalId, previousProperties["Subscription"] || [], properties["Subscription"] || [], logicalId, maskerOrIdentity(maskSecrets));
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
 		if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
@@ -10999,10 +10886,10 @@ var SNSTopicProvider = class {
 	* verbatim — AWS's `SubscribeCommand` accepts `Attributes` as a
 	* `Record<string,string>`.
 	*/
-	async subscribeInline(topicArn, sub, logicalId) {
+	async subscribeInline(topicArn, sub, logicalId, mask) {
 		const protocol = sub["Protocol"];
 		const endpoint = sub["Endpoint"];
-		if (typeof protocol !== "string" || typeof endpoint !== "string") throw new Error(`SNS topic ${logicalId}: inline Subscription entry requires string Protocol and Endpoint, got ${JSON.stringify(sub)}`);
+		if (typeof protocol !== "string" || typeof endpoint !== "string") throw new Error(`SNS topic ${logicalId}: inline Subscription entry requires string Protocol and Endpoint, got ${JSON.stringify(maskDeep(sub, mask))}`);
 		const attributes = buildSubscriptionAttributes(sub);
 		const input = {
 			TopicArn: topicArn,
@@ -11032,11 +10919,11 @@ var SNSTopicProvider = class {
 	* The primary #980 silent-drop (create / add / remove / drift) is fixed; the
 	* attribute-only in-place update is a deliberately-scoped follow-up.
 	*/
-	async reconcileInlineSubscriptions(topicArn, oldSubs, newSubs, logicalId) {
+	async reconcileInlineSubscriptions(topicArn, oldSubs, newSubs, logicalId, mask) {
 		const key = (protocol, endpoint) => `${String(protocol)}${String(endpoint)}`;
 		const oldKeys = new Set(oldSubs.map((s) => key(s["Protocol"], s["Endpoint"])));
 		const newKeys = new Set(newSubs.map((s) => key(s["Protocol"], s["Endpoint"])));
-		for (const sub of newSubs) if (!oldKeys.has(key(sub["Protocol"], sub["Endpoint"]))) await this.subscribeInline(topicArn, sub, logicalId);
+		for (const sub of newSubs) if (!oldKeys.has(key(sub["Protocol"], sub["Endpoint"]))) await this.subscribeInline(topicArn, sub, logicalId, mask);
 		const removed = oldSubs.filter((s) => !newKeys.has(key(s["Protocol"], s["Endpoint"])));
 		if (removed.length === 0) return;
 		const arnByKey = /* @__PURE__ */ new Map();
@@ -12290,7 +12177,9 @@ var LambdaFunctionProvider = class {
 	/**
 	* Update a Lambda function
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const debug = (message) => this.logger.debug(mask(message));
 		this.logger.debug(`Updating Lambda function ${logicalId}: ${physicalId}`);
 		try {
 			const configFields = [
@@ -12400,7 +12289,7 @@ var LambdaFunctionProvider = class {
 			const prevRuntimeManagementConfig = previousProperties["RuntimeManagementConfig"];
 			if (newRuntimeManagementConfig?.["UpdateRuntimeOn"] !== prevRuntimeManagementConfig?.["UpdateRuntimeOn"] || newRuntimeManagementConfig?.["RuntimeVersionArn"] !== prevRuntimeManagementConfig?.["RuntimeVersionArn"]) {
 				await this.putRuntimeManagementConfig(physicalId, newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" });
-				this.logger.debug(`Updated RuntimeManagementConfig for Lambda function ${physicalId} to ${JSON.stringify(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" })}`);
+				debug(`Updated RuntimeManagementConfig for Lambda function ${physicalId} to ${JSON.stringify(maskDeep(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" }, mask))}`);
 			}
 			const getResponse = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
 			const functionArn = getResponse.Configuration?.FunctionArn;
@@ -18085,10 +17974,10 @@ var DynamoDBTableProvider = class {
 			return;
 		}
 		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
-			warn(`GSI ${safeIndexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(sendable)} is lower than the ${JSON.stringify({
+			warn(`GSI ${safeIndexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(sendable, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
 				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
 				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
-			})} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
+			}, maskSecrets))} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
 			return;
 		}
 		return sendable;
@@ -18164,10 +18053,10 @@ var DynamoDBTableProvider = class {
 	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
-		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(desired)} is lower than the ${JSON.stringify({
+		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(desired, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
 			ReadUnitsPerSecond: live?.ReadUnitsPerSecond,
 			WriteUnitsPerSecond: live?.WriteUnitsPerSecond
-		})} DynamoDB currently holds for table ${physicalId}. Warm throughput only ever RISES with a table's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this resource still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline, so the next 'cdkd drift' reports this table clean (a 'cdkd drift --revert' records nothing and keeps reporting it). To make cdkd and AWS agree, set WarmThroughput to the value AWS holds (or remove the property, which AWS treats as keeping the last-set value).`);
+		}, maskSecrets))} DynamoDB currently holds for table ${physicalId}. Warm throughput only ever RISES with a table's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this resource still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline, so the next 'cdkd drift' reports this table clean (a 'cdkd drift --revert' records nothing and keeps reporting it). To make cdkd and AWS agree, set WarmThroughput to the value AWS holds (or remove the property, which AWS treats as keeping the last-set value).`);
 		return true;
 	}
 	/**
@@ -18823,7 +18712,7 @@ var DynamoDBGlobalTableProvider = class {
 			BillingMode: billingMode
 		};
 		const diagnostics = [];
-		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
+		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics, maskSecrets);
 		let effectiveProperties;
 		if (billingModeSubstituted) effectiveProperties = stripProvisionedCapacityKeys({
 			...properties,
@@ -18866,7 +18755,7 @@ var DynamoDBGlobalTableProvider = class {
 			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => {
 				indexesOmitted = true;
 				onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
-			}));
+			}), maskSecrets);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -18905,7 +18794,7 @@ var DynamoDBGlobalTableProvider = class {
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
 		if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
-		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
+		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 		const createOnDemand = {
 			...createCeilings.read.value !== void 0 && { MaxReadRequestUnits: createCeilings.read.value },
 			...createCeilings.write.value !== void 0 && { MaxWriteRequestUnits: createCeilings.write.value }
@@ -18916,8 +18805,8 @@ var DynamoDBGlobalTableProvider = class {
 		for (const replica of replicas) {
 			const replicaRegion = replica["Region"];
 			if (!replicaRegion || replicaRegion === currentRegion) continue;
-			toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics);
-			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {});
+			toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
+			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		}
 		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName, maskSecrets);
 		try {
@@ -18932,7 +18821,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const replica of replicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
-				await this.addReplica(tableName, replica, region, logicalId, billingMode);
+				await this.addReplica(tableName, replica, region, logicalId, billingMode, void 0, maskSecrets);
 			}
 			for (const replica of replicas) {
 				const region = replica["Region"];
@@ -19064,12 +18953,12 @@ var DynamoDBGlobalTableProvider = class {
 	* is the granularity cdkd's pre-flight property-coverage check works at;
 	* these nested keys are tracked as a known gap, not a supported surface.
 	*/
-	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics) {
+	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
 		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
-		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics);
+		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
 		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
-		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {});
+		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		if (tableOverrides.ProvisionedThroughputOverride) create.ProvisionedThroughputOverride = tableOverrides.ProvisionedThroughputOverride;
 		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
 		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
@@ -19161,9 +19050,9 @@ var DynamoDBGlobalTableProvider = class {
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
 			const diagnostics = [];
-			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
+			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
-			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics);
+			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics, maskSecrets);
 			let desiredGsiUnusable = false;
 			const onUnusableGsiBlock = (message) => {
 				desiredGsiUnusable = true;
@@ -19175,13 +19064,13 @@ var DynamoDBGlobalTableProvider = class {
 				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
 			};
 			const liveIndexNames = new Set((describeResp.Table?.GlobalSecondaryIndexes ?? []).map((live) => live.IndexName).filter((name) => typeof name === "string"));
-			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock);
-			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics, onUnusableGsiBlock);
+			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock, maskSecrets);
+			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics, onUnusableGsiBlock, maskSecrets);
 			for (const replica of properties["Replicas"] ?? []) {
 				const replicaRegion = asRecord$1(replica)?.["Region"];
 				if (typeof replicaRegion !== "string" || replicaRegion === currentRegion) continue;
-				toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, diagnostics);
-				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {});
+				toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, diagnostics, maskSecrets);
+				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {}, maskSecrets);
 			}
 			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets);
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
@@ -19230,7 +19119,7 @@ var DynamoDBGlobalTableProvider = class {
 				let previousGsiProbeUnusable = false;
 				toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, () => {
 					previousGsiProbeUnusable = true;
-				});
+				}, maskSecrets);
 				const previousIndexes = previousProperties["GlobalSecondaryIndexes"];
 				effectiveProperties = { ...effectiveProperties ?? properties };
 				if (!previousGsiProbeUnusable && previousIndexes !== void 0) effectiveProperties["GlobalSecondaryIndexes"] = [...previousIndexes];
@@ -19271,9 +19160,9 @@ var DynamoDBGlobalTableProvider = class {
 					BillingMode: newBilling
 				};
 				if (newBilling === "PROVISIONED") {
-					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed");
-					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", void 0, onUnusableGsiBlock);
-					const previousFlipIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed", void 0, onUnusablePreviousGsiBlock);
+					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed", void 0, maskSecrets);
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", void 0, onUnusableGsiBlock, maskSecrets);
+					const previousFlipIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 					if (desiredGsiUnusable || previousGsiUnusable) throw new ProvisioningError(`Cannot flip AWS::DynamoDB::GlobalTable ${logicalId} to PROVISIONED while its GlobalSecondaryIndexes block is unusable: AWS requires per-index provisioned capacity in the same UpdateTable, and it cannot be derived from a malformed block (nor read from a table that is still on-demand). Fix the GlobalSecondaryIndexes value — in the template, or in the cdkd state record on a rollback / drift --revert replay — and re-deploy. The table is unchanged.`, resourceType, logicalId, physicalId);
 					const previousByIndexName = /* @__PURE__ */ new Map();
 					for (const gsi of previousFlipIndexes) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
@@ -19344,7 +19233,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const replica of replicaDiff.added) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
-				await this.addReplica(physicalId, replica, region, logicalId, newBilling);
+				await this.addReplica(physicalId, replica, region, logicalId, newBilling, void 0, maskSecrets);
 				const newReplicaTags = replica["Tags"];
 				await this.applyCrossRegionReplicaTagsDiff(tableArn, region, void 0, newReplicaTags, physicalId, maskSecrets);
 				const newReadAutoScaling = (replica["ReadProvisionedThroughputSettings"] ?? {})["ReadCapacityAutoScalingSettings"];
@@ -19377,13 +19266,13 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
-				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling);
+				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, void 0, maskSecrets);
 				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
-				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {});
+				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {}, maskSecrets);
 				if (replicaOverrides.ProvisionedThroughputOverride) updateAction.ProvisionedThroughputOverride = replicaOverrides.ProvisionedThroughputOverride;
 				if (replicaOverrides.OnDemandThroughputOverride) updateAction.OnDemandThroughputOverride = replicaOverrides.OnDemandThroughputOverride;
 				if (oldBilling === newBilling) {
-					const oldReplicaOverrides = toSdkReplicaThroughputOverrides(oldReplica ?? {}, oldBilling, void 0, {});
+					const oldReplicaOverrides = toSdkReplicaThroughputOverrides(oldReplica ?? {}, oldBilling, void 0, {}, maskSecrets);
 					const droppedOverrides = [];
 					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
@@ -19400,7 +19289,7 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
-			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock);
+			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
 				liveBillingMode,
@@ -20820,14 +20709,14 @@ function extractLocalDeletionProtection(props, region) {
 *    literal `ReadCapacityUnits`, which is taken before its auto-scaling
 *    members; 5 if absent.
 */
-function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics) {
+function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
 	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord$1(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
 	const rawWrite = properties["WriteProvisionedThroughputSettings"];
 	const read = deriveReadCapacityUnits(asRecord$1(rawRead), source);
 	const write = deriveWriteCapacityUnits(asRecord$1(rawWrite), source);
-	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "Replicas[local].ReadProvisionedThroughputSettings" });
-	if (write === void 0) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "WriteProvisionedThroughputSettings" });
+	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "Replicas[local].ReadProvisionedThroughputSettings" }, maskSecrets);
+	if (write === void 0) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "WriteProvisionedThroughputSettings" }, maskSecrets);
 	return {
 		ReadCapacityUnits: read ?? DEFAULT_CAPACITY_UNITS,
 		WriteCapacityUnits: write ?? DEFAULT_CAPACITY_UNITS
@@ -21110,7 +20999,7 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 * `ProvisionedThroughputOverride` / `OnDemandThroughputOverride` as "inherit
 * the source table's settings".
 */
-function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, context) {
+function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, context, maskSecrets = (text) => text) {
 	const out = {};
 	for (const member of members) {
 		if (explicit && explicit[member] !== void 0) {
@@ -21123,7 +21012,7 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 				kind: "unresolved-member",
 				...context.indexName !== void 0 && { indexName: context.indexName },
 				member,
-				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(explicit[member])?.slice(0, 80)}), so it was ignored. This is usually an unresolved intrinsic; resolve it to a literal.`
+				message: `${context.blockName}.${member} is present but did not resolve to a number (${JSON.stringify(maskDeep(explicit[member], maskSecrets))?.slice(0, 80)}), so it was ignored. This is usually an unresolved intrinsic; resolve it to a literal.`
 			});
 		}
 		const derivedValue = derived?.[member];
@@ -21144,7 +21033,7 @@ function mergeExplicitThroughputBlock(explicit, derived, members, diagnostics, c
 * gate short-circuits). The defect is identical in all three; only the
 * diagnostic was conditional.
 */
-function reportUnresolvedRawMember(rawValue, diagnostics, context) {
+function reportUnresolvedRawMember(rawValue, diagnostics, context, maskSecrets = (text) => text) {
 	if (!diagnostics) return;
 	if (rawValue === void 0) return;
 	if (toFiniteNumber(rawValue) !== void 0) return;
@@ -21152,7 +21041,7 @@ function reportUnresolvedRawMember(rawValue, diagnostics, context) {
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: context.member,
-		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(rawValue)?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it.`
+		message: `${context.blockName}.${context.member} is declared but did not resolve to a number (${JSON.stringify(maskDeep(rawValue, maskSecrets))?.slice(0, 80)}), so no throughput value was sent for it and the live AWS setting was left unchanged. This is usually an unresolved intrinsic; resolve it to a literal to apply the limit, or remove the property entirely to clear it.`
 	});
 }
 /**
@@ -21230,7 +21119,7 @@ function blameUnresolvedProvisionedMember(rawSettings, side, source) {
 * explicit SDK-shaped member is standing in for it, so the warning always
 * describes what actually reached AWS.
 */
-function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome, diagnostics, context) {
+function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome, diagnostics, context, maskSecrets = (text) => text) {
 	if (!diagnostics) return;
 	const blame = blameUnresolvedProvisionedMember(rawSettings, side, source);
 	if (!blame) return;
@@ -21240,7 +21129,7 @@ function reportUnresolvedProvisionedCapacity(rawSettings, side, source, outcome,
 		kind: "unresolved-member",
 		...context.indexName !== void 0 && { indexName: context.indexName },
 		member: blame.relPath ? blame.relPath.slice(blame.relPath.lastIndexOf(".") + 1) : context.blockName.slice(context.blockName.lastIndexOf(".") + 1),
-		message: `${path} is declared but did not resolve to a number (${JSON.stringify(blame.value)?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared.`
+		message: `${path} is declared but did not resolve to a number (${JSON.stringify(maskDeep(blame.value, maskSecrets))?.slice(0, 80)}), ${consequence}. This is usually an unresolved intrinsic; resolve it to a literal to apply the capacity you declared.`
 	});
 }
 /**
@@ -21332,10 +21221,10 @@ function pickAutoScalingCapacity(autoScaling, source) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics, onUnusableIndexes) {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics, onUnusableIndexes, maskSecrets = (text) => text) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) {
-		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}).`;
+		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(maskDeep(rawIndexes, maskSecrets))?.slice(0, 200)}).`;
 		if (onUnusableIndexes) {
 			onUnusableIndexes(shapeDetail);
 			return [];
@@ -21396,19 +21285,19 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 				reportUnresolvedProvisionedCapacity(fromReplica ? rawLocalRead : rawGsiRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
 					...typeof indexName === "string" && { indexName },
 					blockName: fromReplica ? "Replicas[local].GlobalSecondaryIndexes[].ReadProvisionedThroughputSettings" : "ReadProvisionedThroughputSettings"
-				});
+				}, maskSecrets);
 			}
 			if (derivedWrite === void 0 && !explicitCovers("WriteCapacityUnits")) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, {
 				...typeof indexName === "string" && { indexName },
 				blockName: "WriteProvisionedThroughputSettings"
-			});
+			}, maskSecrets);
 			sdk.ProvisionedThroughput = mergeExplicitThroughputBlock(explicitProvisioned, {
 				ReadCapacityUnits: derivedRead ?? DEFAULT_CAPACITY_UNITS,
 				WriteCapacityUnits: derivedWrite ?? DEFAULT_CAPACITY_UNITS
 			}, ["ReadCapacityUnits", "WriteCapacityUnits"], diagnostics, {
 				...typeof indexName === "string" && { indexName },
 				blockName: "ProvisionedThroughput"
-			});
+			}, maskSecrets);
 		} else {
 			const rawWrite = asRecord$1(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"];
 			const rawReadLocal = asRecord$1(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
@@ -21417,12 +21306,12 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 				...typeof indexName === "string" && { indexName },
 				blockName: "WriteOnDemandThroughputSettings",
 				member: "MaxWriteRequestUnits"
-			});
+			}, maskSecrets);
 			reportUnresolvedRawMember(rawReadLocal !== void 0 ? rawReadLocal : rawReadGsi, diagnostics, {
 				...typeof indexName === "string" && { indexName },
 				blockName: rawReadLocal !== void 0 ? "Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings" : "ReadOnDemandThroughputSettings",
 				member: "MaxReadRequestUnits"
-			});
+			}, maskSecrets);
 			const maxWrite = toFiniteNumber(rawWrite);
 			const maxRead = toFiniteNumber(rawReadLocal) ?? toFiniteNumber(rawReadGsi);
 			const merged = mergeExplicitThroughputBlock(explicitOnDemand, {
@@ -21431,7 +21320,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			}, ["MaxReadRequestUnits", "MaxWriteRequestUnits"], diagnostics, {
 				...typeof indexName === "string" && { indexName },
 				blockName: "OnDemandThroughput"
-			});
+			}, maskSecrets);
 			if (merged) sdk.OnDemandThroughput = merged;
 		}
 		result.push(sdk);
@@ -21943,14 +21832,14 @@ function buildLiveRecoveryGsiBaseline(desiredSdkIndexes, liveIndexes, options) {
 * status back in `readCurrentState`). Recorded here rather than silently
 * dropped; tracked with the other GlobalTable nested-key gaps.
 */
-function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnostics) {
+function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnostics, maskSecrets = (text) => text) {
 	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
 	return replicaIndexes.map((entry) => {
 		const cfn = asRecord$1(entry);
 		if (!cfn) return entry;
 		const indexName = cfn["IndexName"];
 		const sdk = { IndexName: indexName };
-		const overrides = toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, { ...typeof indexName === "string" && { indexName } });
+		const overrides = toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, { ...typeof indexName === "string" && { indexName } }, maskSecrets);
 		if (overrides.ProvisionedThroughputOverride) sdk.ProvisionedThroughputOverride = overrides.ProvisionedThroughputOverride;
 		if (overrides.OnDemandThroughputOverride) sdk.OnDemandThroughputOverride = overrides.OnDemandThroughputOverride;
 		return sdk;
@@ -21970,7 +21859,7 @@ function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnos
 * mode. Both override members are READ-side only — a replica has no
 * independent write capacity, since writes replicate from the source table.
 */
-function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context) {
+function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context, maskSecrets = (text) => text) {
 	const explicitProvisioned = asRecord$1(cfn["ProvisionedThroughputOverride"]);
 	const explicitOnDemand = asRecord$1(cfn["OnDemandThroughputOverride"]);
 	if (explicitProvisioned && billingMode !== "PROVISIONED") diagnostics?.push({
@@ -21991,11 +21880,11 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context)
 		if (readCapacity === void 0 && toFiniteNumber(explicitProvisioned?.["ReadCapacityUnits"]) === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", "min", { suppressed: "so no ProvisionedThroughputOverride was sent and the replica keeps the source table's read capacity" }, diagnostics, {
 			...context,
 			blockName: "ReadProvisionedThroughputSettings"
-		});
+		}, maskSecrets);
 		const merged = mergeExplicitThroughputBlock(explicitProvisioned, readCapacity !== void 0 ? { ReadCapacityUnits: readCapacity } : void 0, ["ReadCapacityUnits"], diagnostics, {
 			...context,
 			blockName: "ProvisionedThroughputOverride"
-		});
+		}, maskSecrets);
 		return merged ? { ProvisionedThroughputOverride: merged } : {};
 	}
 	const rawMaxRead = asRecord$1(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"];
@@ -22003,12 +21892,12 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context)
 		...context,
 		blockName: "ReadOnDemandThroughputSettings",
 		member: "MaxReadRequestUnits"
-	});
+	}, maskSecrets);
 	const maxReadRequestUnits = toFiniteNumber(rawMaxRead);
 	const merged = mergeExplicitThroughputBlock(explicitOnDemand, maxReadRequestUnits !== void 0 ? { MaxReadRequestUnits: maxReadRequestUnits } : void 0, ["MaxReadRequestUnits"], diagnostics, {
 		...context,
 		blockName: "OnDemandThroughputOverride"
-	});
+	}, maskSecrets);
 	return merged ? { OnDemandThroughputOverride: merged } : {};
 }
 /**
@@ -22030,7 +21919,7 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context)
 * member on `ReplicaSpecification`:
 * `ReadOnDemandThroughputSettings: { MaxReadRequestUnits: integer, minimum 1 }`.
 */
-function collectTableOnDemandCeilings(properties, region, diagnostics) {
+function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecrets = (text) => text) {
 	const writeBlock = properties["WriteOnDemandThroughputSettings"];
 	const replicas = properties["Replicas"];
 	const readBlock = asRecord$1(Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
@@ -22039,11 +21928,11 @@ function collectTableOnDemandCeilings(properties, region, diagnostics) {
 	reportUnresolvedRawMember(rawRead, diagnostics, {
 		blockName: "Replicas[local].ReadOnDemandThroughputSettings",
 		member: "MaxReadRequestUnits"
-	});
+	}, maskSecrets);
 	reportUnresolvedRawMember(rawWrite, diagnostics, {
 		blockName: "WriteOnDemandThroughputSettings",
 		member: "MaxWriteRequestUnits"
-	});
+	}, maskSecrets);
 	return {
 		read: {
 			declared: rawRead !== void 0 || isUnresolvedIntrinsicBlock(readBlock),
@@ -22919,9 +22808,9 @@ var CloudWatchAnomalyDetectorProvider = class {
 	/**
 	* Create an anomaly detection model via `PutAnomalyDetector`.
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CloudWatch anomaly detector ${logicalId}`);
-		const params = buildPutParams(properties);
+		const params = buildPutParams(properties, maskerOrIdentity(context?.maskSecrets));
 		if (!hasDescriptor(params)) throw new ProvisioningError(`AnomalyDetector ${logicalId} needs a metric descriptor: either SingleMetricAnomalyDetector, MetricMathAnomalyDetector, or the top-level Namespace/MetricName/Stat fields`, resourceType, logicalId);
 		try {
 			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(params));
@@ -22953,10 +22842,10 @@ var CloudWatchAnomalyDetectorProvider = class {
 	* defaults), so re-putting the full desired properties matches CFn's
 	* "removed property resets to default" behavior with no extra clearing.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
 		try {
-			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(buildPutParams(properties)));
+			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(buildPutParams(properties, maskerOrIdentity(context?.maskSecrets))));
 			this.logger.debug(`Successfully updated CloudWatch anomaly detector ${logicalId}`);
 			return {
 				physicalId,
@@ -23023,7 +22912,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 * `Configuration.ExcludedTimeRanges[].StartTime/EndTime`, which CFn carries
 * as ISO-8601 strings and the SDK models as `Date`.
 */
-function buildPutParams(properties) {
+function buildPutParams(properties, mask) {
 	const params = {};
 	const single = properties["SingleMetricAnomalyDetector"];
 	if (single !== void 0) params.SingleMetricAnomalyDetector = single;
@@ -23039,8 +22928,8 @@ function buildPutParams(properties) {
 		if (configuration["MetricTimeZone"] !== void 0) mapped.MetricTimezone = configuration["MetricTimeZone"];
 		const ranges = configuration["ExcludedTimeRanges"];
 		if (ranges !== void 0) mapped.ExcludedTimeRanges = ranges.map((r) => ({
-			StartTime: toDate(r["StartTime"]),
-			EndTime: toDate(r["EndTime"])
+			StartTime: toDate(r["StartTime"], mask),
+			EndTime: toDate(r["EndTime"], mask)
 		}));
 		params.Configuration = mapped;
 	}
@@ -23065,11 +22954,11 @@ function buildDeleteParams(properties) {
 	return params;
 }
 /** CFn carries Range times as ISO-8601 strings; the SDK models them as Date. */
-function toDate(value) {
+function toDate(value, mask) {
 	if (value === void 0) return void 0;
 	if (value instanceof Date) return value;
 	const parsed = typeof value === "string" || typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
-	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${JSON.stringify(value)}`);
+	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${JSON.stringify(maskDeep(value, mask))}`);
 	return parsed;
 }
 /**
@@ -44848,11 +44737,11 @@ var AppSyncProvider = class {
 	* engine's replacement-detection layer should normally route those
 	* through CREATE+DELETE.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.updateGraphQLApi(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::AppSync::GraphQLSchema": return this.updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::AppSync::DataSource": return this.updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::AppSync::DataSource": return this.updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties, maskerOrIdentity(context?.maskSecrets));
 			case "AWS::AppSync::Resolver": return this.updateResolver(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::AppSync::ApiKey": return this.updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
@@ -44959,7 +44848,7 @@ var AppSyncProvider = class {
 			wasReplaced: false
 		};
 	}
-	async updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		for (const field of [
 			"ApiId",
 			"Name",
@@ -44989,7 +44878,7 @@ var AppSyncProvider = class {
 			name,
 			type
 		};
-		this.applyDataSourceConfig(input, resourceType, logicalId, properties);
+		this.applyDataSourceConfig(input, resourceType, logicalId, properties, mask);
 		try {
 			await this.getClient().send(new UpdateDataSourceCommand(input));
 		} catch (error) {
@@ -45189,10 +45078,10 @@ var AppSyncProvider = class {
 	* .claude/rules/providers.md. So the accepted shapes are enumerated instead:
 	* a finite NUMBER, or a NON-BLANK string that parses to one.
 	*/
-	toDeltaSyncTtl(value, path, logicalId, resourceType) {
+	toDeltaSyncTtl(value, path, logicalId, resourceType, mask) {
 		const numeric = typeof value === "number" ? value : typeof value === "string" ? value.trim() : void 0;
 		const parsed = numeric === void 0 || numeric === "" ? NaN : Number(numeric);
-		if (!Number.isFinite(parsed)) throw new ProvisioningError(`${resourceType} ${path} must be a number of minutes (CFn types it as a string), got ${JSON.stringify(value)} — cdkd refuses to drop it silently`, resourceType, logicalId);
+		if (!Number.isFinite(parsed)) throw new ProvisioningError(`${resourceType} ${path} must be a number of minutes (CFn types it as a string), got ${JSON.stringify(maskDeep(value, mask))} — cdkd refuses to drop it silently`, resourceType, logicalId);
 		return parsed;
 	}
 	/**
@@ -45536,7 +45425,7 @@ var AppSyncProvider = class {
 	* validation error. The read side (`readDataSource`) gates on the
 	* response's own discriminator instead.
 	*/
-	applyDataSourceConfig(input, resourceType, logicalId, properties) {
+	applyDataSourceConfig(input, resourceType, logicalId, properties, mask) {
 		if (properties["Description"] !== void 0) input.description = properties["Description"];
 		if (properties["ServiceRoleArn"] !== void 0) input.serviceRoleArn = properties["ServiceRoleArn"];
 		const dynamo = this.asObject(properties["DynamoDBConfig"], "DynamoDBConfig", { logicalId }, resourceType);
@@ -45550,9 +45439,9 @@ var AppSyncProvider = class {
 			const delta = this.asObject(dynamo["DeltaSyncConfig"], "DynamoDBConfig.DeltaSyncConfig", { logicalId }, resourceType);
 			if (delta) {
 				const deltaConfig = {};
-				if (delta["BaseTableTTL"] !== void 0) deltaConfig.baseTableTTL = this.toDeltaSyncTtl(delta["BaseTableTTL"], "DynamoDBConfig.DeltaSyncConfig.BaseTableTTL", logicalId, resourceType);
+				if (delta["BaseTableTTL"] !== void 0) deltaConfig.baseTableTTL = this.toDeltaSyncTtl(delta["BaseTableTTL"], "DynamoDBConfig.DeltaSyncConfig.BaseTableTTL", logicalId, resourceType, mask);
 				if (delta["DeltaSyncTableName"] !== void 0) deltaConfig.deltaSyncTableName = delta["DeltaSyncTableName"];
-				if (delta["DeltaSyncTableTTL"] !== void 0) deltaConfig.deltaSyncTableTTL = this.toDeltaSyncTtl(delta["DeltaSyncTableTTL"], "DynamoDBConfig.DeltaSyncConfig.DeltaSyncTableTTL", logicalId, resourceType);
+				if (delta["DeltaSyncTableTTL"] !== void 0) deltaConfig.deltaSyncTableTTL = this.toDeltaSyncTtl(delta["DeltaSyncTableTTL"], "DynamoDBConfig.DeltaSyncConfig.DeltaSyncTableTTL", logicalId, resourceType, mask);
 				ddbConfig.deltaSyncConfig = deltaConfig;
 			}
 			input.dynamodbConfig = ddbConfig;
@@ -45731,7 +45620,7 @@ var AppSyncProvider = class {
 				name,
 				type
 			};
-			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
+			this.applyDataSourceConfig(input, resourceType, logicalId, properties, maskerOrIdentity(context?.maskSecrets));
 			reportedArn = (await this.getClient().send(new CreateDataSourceCommand(input))).dataSource?.dataSourceArn;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
 		} catch (error) {
@@ -49365,15 +49254,15 @@ var BudgetsBudgetProvider = class {
 	* a UTC date string (`2026-07-01T00:00:00Z`) or an epoch timestamp in
 	* seconds (possibly as a numeric string).
 	*/
-	toSdkDate(raw, field, logicalId, resourceType) {
+	toSdkDate(raw, field, logicalId, resourceType, mask) {
 		let date;
 		if (typeof raw === "number") date = new Date(raw < 0xe8d4a51000 ? raw * 1e3 : raw);
 		else if (typeof raw === "string" && /^\d+$/.test(raw)) {
 			const num = Number(raw);
 			date = new Date(num < 0xe8d4a51000 ? num * 1e3 : num);
 		} else if (typeof raw === "string") date = new Date(raw);
-		else throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: expected a date string or epoch timestamp, got ${JSON.stringify(raw)}`, resourceType, logicalId);
-		if (Number.isNaN(date.getTime())) throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: ${JSON.stringify(raw)} is not a parseable date`, resourceType, logicalId);
+		else throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: expected a date string or epoch timestamp, got ${JSON.stringify(maskDeep(raw, mask))}`, resourceType, logicalId);
+		if (Number.isNaN(date.getTime())) throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: ${JSON.stringify(maskDeep(raw, mask))} is not a parseable date`, resourceType, logicalId);
 		return date;
 	}
 	/**
@@ -49383,7 +49272,7 @@ var BudgetsBudgetProvider = class {
 	* `TimePeriod.Start` / `.End` are `Date`s. `FilterExpression` / `Metrics` /
 	* `CostFilters` / `CostTypes` / `AutoAdjustData` pass through verbatim.
 	*/
-	toSdkBudget(raw, budgetName, logicalId, resourceType) {
+	toSdkBudget(raw, budgetName, logicalId, resourceType, mask) {
 		if (raw === void 0 || raw === null || typeof raw !== "object") throw new ProvisioningError(`The Budget property is required for ${logicalId}`, resourceType, logicalId);
 		const src = raw;
 		const budget = {
@@ -49399,8 +49288,8 @@ var BudgetsBudgetProvider = class {
 		if (src["TimePeriod"] !== void 0 && typeof src["TimePeriod"] === "object") {
 			const rawPeriod = src["TimePeriod"];
 			const period = {};
-			if (rawPeriod["Start"] !== void 0) period.Start = this.toSdkDate(rawPeriod["Start"], "Start", logicalId, resourceType);
-			if (rawPeriod["End"] !== void 0) period.End = this.toSdkDate(rawPeriod["End"], "End", logicalId, resourceType);
+			if (rawPeriod["Start"] !== void 0) period.Start = this.toSdkDate(rawPeriod["Start"], "Start", logicalId, resourceType, mask);
+			if (rawPeriod["End"] !== void 0) period.End = this.toSdkDate(rawPeriod["End"], "End", logicalId, resourceType, mask);
 			budget["TimePeriod"] = period;
 		}
 		return budget;
@@ -49480,7 +49369,8 @@ var BudgetsBudgetProvider = class {
 	* its notifications with subscribers, and resource tags — no post-create
 	* wiring to clean up on partial failure).
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(`Creating budget ${logicalId}`);
 		const rawName = (properties["Budget"] ?? {})["BudgetName"];
 		const name = typeof rawName === "string" && rawName.length > 0 ? rawName : generateResourceName(logicalId, {
@@ -49493,7 +49383,7 @@ var BudgetsBudgetProvider = class {
 			const resourceTags = this.toSdkResourceTags(properties["ResourceTags"]);
 			await this.getClient().send(new CreateBudgetCommand({
 				AccountId: accountId,
-				Budget: this.toSdkBudget(properties["Budget"], name, logicalId, resourceType),
+				Budget: this.toSdkBudget(properties["Budget"], name, logicalId, resourceType, mask),
 				...notifications.length > 0 && { NotificationsWithSubscribers: notifications },
 				...resourceTags.length > 0 && { ResourceTags: resourceTags }
 			}));
@@ -49513,13 +49403,14 @@ var BudgetsBudgetProvider = class {
 	* reconcile `NotificationsWithSubscribers` in place (CloudFormation would
 	* replace the whole budget instead) and diff `ResourceTags`.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(`Updating budget ${logicalId}: ${physicalId}`);
 		try {
 			const accountId = await this.resolveAccountId();
 			await this.getClient().send(new UpdateBudgetCommand({
 				AccountId: accountId,
-				NewBudget: this.toSdkBudget(properties["Budget"], physicalId, logicalId, resourceType)
+				NewBudget: this.toSdkBudget(properties["Budget"], physicalId, logicalId, resourceType, mask)
 			}));
 			await this.reconcileNotifications(accountId, physicalId, this.toSdkNotificationsWithSubscribers(previousProperties["NotificationsWithSubscribers"]), this.toSdkNotificationsWithSubscribers(properties["NotificationsWithSubscribers"]));
 			await this.reconcileResourceTags(accountId, physicalId, this.toSdkResourceTags(previousProperties["ResourceTags"]), this.toSdkResourceTags(properties["ResourceTags"]));
@@ -49828,11 +49719,11 @@ function expandShardLevelMetrics(value) {
 * previous side is never routed through the refusal at all — see
 * {@link previousMetricNames}.
 */
-function readShardLevelMetrics(value) {
+function readShardLevelMetrics(value, mask) {
 	if (value == null) return { kind: "absent" };
 	if (!isUsableMetricsList(value)) return {
 		kind: "unusable",
-		reason: `AWS::Kinesis::Stream DesiredShardLevelMetrics must be an array of metric-name strings, got ${JSON.stringify(value)}`
+		reason: `AWS::Kinesis::Stream DesiredShardLevelMetrics must be an array of metric-name strings, got ${JSON.stringify(maskDeep(value, mask))}`
 	};
 	const expanded = expandShardLevelMetrics(value);
 	return {
@@ -49851,7 +49742,7 @@ function previousMetricNames(value) {
 	const expanded = expandShardLevelMetrics(value);
 	return isUsableMetricsList(expanded) ? expanded : [];
 }
-function readMaxRecordSize(value) {
+function readMaxRecordSize(value, mask) {
 	if (value == null) return { kind: "absent" };
 	if (typeof value === "number" && Number.isFinite(value)) return {
 		kind: "usable",
@@ -49866,7 +49757,7 @@ function readMaxRecordSize(value) {
 	}
 	return {
 		kind: "unusable",
-		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(value)}`
+		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(maskDeep(value, mask))}`
 	};
 }
 /**
@@ -49876,8 +49767,8 @@ function readMaxRecordSize(value) {
 * Unusable / absent both yield `undefined`, which the caller treats as "no
 * declared size" rather than refusing — the previous side is state-borne.
 */
-function comparableRecordSize(value) {
-	const read = readMaxRecordSize(value);
+function comparableRecordSize(value, mask) {
+	const read = readMaxRecordSize(value, mask);
 	return read.kind === "usable" ? read.size : void 0;
 }
 /**
@@ -49910,13 +49801,15 @@ var KinesisStreamProvider = class {
 	* Create a Kinesis stream
 	*/
 	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
-		if (desiredRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
+		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
+		if (desiredRead.kind === "unusable") if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
 		else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
-		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
-		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
+		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
+		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
 		else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -49994,7 +49887,9 @@ var KinesisStreamProvider = class {
 	* RetentionPeriodHours, StreamEncryption, and Tags. Name changes require
 	* replacement (handled by the deployment layer).
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Updating Kinesis stream ${logicalId}: ${physicalId}`);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -50064,10 +49959,10 @@ var KinesisStreamProvider = class {
 					await this.waitForStreamActive(physicalId);
 				}
 			}
-			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
-			if (desiredSizeRead.kind === "unusable") this.logger.warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
-			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"]);
-			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"]);
+			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
+			if (desiredSizeRead.kind === "unusable") warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
+			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"], mask);
+			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
 			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== oldMaxRecordSize) {
 				this.logger.debug(`Updating max record size for ${physicalId}: ${oldMaxRecordSize} -> ${newMaxRecordSize}`);
 				await this.getClient().send(new UpdateMaxRecordSizeCommand({
@@ -50076,9 +49971,9 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
-			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 			let desiredMetrics;
-			if (desiredRead.kind === "unusable") this.logger.warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
+			if (desiredRead.kind === "unusable") warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
 			else {
 				desiredMetrics = desiredRead.kind === "usable" ? desiredRead.expanded : void 0;
 				const desiredSet = desiredRead.kind === "usable" ? desiredRead.metrics : [];
@@ -88120,4 +88015,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-I-xR_ceK.js.map
+//# sourceMappingURL=program-BfK9a98r.js.map