@go-to-k/cdkd 0.284.10 → 0.284.12

package/dist/{deploy-engine-DGuaeWaV.js → deploy-engine-nwoIJsLn.js}

@@ -11095,6 +11095,159 @@ function maskSecretsInText(text, secrets) {
 	return text.replace(regex, "***");
 }
 /**
+* How deep {@link maskSecretsInError} follows a `cause` chain. A CYCLE is
+* already handled by the visited-set, so this bounds only a pathologically long
+* chain; the same bounded-walk shape `extractDeploymentEventError` (depth 10)
+* and the retry classifiers (depth 5) use. A link BEYOND the cap keeps its
+* original, UNMASKED message, and the last cloned link points at it.
+*/
+const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
+/**
+* The `cause` chain of `root`, root first, stopping at the first non-`Error`
+* link, at a link already visited (so a cycle terminates instead of hanging),
+* or at {@link ERROR_CAUSE_MASK_MAX_DEPTH}.
+*/
+function errorCauseChain(root) {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = root;
+	while (current instanceof Error && !seen.has(current) && chain.length < ERROR_CAUSE_MASK_MAX_DEPTH) {
+		seen.add(current);
+		chain.push(current);
+		current = current.cause;
+	}
+	return chain;
+}
+/**
+* Return `error` with {@link maskSecretsInText} applied to the `message` AND the
+* `stack` of every link in its `cause` chain, with everything else about each
+* link preserved (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)
+* review).
+*
+* Two bounds on that "every link", both stated here because the PUBLIC contract
+* is what a caller reads and neither is visible from the call site:
+* - The walk stops at {@link ERROR_CAUSE_MASK_MAX_DEPTH}. A chain longer than
+*   that keeps its remaining links' ORIGINAL, UNMASKED messages, and the last
+*   cloned link points straight at them.
+* - A `cause` that is not an `Error` (a string, a plain object) is carried
+*   through VERBATIM and is never masked — the walk has nothing to clone. No
+*   cdkd or AWS SDK site constructs one today, so this is a documented residual
+*   rather than a reachable leak, but a caller attaching arbitrary data as a
+*   `cause` must mask it itself. `src/cli/index.ts`'s `console.error` renders
+*   such a cause via `util.inspect`, so it WOULD reach the terminal.
+*
+* **Why an error and not just its text.** `formatError` (`src/utils/error-handler.ts`)
+* renders a `CdkdError`'s CAUSE as `Caused by: <cause.message>`, and `handleError`
+* logs that at `error` level for any failure that escapes a command — so a raw
+* provider error attached as a `ProvisioningError`'s cause reaches the terminal
+* verbatim, at DEFAULT verbosity, even when every log site that INTERPOLATED
+* the message masked it. Masking the string at each log site cannot close that:
+* the sink reads the error OBJECT.
+*
+* `formatError` is not the only such sink, and the second one is what makes the
+* CHAIN argument below concrete rather than hypothetical: `src/cli/index.ts`'s
+* top-level `main().catch(...)` does `console.error('Fatal error:', error)`,
+* which renders the whole object through `util.inspect` — every `[cause]` link
+* AND every link's `stack`. Measured: an outer `Error('top')` wrapping
+* `Error("Value 'hunter2' failed")` prints as
+* `Error: top ... { [cause]: Error: Value 'hunter2' failed ... }`. So a
+* multi-level sink exists TODAY, and it is why `stack` is masked below rather
+* than merely preserved.
+*
+* **Why the whole CHAIN and not just the top link.** Masking only `error.message`
+* looks sufficient because `formatError` renders one level — and it is not, in
+* two ways that a top-level-only fix gets exactly backwards. A provider that
+* wraps an AWS failure in a generic sentence (`new Error('the call failed',
+* { cause: awsError })`) leaves the plaintext ONE link down, where the
+* identity-return below then reports "nothing to mask" and hands back an object
+* still carrying it — the function's own contract says the returned error is
+* safe to render, and every later reader believes it. And `formatError`
+* rendering a single level is an implementation detail: one edit there (walking
+* the chain is the obvious improvement) re-opens the hole with nothing failing.
+* So the invariant is about the OBJECT, not about today's renderer.
+*
+* **Why a clone rather than assigning to `error.message`.** The argument is an
+* error cdkd did not create — usually the AWS SDK's — and mutating a caller's
+* object is visible to every other holder of it, including a retry loop that
+* may still classify it. Each link's clone copies the prototype and EVERY own
+* property descriptor, symbols included, so the three things that read a cause
+* chain keep working: `isMarkedNonRetryable` (a non-enumerable `Symbol.for`
+* marker), `extractDeploymentEventError` / `isThrottlingError` /
+* `isTransientServerError` (`$metadata`, `Code`, `name`), and the chain itself.
+* `Object.assign` would have dropped the marker, which is why the descriptors
+* form is used.
+*
+* `message`, `cause` and `stack` are the three descriptors deliberately NOT
+* copied through: each is re-defined per link, and copying a NON-CONFIGURABLE
+* original would make that re-definition throw. `cause` is rewired to the CLONE
+* of whatever it pointed at, in a second pass over the already-built clone map —
+* which is what makes a cyclic chain terminate rather than recurse. A `cause`
+* that is not an `Error` (a string, a plain object) keeps its original
+* descriptor verbatim.
+*
+* **Why `stack` is re-defined as DATA rather than copied.** V8 installs `stack`
+* as an own ACCESSOR whose getter reads a slot the engine attaches to an error
+* IT created, so copying that descriptor onto an `Object.create` clone yields a
+* getter with nothing behind it and `clone.stack` reads `undefined` (measured).
+* That is not a leak today — the clone is only ever reached as a `cause`, and
+* `handleError` prints the TOP-level error's stack — but this function is
+* exported and generic, so a future top-level caller would get back an error
+* with no trace at all. The clone therefore carries a masked COPY of the
+* original's stack text, which both preserves the trace and closes the sink the
+* copy would otherwise open: a stack's first line embeds the message, so an
+* unmasked stack re-exposes exactly the plaintext the `message` mask removed —
+* and `util.inspect` prints it. An original with no readable string `stack`
+* (not an engine-created error) simply gets no own `stack`, as before.
+*
+* Returns the ORIGINAL object by identity when NOTHING ANYWHERE IN THE CHAIN
+* changed, so a non-secret failure keeps referential equality and the common
+* path allocates nothing.
+*/
+function maskSecretsInError(error, secrets) {
+	if (secrets.size === 0 || !(error instanceof Error)) return error;
+	const chain = errorCauseChain(error);
+	const maskedMessages = chain.map((link) => maskSecretsInText(link.message, secrets));
+	if (maskedMessages.every((masked, i) => masked === chain[i].message)) return error;
+	const clones = /* @__PURE__ */ new Map();
+	for (const [i, original] of chain.entries()) {
+		const descriptors = {};
+		for (const key of Reflect.ownKeys(original)) {
+			if (key === "message" || key === "cause" || key === "stack") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(original, key);
+			if (descriptor) descriptors[key] = descriptor;
+		}
+		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
+		Object.defineProperty(clone, "message", {
+			value: maskedMessages[i],
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		const originalStack = original.stack;
+		if (typeof originalStack === "string") Object.defineProperty(clone, "stack", {
+			value: maskSecretsInText(originalStack, secrets),
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		clones.set(original, clone);
+	}
+	for (const original of chain) {
+		const causeDescriptor = Object.getOwnPropertyDescriptor(original, "cause");
+		if (!causeDescriptor) continue;
+		const clone = clones.get(original);
+		const causeValue = original.cause;
+		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
+		Object.defineProperty(clone, "cause", replacement ? {
+			value: replacement,
+			writable: true,
+			enumerable: causeDescriptor.enumerable === true,
+			configurable: true
+		} : causeDescriptor);
+	}
+	return clones.get(error);
+}
+/**
 * Bind a {@link RecordedSecretValues} bag into a {@link SecretMasker} for a
 * caller to hand to a provider.
 *
@@ -16053,7 +16206,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ChVCjyK2.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CkIFzX7p.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -16741,6 +16894,33 @@ const CR_NO_PROPERTIES_SKIP_REASON = "no properties in state — Delete handler
 */
 const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete handler not invoked";
 /**
+* Third sibling of the two above, for the arm where cdkd HAD everything it
+* needed and the Delete request still could not be completed — a permanent
+* `lambda:InvokeFunction` denial, an exhausted readiness waiter, a response
+* that never arrived.
+*
+* That arm used to swallow the error and return `undefined`, which
+* `deleteSkipReason` reads as DELETED: `cdkd destroy` printed `✓ … deleted`,
+* dropped the state record and exited 0 over a handler that never received a
+* `Delete` — silently orphaning everything that handler manages. It is the
+* same silent-orphan class issue
+* [#1752](https://github.com/go-to-k/cdkd/issues/1752) removed from the two
+* arms above, reached through the catch rather than through a guard.
+*
+* **Fixed wording, no interpolation.** The underlying AWS message goes out on
+* the `logger.warn` beside it and NOT into the reason, because a `reason` is
+* rendered into the `Error` the deploy-side replacement sites throw, whose
+* catch classifies an already-deleted resource by SUBSTRING — an AWS message
+* carrying `does not exist` / `not found` would make a skip read as "already
+* gone" and drop the record again, one layer further out. Same rule the
+* `sns-subscription` abort follows.
+*
+* The premise is "the resource was NOT destroyed", not "no AWS call was
+* issued": the handler may have run and failed, or run and had its response
+* lost. Both leave the resource unproven, which is what a skip asserts.
+*/
+const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
+/**
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
@@ -16795,12 +16975,115 @@ function decodeInvokeLogTail(logResult) {
 	}
 }
 /**
+* Recover the backing function's own STATUS fields from an
+* `@smithy/util-waiter` failure message, or `undefined` when they are not
+* there (issue #2033).
+*
+* The message is `JSON.stringify(result)` and `result.reason` is, for both
+* Lambda readiness waiters, the ENTIRE `GetFunction` response. Only these
+* AWS-authored status fields are lifted out of it — never the whole payload,
+* which carries `Configuration.Environment.Variables` into a durable store.
+*
+* Best-effort by construction: a non-JSON message, a different waiter shape, or
+* a payload with no `Configuration` all yield `undefined`, and the caller falls
+* back to a fixed sentence.
+*/
+function extractWaiterFunctionStatus(message) {
+	let parsed;
+	try {
+		parsed = JSON.parse(message);
+	} catch {
+		return;
+	}
+	const config = (parsed?.reason)?.Configuration;
+	if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
+	const fields = config;
+	const parts = [];
+	for (const key of [
+		"State",
+		"StateReasonCode",
+		"StateReason",
+		"LastUpdateStatus",
+		"LastUpdateStatusReasonCode",
+		"LastUpdateStatusReason"
+	]) {
+		const value = fields[key];
+		if (typeof value === "string" && value !== "") parts.push(`${key}=${value}`);
+	}
+	return parts.length > 0 ? parts.join(", ") : void 0;
+}
+/**
+* Render a Lambda readiness-waiter failure for a message that is persisted
+* (issue #2033) — see `waitForBackingLambdaReady` for the whole argument.
+*
+* TIMEOUT / ABORT keep the waiter's own message: its `observedResponses` keys
+* are status lines `@smithy/util-waiter` builds itself (`403: <AWS message>`),
+* which is exactly the diagnostic a stalled waiter needs and carries no
+* response body. Every other state serialized the full `GetFunction` response,
+* so that arm reports the error NAME plus the function's own status fields.
+*/
+function describeWaiterFailure(error) {
+	const name = error instanceof Error ? error.name : "Error";
+	const message = error instanceof Error ? error.message : String(error);
+	if (name === "TimeoutError" || name === "AbortError") return message;
+	return `${name} (${extractWaiterFunctionStatus(message) ?? "no function status reported"}). The waiter's raw payload is withheld because it embeds the whole GetFunction response, environment variables included; run \`aws lambda get-function\` for the detail.`;
+}
+/**
 * IAM-authorization-propagation signals in a custom resource FAILED reason that
 * indicate the backing Lambda's freshly-attached execution-role policy has not
 * yet taken effect for its assumed-role session (so a recycle + retry will
 * succeed once IAM settles). Lowercase substrings. Intentionally narrow — these
 * are the IAM-permission-not-yet-effective phrases only, NOT generic transient
 * errors (throttling / timeouts), which must not trigger a CR re-invoke.
+*
+* **This set is deliberately NARROWER than
+* `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` (`src/deployment/retryable-errors.ts`)
+* and stays that way** (issue
+* [#2033](https://github.com/go-to-k/cdkd/issues/2033), which asked whether the
+* narrowing was still intended or a list that had stopped tracking its
+* counterpart).
+*
+* "Narrower", not "a subset" — an earlier revision of this comment said SUBSET
+* and that was FALSE of the list beside it. Three of these six entries appear
+* in no form in the shared list (`no identity-based policy allows`, both
+* `not in the state functionActive` spellings), and a fourth appears there only
+* ANCHORED: the shared list carries `Firehose is unable to assume role` /
+* `is unable to assume provided role` / `is unable to assume the role` and
+* deliberately refuses the bare `is unable to assume` this list uses, so that a
+* permanent `... is unable to assume role X because of an explicit deny` cannot
+* burn a retry budget. The bare spelling is right HERE — the text is the
+* handler's own reason about the race cdkd created — and wrong for AWS-authored
+* text about a call cdkd made, which is why
+* {@link CR_THROWN_AUTHZ_EXTRA_SIGNALS} does not re-export it.
+*
+* The narrowing is intended, because the two lists are consumed under different
+* COSTS and classify text with different AUTHORS:
+*
+*  - This set is matched against the HANDLER's own FAILED `Reason` (and, since
+*    #1674, against arbitrary handler stdout in the log tail). A match here buys
+*    a re-INVOKE, which re-runs the user's `Create` — a non-idempotent handler
+*    repeats partial work, and a Provider-framework `onEvent` can create a
+*    SECOND physical resource and orphan the first (the accepted cost stated on
+*    {@link CR_TRANSIENT_AUTHZ_LOG_SIGNALS}). So the phrases must name the race
+*    cdkd ITSELF created — the backing function's freshly-attached execution
+*    role — and nothing else. Most of the superset's entries describe a
+*    DOWNSTREAM call the handler made (`Invalid principal in policy`,
+*    `Cannot access stream`, `KMS key is invalid for CreateGrant`,
+*    `Invalid InstanceProfile`, …); a re-invoke is not the remedy for those, so
+*    each one would buy a recycle plus an identical re-failure. The three the
+*    issue named specifically — `role defined for the function`, `trust policy`,
+*    `Invalid principal in policy` — are exactly that shape when they arrive in
+*    a handler-authored reason, and the first two are ALREADY covered here in
+*    the spelling that matters (`cannot be assumed` / `is unable to assume` are
+*    what Lambda emits for an unassumable execution role).
+*  - The shared list is matched against text AWS wrote about a call CDKD made.
+*    It is used, in full, by
+*    {@link CustomResourceProvider.isTransientAuthzThrow} for a THROWN error
+*    from one of the provider's OWN SDK calls — see that method for why the
+*    wider list is correct there and costs nothing extra.
+*
+* So the answer to "should these converge" is no; what was genuinely missing was
+* the second consumer, not a wider first one.
 */
 const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"not authorized to perform",
@@ -16811,6 +17094,27 @@ const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"is unable to assume"
 ];
 /**
+* The CR-specific spellings {@link CustomResourceProvider.isTransientAuthzThrow}
+* adds ON TOP of `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` — i.e. exactly the
+* phrases the shared list does not carry in any form (issue #2033).
+*
+* Deliberately NOT `CR_TRANSIENT_AUTHZ_SIGNALS` itself, which is what the first
+* cut of the fix used. Three of that list's entries are already covered by the
+* shared list (`not authorized to perform` / `cannot be assumed`, plus the three
+* ANCHORED `unable to assume` spellings), so re-uniting the whole thing bought
+* nothing except the bare, UN-anchored `is unable to assume` — which the shared
+* list refuses on purpose so a permanent explicit-deny cannot spend a 47.75s
+* budget before failing. This list is the difference, and only the difference.
+*
+* Lower-cased substrings, matched against a lower-cased message (the shared list
+* is mixed-case and matched verbatim by `isIamPropagationError`).
+*
+* `is not in the state functionactive` from the sibling list is omitted as a
+* pure superstring of the entry below it: any message matching it matches this
+* one too.
+*/
+const CR_THROWN_AUTHZ_EXTRA_SIGNALS = ["no identity-based policy allows", "not in the state functionactive"];
+/**
 * The same IAM-authorization-propagation signals, matched against the backing
 * function's INVOCATION LOG TAIL rather than the FAILED reason (issue #1674).
 *
@@ -16871,6 +17175,37 @@ const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
 * at 4 KB regardless, so this only trims the extreme case.
 */
 const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
+/** Default for `CDKD_CR_AUTHZ_MAX_RETRIES` — see `transientAuthzMaxRetries`. */
+const CR_AUTHZ_MAX_RETRIES_DEFAULT = 2;
+/**
+* Hard ceiling for `CDKD_CR_AUTHZ_MAX_RETRIES`.
+*
+* The knob's units are RE-INVOCATIONS OF THE USER'S HANDLER, each one also
+* paying a `recycleBackingFunctionExecEnv` (an `UpdateFunctionConfiguration`
+* plus a 120s waiter). Ten of those is already far past the point where an
+* IAM-propagation race would have settled, so anything above it is a typo or a
+* misunderstanding rather than a preference — and left unclamped a `1e9`
+* passes the finite / `>= 0` gate and re-invokes until the deploy engine's
+* per-resource deadline fires an hour later.
+*/
+const CR_AUTHZ_MAX_RETRIES_CEILING = 10;
+/**
+* Bound for the `.cause` walks in this file, matching the depth
+* `isMarkedNonRetryable` / `isThrottlingError` use in
+* `src/deployment/retryable-errors.ts`. Bounded rather than unbounded so a
+* cyclic chain cannot hang the classifier.
+*/
+const CR_ERROR_CAUSE_MAX_DEPTH = 5;
+/**
+* Sleep seam for this provider's hand-rolled waits (the pre-delivery retry
+* backoff and the S3 response poll).
+*
+* Mutable module state ONLY so tests can run a 47.75s retry schedule without
+* spending 47.75s; production never reassigns it. Mirrors the
+* `deleteTableRetryDelays.sleep` seam the DynamoDB providers use, and the
+* `sleep` option `withRetry` already exposes for the same reason.
+*/
+const customResourceRetryDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
 * Lines Lambda emits for EVERY invocation regardless of what the handler logged.
 * A tail consisting only of these carries no diagnostic value, and it is the
@@ -17010,6 +17345,24 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* exponential backoff for async patterns (CDK Provider framework with
 	* isCompleteHandler), so an outer retry adds nothing but the multi-
 	* key bug.
+	*
+	* **Opting out of the outer loop is a promise to retry HERE, and that
+	* promise is kept PER CALL — not per attempt.** Issue
+	* [#2033](https://github.com/go-to-k/cdkd/issues/2033) found the claim
+	* backed for exactly one error SHAPE: the internal loop keyed only on the
+	* handler's RETURNED `cfnResponse.Status === 'FAILED'`, and its body had no
+	* `try` / `catch` at any point, so a THROWN error from any AWS SDK call the
+	* provider itself makes left `create()` directly and was single-shot — while
+	* every other resource type got 26 retries over 47.75s for the identical
+	* wording. The per-call decision, in one place:
+	*
+	* | call | retried on a throw? | why |
+	* |---|---|---|
+	* | S3 `PutObject` (response-key placeholder) | YES, own `withRetry` (the standard dense propagation schedule, 47.75s) — and its exhausted throw is `markNonRetryable`d so the loop below cannot spend a SECOND budget on it | idempotent PUT of an empty object at a key cdkd just minted; touches no response-URL lifecycle, so a replay is free |
+	* | Lambda `Invoke` / SNS `Publish` | YES, but only PRE-DELIVERY, on {@link CustomResourceProvider.preDeliveryAuthzMaxRetries} — its OWN budget, the same dense 47.75s schedule every other resource type gets | a replay re-delivers the request, which is the hazard this flag exists for, so the PRE-delivery fence is what makes the budget affordable: nothing has been delivered, so a replay re-invokes NOTHING — see {@link CustomResourceProvider.isTransientAuthzThrow} |
+	* | `waitUntilFunctionActiveV2` / `waitUntilFunctionUpdatedV2` | ALREADY, by the SDK waiter — and their wrapped failure is `markNonRetryable`d, so the loop below does not replay it either | measured against `@aws-sdk/client-lambda`: the generated `checkState` catches EVERY exception and returns `RETRY`, so a mid-propagation 403 on `lambda:GetFunction` is polled out to `maxWaitTime` (600s). Wrapping them again would only stack a second budget on top — and `@smithy/util-waiter` serializes its `observedResponses` into the TIMEOUT message, whose keys read `403: User: … is not authorized to perform: lambda:GetFunction …`, so a classifier reading that message would have replayed a PERMANENT denial for 3 x 600s |
+	* | `GetFunction` (delete-path backing-Lambda probe) | NO, deliberately | it already fails OPEN — anything but a definitive `ResourceNotFoundException` falls through to the normal invoke path, whose waiters cover the same propagation window one call later. Retrying would only delay that fall-through by up to 47.75s on a genuine permission denial |
+	* | anything AFTER delivery (`pollS3Response`, the `FunctionError` throw, `cleanupResponseObject`) | NO, deliberately | the handler is running and will PUT to the URL of THIS attempt; a replay strands it at a key nobody polls, which is precisely the bug `disableOuterRetry` prevents |
 	*/
 	disableOuterRetry = true;
 	/** Max time to wait for synchronous S3 response after Lambda invocation (30 seconds) */
@@ -17023,8 +17376,13 @@ var CustomResourceProvider = class CustomResourceProvider {
 	/** Max poll interval for async polling with exponential backoff (30 seconds) */
 	MAX_POLL_INTERVAL_MS = 3e4;
 	/**
-	* How many extra times to re-invoke a custom resource whose handler returned
-	* FAILED with a *transient IAM-authorization* reason (e.g. the CDK Provider
+	* How many extra times to RE-INVOKE a custom resource whose handler returned
+	* FAILED with a *transient IAM-authorization* reason.
+	*
+	* TWO error shapes, TWO budgets, deliberately (issue #2033) — this one and
+	* {@link CustomResourceProvider.preDeliveryAuthzMaxRetries}. This budget
+	* governs the shape where the handler ALREADY RAN: it returned FAILED with a
+	* transient-authz reason (e.g. the CDK Provider
 	* framework's `lambda:GetFunction` / "not in the state functionActive" 403
 	* when the framework role's freshly-attached inline policy has not yet
 	* propagated to the assumed-role session). cdkd's fast SDK path invokes the
@@ -17036,16 +17394,67 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* `disableOuterRetry` to avoid stranding a pre-signed response URL — so we
 	* retry HERE instead, deriving a fresh response URL + RequestId per attempt
 	* and recycling the backing function's execution environment between tries).
-	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES`. `0` disables the RETRY only —
+	*
+	* **It is SMALL (2) because every retry it authorises RE-RUNS THE USER'S
+	* HANDLER**, and that is the whole reason the second shape does not share it:
+	* a pre-delivery throw invokes the handler ZERO times, so the argument that
+	* bounds this number does not apply there at all. Sharing it was measured
+	* wrong — 2 retries on the dense schedule is 250ms + 500ms of coverage, i.e.
+	* 0.75s against an IAM-propagation window this repo has measured at 7-12s, so
+	* issue #2033's own scenario still failed with the fix in place.
+	*
+	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES` (clamped to
+	* {@link CR_AUTHZ_MAX_RETRIES_CEILING}). `0` disables the RE-INVOKE only —
 	* the issue-#1674 log-tail scan and the reason annotation it produces still
 	* run, because they describe the failure rather than react to it.
+	*
+	* It does NOT disable either of the two retries that cannot reach the
+	* handler: the response-placeholder `PutObject` retry in
+	* `generateResponseURL`, and the pre-delivery arm above. Neither is what this
+	* knob exists to bound — it bounds how many times a user's handler may be
+	* re-run — and a user turning off re-invokes should not thereby lose the
+	* propagation coverage every other resource type gets for free.
 	*/
 	transientAuthzMaxRetries = (() => {
 		const raw = process.env["CDKD_CR_AUTHZ_MAX_RETRIES"];
-		if (raw === void 0 || raw === "") return 2;
+		if (raw === void 0 || raw === "") return CR_AUTHZ_MAX_RETRIES_DEFAULT;
 		const n = Number(raw);
-		return Number.isFinite(n) && n >= 0 ? n : 2;
+		if (!Number.isFinite(n) || n < 0) return CR_AUTHZ_MAX_RETRIES_DEFAULT;
+		const clamped = Math.min(Math.floor(n), CR_AUTHZ_MAX_RETRIES_CEILING);
+		if (clamped !== n) this.logger.warn(`CDKD_CR_AUTHZ_MAX_RETRIES=${raw} is out of range; using ${clamped} (whole numbers, at most ${CR_AUTHZ_MAX_RETRIES_CEILING} — each retry re-invokes the custom resource handler).`);
+		return clamped;
 	})();
+	/**
+	* Budget for the PRE-DELIVERY thrown arm — a transient IAM-authorization
+	* error thrown by the `Invoke` / `Publish` itself BEFORE the request reached
+	* the handler (issue #2033). The reported shape is an `AccessDeniedException`
+	* on `lambda:InvokeFunction` while the DEPLOYING principal's own
+	* freshly-attached policy is still propagating.
+	*
+	* It is {@link IAM_PROPAGATION_MAX_RETRIES} — the same 26 retries over 47.75s
+	* that `withRetry` gives every other resource type for the identical wording,
+	* on the same dense schedule ({@link IAM_PROPAGATION_INITIAL_DELAY_MS}
+	* doubling to {@link IAM_PROPAGATION_MAX_DELAY_MS}). The measured window this
+	* has to cover is 7-12s; the FAILED-response budget's 0.75s does not.
+	*
+	* **Why it can afford that while its sibling cannot**: it fires only when
+	* `delivered === false`, so the handler has been invoked ZERO times and a
+	* replay re-runs NOTHING — no partial work repeated, no second physical
+	* resource from a Provider-framework `onEvent`, no stranded response URL. The
+	* only cost of a retry here is one `PutObject` + one presign, and the
+	* abandoned placeholder is swept before the next attempt. So the constraint
+	* that keeps `transientAuthzMaxRetries` at 2 is simply absent, and matching
+	* every other resource type is the correct answer instead.
+	*
+	* A thrown retry also skips the exec-env recycle: the denial is on CDKD's own
+	* principal, not on the backing function's role, so there is no warm
+	* container holding stale credentials to invalidate.
+	*
+	* Deliberately NOT overridable by an env var. It bounds no handler
+	* invocation, so there is nothing for a user to trade off — the same reason
+	* the placeholder `PutObject`'s `withRetry` takes no knob either.
+	*/
+	preDeliveryAuthzMaxRetries = 26;
 	constructor(config) {
 		const awsClients = getAwsClients();
 		this.lambdaClient = awsClients.lambda;
@@ -17252,7 +17661,11 @@ var CustomResourceProvider = class CustomResourceProvider {
 			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
 			else this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record so a re-run can retry it. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
+			};
 		}
 	}
 	/**
@@ -17309,31 +17722,71 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* `prepareInvocation()`) and recycling the backing function's execution
 	* environment between tries so its next cold start re-assumes the role.
 	*
+	* **The loop covers TWO error shapes** (issue #2033). The original one is the
+	* handler's RETURNED `Status: 'FAILED'`. The second is an error THROWN by one
+	* of the provider's OWN SDK calls before the request reached the handler —
+	* which used to leave `create()` directly, because the loop body had no
+	* `try` / `catch` at any point, making every such call single-shot while every
+	* other resource type got the outer `withRetry`'s 26 attempts for the identical
+	* wording. The `delivered` flag below is what keeps the second arm honest: it
+	* flips the moment `Invoke` / `Publish` RETURNS, and a throw after that point
+	* is rethrown untouched no matter how transient it reads, because the handler
+	* is running and will PUT to THIS attempt's response URL. See
+	* {@link CustomResourceProvider.disableOuterRetry} for the whole per-call
+	* table, and {@link CustomResourceProvider.isTransientAuthzThrow} for why a
+	* PRE-delivery throw is safe to replay at all.
+	*
 	* `buildRequest` is called once per attempt with the fresh invocation so the
 	* CFn request body always carries the matching ResponseURL / RequestId.
 	* Returns the final response; the caller decides what a terminal FAILED means
 	* (create/update throw, delete warns-and-continues).
 	*/
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
-		for (let attempt = 0;; attempt++) {
-			const invocation = await this.prepareInvocation();
-			const request = buildRequest(invocation);
-			this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
-			const { response: cfnResponse, logResult } = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
-			const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
-			const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
-			const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
-			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
-				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
-				await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
-				continue;
+		const watch = this.startInterruptWatch(logicalId);
+		try {
+			let preDeliveryRetries = 0;
+			let failedResponseRetries = 0;
+			for (let attempt = 0;; attempt++) {
+				let delivered = false;
+				let cfnResponse;
+				let logResult;
+				let invocation;
+				try {
+					invocation = await this.prepareInvocation(logicalId, watch);
+					const request = buildRequest(invocation);
+					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
+					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
+						delivered = true;
+					});
+					cfnResponse = sent.response;
+					logResult = sent.logResult;
+				} catch (error) {
+					if (delivered || preDeliveryRetries >= this.preDeliveryAuthzMaxRetries || !this.isTransientAuthzThrow(error)) throw error;
+					const delayMs = Math.min(250 * Math.pow(2, preDeliveryRetries), IAM_PROPAGATION_MAX_DELAY_MS);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(error instanceof Error ? error.message : String(error))}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
+					if (invocation !== void 0) await this.cleanupResponseObject(invocation.responseKey);
+					preDeliveryRetries += 1;
+					await this.sleepInterruptibly(delayMs, watch);
+					continue;
+				}
+				const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
+				const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
+				const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
+				if (cfnResponse.Status === "FAILED" && failedResponseRetries < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
+					failedResponseRetries += 1;
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
+					await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
+					continue;
+				}
+				if (cfnResponse.Status === "FAILED" && logAuthzMatch !== void 0) return {
+					...cfnResponse,
+					Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
+				};
+				if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
+				return cfnResponse;
 			}
-			if (cfnResponse.Status === "FAILED" && logAuthzMatch !== void 0) return {
-				...cfnResponse,
-				Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
-			};
-			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
-			return cfnResponse;
+		} finally {
+			watch.dispose();
 		}
 	}
 	/**
@@ -17355,6 +17808,63 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return CR_TRANSIENT_AUTHZ_SIGNALS.some((p) => lower.includes(p));
 	}
 	/**
+	* Classify an error THROWN by one of the provider's own SDK calls as a
+	* transient IAM-authorization race worth replaying (issue #2033).
+	*
+	* The list is cdkd's shared `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` — the
+	* same one every other resource type is classified with, via `withRetry` —
+	* plus {@link CR_THROWN_AUTHZ_EXTRA_SIGNALS}, the two CR-specific spellings
+	* the shared list does not carry in any form. That is deliberately WIDER than
+	* the FAILED-reason classifier, and the asymmetry is the whole point: this
+	* text was written by AWS about a call CDKD made, whereas a FAILED reason was
+	* written by the user's handler about a call IT made. See
+	* {@link CR_TRANSIENT_AUTHZ_SIGNALS} for the full argument, including why the
+	* bare `is unable to assume` spelling stays on that side of the line.
+	*
+	* **Two REFUSALS come before any pattern**, and each closes a way for a
+	* single call to be given two retry budgets:
+	*
+	*  - `isMarkedNonRetryable` — cdkd's own declaration that this raising cannot
+	*    succeed on a replay. Both of the provider's already-retried calls stamp
+	*    it: the placeholder `PutObject` after its `withRetry` is exhausted, and
+	*    `waitForBackingLambdaReady` after the SDK waiter has polled for its full
+	*    600s. The marker rather than the wording is what makes the second one
+	*    sound: `@smithy/util-waiter` serializes `observedResponses` into its
+	*    TIMEOUT message and those keys read
+	*    `403: User: … is not authorized to perform: lambda:GetFunction …`, so a
+	*    PERMANENT denial matched every pattern here and a message-shaped fence
+	*    would be one AWS wording change from failing open. It also refuses a
+	*    cdkd-authored REFUSAL whose text happens to carry an authz phrase.
+	*  - the `.cause` chain is WALKED (bounded), matching `isThrottlingError` /
+	*    `isMarkedNonRetryable`. cdkd wraps SDK errors routinely, and issue #2040
+	*    documents the drop-`cause` class in this very directory; a top-level-only
+	*    read would silently un-retry a wrapped propagation denial.
+	*
+	* **Every pattern in that union is an AUTHORIZATION or REQUEST-VALIDATION
+	* rejection, and that is what makes replaying an `Invoke` safe here.** Such a
+	* rejection is decided at the API front door, before any execution environment
+	* is engaged, so the handler provably did not run and a replay cannot
+	* re-deliver work — the hazard `disableOuterRetry` exists for. It is also why
+	* this classifier deliberately does NOT reach for the broader
+	* `isRetryableTransientError`: a throttle, an HTTP 5xx or a socket timeout can
+	* each arrive AFTER the request was accepted, so replaying one could invoke a
+	* non-idempotent handler twice. Those classes stay single-shot on this path by
+	* design, and the caller's `delivered` flag is the second, independent fence.
+	*/
+	isTransientAuthzThrow(error) {
+		if (isMarkedNonRetryable(error)) return false;
+		let current = error;
+		for (let depth = 0; depth < CR_ERROR_CAUSE_MAX_DEPTH && current != null; depth++) {
+			const message = current instanceof Error ? current.message : typeof current === "string" ? current : "";
+			if (message !== "") {
+				const lower = message.toLowerCase();
+				if (isIamPropagationError(message) || CR_THROWN_AUTHZ_EXTRA_SIGNALS.some((p) => lower.includes(p))) return true;
+			}
+			current = current.cause;
+		}
+		return false;
+	}
+	/**
 	* Find the IAM-authorization denial inside a backing function's invocation
 	* log tail, for the case the FAILED reason itself carries none (issue #1674).
 	*
@@ -17440,15 +17950,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* erased from the FAILED reason (issue #1674). Returned UNDECODED so the
 	* happy path pays nothing — only a FAILED whose reason missed decodes it.
 	* Absent on the SNS path: there is no Lambda invoke to attach a log to.
+	*
+	* `onDelivered` is invoked exactly once, the moment the `Invoke` / `Publish`
+	* RETURNS — i.e. at the point after which a replay would re-deliver the
+	* request to the handler and strand this attempt's pre-signed response URL.
+	* The caller's retry-on-throw arm is fenced on it (issue #2033). Deliberately
+	* called AFTER the send rather than before: a rejection at the API front door
+	* (the IAM-propagation class this arm exists for) means the handler never ran,
+	* and treating that as delivered would leave the reported failure single-shot.
 	*/
-	async sendRequest(serviceToken, request, responseKey, logicalId, operation) {
+	async sendRequest(serviceToken, request, responseKey, logicalId, operation, onDelivered) {
 		if (this.isSnsServiceToken(serviceToken)) {
 			this.logger.debug(`ServiceToken is SNS topic, publishing to: ${serviceToken}`);
 			await this.publishToSns(serviceToken, request);
+			onDelivered();
 			return { response: await this.pollS3Response(responseKey, logicalId, operation) };
 		}
 		await this.waitForBackingLambdaReady(serviceToken, logicalId);
 		const invokeResponse = await this.invokeLambda(serviceToken, request);
+		onDelivered();
 		return {
 			response: await this.getCustomResourceResponse(invokeResponse, responseKey, logicalId, operation),
 			...invokeResponse.LogResult === void 0 ? {} : { logResult: invokeResponse.LogResult }
@@ -17481,6 +18001,37 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* deploy engine's per-resource `--resource-timeout` (default 30 min)
 	* still bounds the outer Custom Resource provisioning attempt, so
 	* this waiter cap is layered defense, not the only timeout.
+	*
+	* **The wrapped failure is `markNonRetryable`d, and its message is NOT the
+	* waiter's** (issue #2033). Both halves are about `@smithy/util-waiter`'s
+	* `checkExceptions`, which serializes its whole result into the `Error`
+	* message:
+	*
+	*  - On TIMEOUT that includes `observedResponses`, whose keys read
+	*    `403: User: … is not authorized to perform: lambda:GetFunction on
+	*    resource: …`. The waiter's generated `checkState` catches EVERY
+	*    exception and returns `RETRY`, so reaching here means a 600s budget was
+	*    already spent — yet the message matched
+	*    {@link CustomResourceProvider.isTransientAuthzThrow} exactly, so a
+	*    PERMANENT `lambda:GetFunction` denial was replayed for 3 x 600s instead
+	*    of 10 minutes, blowing any `--resource-timeout
+	*    AWS::CloudFormation::CustomResource=15m`. The marker is a property of
+	*    the error object, so unlike a wording test it cannot be defeated by AWS
+	*    rephrasing the denial.
+	*  - On the non-TIMEOUT arm (`State: Failed`, i.e. an ENI / VPC failure) the
+	*    serialized result carries `reason` and `final`, which for this waiter
+	*    are the ENTIRE `GetFunction` response — `Configuration.Environment.
+	*    Variables` included. That message reached `ProvisioningError.message`
+	*    and `extractDeploymentEventError` persisted it to
+	*    `deployments/{runId}.jsonl`, a durable store that outlives
+	*    `cdkd destroy` and is contractually "error + metadata only, never
+	*    resource properties, because they may contain secrets"
+	*    (`docs/deployment-events.md`). So this arm interpolates the error NAME
+	*    plus a fixed sentence, and recovers only the function's own
+	*    `State` / `StateReason` / `StateReasonCode` — AWS-authored status
+	*    fields — from the serialized payload. The TIMEOUT / ABORT arms keep
+	*    their message: `observedResponses` keys are status lines built by
+	*    `createMessageFromResponse`, never a response body.
 	*/
 	async waitForBackingLambdaReady(serviceToken, logicalId) {
 		try {
@@ -17497,7 +18048,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				maxDelay: 5
 			}, { FunctionName: serviceToken });
 		} catch (error) {
-			throw new Error(`Lambda backing custom resource ${logicalId} (${serviceToken}) did not reach a ready state for Invoke: ${error instanceof Error ? error.message : String(error)}`);
+			throw markNonRetryable(new Error(`Lambda backing custom resource ${logicalId} (${serviceToken}) did not reach a ready state for Invoke: ${describeWaiterFailure(error)}`, { cause: error }));
 		}
 	}
 	/**
@@ -17593,28 +18144,38 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* Centralising this in one helper makes that invariant impossible to
 	* violate at the call sites.
 	*/
-	async prepareInvocation() {
+	async prepareInvocation(logicalId, watch) {
 		const requestId = `cdkd-${Date.now()}-${Math.random().toString(36).substring(7)}`;
 		const responseKey = this.getResponseKey(requestId);
 		return {
 			requestId,
 			responseKey,
-			responseURL: await this.generateResponseURL(responseKey)
+			responseURL: await this.generateResponseURL(responseKey, logicalId, watch)
 		};
 	}
 	/**
 	* Generate a pre-signed S3 PUT URL for Lambda to send its response
 	*/
-	async generateResponseURL(responseKey) {
+	async generateResponseURL(responseKey, logicalId, watch) {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
 		await this.ensureResponseClient();
-		await this.s3Client.send(new PutObjectCommand({
-			Bucket: this.responseBucket,
-			Key: responseKey,
-			Body: "",
-			ContentLength: 0,
-			ContentType: "application/json"
-		}));
+		const bucket = this.responseBucket;
+		try {
+			await withRetry(() => this.s3Client.send(new PutObjectCommand({
+				Bucket: bucket,
+				Key: responseKey,
+				Body: "",
+				ContentLength: 0,
+				ContentType: "application/json"
+			})), `${logicalId} (custom-resource response placeholder)`, {
+				logger: this.logger,
+				isInterrupted: watch.isInterrupted,
+				onInterrupted: watch.onInterrupted,
+				sleep: customResourceRetryDelays.sleep
+			});
+		} catch (error) {
+			throw markNonRetryable(error instanceof Error ? error : new Error(String(error)));
+		}
 		const command = new PutObjectCommand({
 			Bucket: this.responseBucket,
 			Key: responseKey
@@ -17725,7 +18286,50 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return result;
 	}
 	sleep(ms) {
-		return new Promise((resolve) => setTimeout(resolve, ms));
+		return customResourceRetryDelays.sleep(ms);
+	}
+	/**
+	* Install a SIGINT watch for one custom-resource invocation (issue #2033).
+	*
+	* `docs/provider-development.md` requires a new `withRetry` to thread
+	* `isInterrupted` / `onInterrupted`, and a hand-rolled backoff to be
+	* interruptible for the same reason: without it Ctrl-C is dead for the whole
+	* 47.75s schedule. The provider already had the shape — `pollS3Response`
+	* installs its own handler — so this is that pattern, lifted so the two new
+	* wait sites share one flag and one disposal.
+	*
+	* The caller MUST `dispose()` in a `finally`; a leaked listener would
+	* accumulate one per resource across a deploy.
+	*/
+	startInterruptWatch(logicalId) {
+		let interrupted = false;
+		const handler = () => {
+			interrupted = true;
+		};
+		process.on("SIGINT", handler);
+		return {
+			isInterrupted: () => interrupted,
+			onInterrupted: () => /* @__PURE__ */ new Error(`Custom resource ${logicalId} interrupted by user`),
+			dispose: () => {
+				process.removeListener("SIGINT", handler);
+			}
+		};
+	}
+	/**
+	* `sleep` that checks the interrupt watch at most a second apart, mirroring
+	* `withRetry`'s own once-per-second probe. Throws the watch's error when the
+	* user has hit Ctrl-C, so the retry loop unwinds instead of sitting out the
+	* remaining backoff.
+	*/
+	async sleepInterruptibly(ms, watch) {
+		let remaining = ms;
+		while (remaining > 0) {
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+			const chunk = Math.min(1e3, remaining);
+			await this.sleep(chunk);
+			remaining -= chunk;
+		}
+		if (watch.isInterrupted()) throw watch.onInterrupted();
 	}
 	/**
 	* Adopt an existing custom resource into cdkd state.
@@ -22426,6 +23030,22 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
+//#endregion
+//#region src/deployment/masking-retry-logger.ts
+/**
+* Bind `logger` to `secrets`, masking every line the retry loop emits.
+*
+* No-op when the caller resolved no secret ({@link maskSecretsInText} returns
+* the text unchanged for an empty bag), so a non-secret resource's output is
+* byte-identical to threading the raw logger.
+*/
+function maskingRetryLogger(logger, secrets) {
+	return {
+		debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
+		warn: (msg) => logger.warn(maskSecretsInText(msg, secrets))
+	};
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 /**
@@ -22705,6 +23325,38 @@ function replayingStateCreateContext(secrets) {
 	};
 }
 /**
+* The {@link DeploymentEventError} a failed replay records, with this op's
+* re-resolved secrets masked out of its message (issue
+* [#2031](https://github.com/go-to-k/cdkd/issues/2031) acceptance item 2).
+*
+* `extractDeploymentEventError` copies `err.message` VERBATIM, and the events
+* store is a DURABLE sink — `deployments/{runId}.jsonl` in S3 outlives the
+* terminal the `logger.warn` beside it scrolls past, and `cdkd events` replays
+* it later. The standalone `cdkd rollback` command wires
+* `recordEvent: (e) => eventRecorder.record(e)` (`src/cli/commands/rollback.ts`)
+* with NO masking of its own, so without this the plaintext the terminal line
+* masks is persisted one statement later.
+*
+* The in-process caller (`DeployEngine.rollbackExecutorContext`) routes through
+* `maskSecretsInEvent`, but that masks with the DEPLOY's `perResourceSecrets`
+* for the resource — a different bag from the one this replay re-resolved from
+* the JOURNAL, which can name a different secret version or a reference the
+* deploy never resolved. Masking here is what makes both callers equal, and
+* double-masking is a no-op (the mask is not a key of either bag).
+*
+* `name` / `awsErrorCode` / `requestId` are deliberately left alone: they are
+* AWS-authored identifiers, not message text, and #2038 traced all three as
+* non-sensitive.
+*/
+function maskedRollbackEventError(error, secrets) {
+	const extracted = extractDeploymentEventError(error);
+	if (secrets.size === 0) return extracted;
+	return {
+		...extracted,
+		message: maskSecretsInText(extracted.message, secrets)
+	};
+}
+/**
 * Which provisioning layer a delete must be judged against: the CURRENT
 * state record wins (it is what state says AWS holds right now), with the
 * journaled op's routing as the legacy-state fallback. Shared by both
@@ -23063,10 +23715,10 @@ function redactRollbackRecord(record, secrets, journaledProps) {
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
 	}, secrets);
 }
-async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted) {
+async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
 	if (provider.disableOuterRetry) return await provider.update(...args);
 	return await withRetry(() => provider.update(...args), logicalId, {
-		logger,
+		logger: maskingRetryLogger(logger, secrets),
 		...isInterrupted && {
 			isInterrupted,
 			onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while retrying a resource update")
@@ -23121,6 +23773,21 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	/**
+	* This op's `plaintext -> {{resolve:...}}expression` bag, filled by
+	* {@link resolveReplayProps} on whichever arm runs (issues
+	* [#2038](https://github.com/go-to-k/cdkd/issues/2038) /
+	* [#2031](https://github.com/go-to-k/cdkd/issues/2031)).
+	*
+	* HOISTED above the `try` rather than declared per arm, which is what the
+	* two arms used to do: the shared catch below logs the thrown AWS message and
+	* persists it to the events store, and it cannot see a binding scoped to the
+	* arm that threw. Exactly one arm runs per call, so a single per-op bag is
+	* equivalent to the per-arm ones for every existing reader (`secrets.size`
+	* stays 0 on the arms that resolve nothing, so `redactRollbackRecord` and the
+	* maskers keep their identity behavior).
+	*/
+	const secrets = /* @__PURE__ */ new Map();
+	/**
 	* The route a CREATE-rollback arm resolved for this op (issue #1366) —
 	* hoisted so the shared catch's ROLLBACK_RESOURCE_FAILED reports the route
 	* the delete was going to take, which is the one a refusal is about. Stays
@@ -23244,7 +23911,6 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
-				const secrets = /* @__PURE__ */ new Map();
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets) ?? {};
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
@@ -23261,7 +23927,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				try {
 					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
-						logger,
+						logger: maskingRetryLogger(logger, secrets),
 						...isInterrupted && {
 							isInterrupted,
 							onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting out the name cooldown")
@@ -23284,7 +23950,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					try {
 						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
-							logger,
+							logger: maskingRetryLogger(logger, secrets),
 							...isInterrupted && {
 								isInterrupted,
 								onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting for the old name to release")
@@ -23292,7 +23958,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							isRetryable: isRecreateRetryableError
 						});
 					} catch (recreateError) {
-						throw new Error(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`);
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
@@ -23315,7 +23981,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
-					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
+					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
 					result.warnings++;
 				}
 				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
@@ -23347,7 +24013,6 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
 				});
-				const secrets = /* @__PURE__ */ new Map();
 				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets);
 				const currentProps = await resolveReplayProps(current.properties, resolver, secrets);
 				const revertResult = await updateWithRollbackRetry(provider, [
@@ -23357,10 +24022,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					desiredProps ?? {},
 					currentProps ?? {},
 					{ maskSecrets: createSecretMasker(secrets) }
-				], op.logicalId, logger, isInterrupted);
+				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				const rollbackPartial = updatePartialReason(revertResult);
-				if (rollbackPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`);
+				if (rollbackPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`, secrets));
 				else logger.info(`  Rollback: ${op.logicalId} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
@@ -23370,13 +24035,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
 					...op.provisionedBy && { provisionedBy: op.provisionedBy },
-					...rollbackPartial !== void 0 && { reason: rollbackPartial }
+					...rollbackPartial !== void 0 && { reason: maskSecretsInText(rollbackPartial, secrets) }
 				});
 				return;
 			}
 		}
 	} catch (rollbackError) {
-		logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+		logger.warn(maskSecretsInText(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`, secrets));
 		logger.warn("  Continuing with remaining rollback operations...");
 		result.failures++;
 		const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -23387,7 +24052,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			logicalId: op.logicalId,
 			resourceType: op.resourceType,
 			...failedRoute && { provisionedBy: failedRoute },
-			error: extractDeploymentEventError(rollbackError)
+			error: maskedRollbackEventError(rollbackError, secrets)
 		});
 	}
 }
@@ -23424,6 +24089,15 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		}
 		const op = failedOps[i];
 		const action = classifyFailedOp(op, stateResources);
+		/**
+		* This op's re-resolved secret bag — the twin of `replaySingle`'s, and
+		* hoisted above this iteration's `try` for the same reason (issues #2038 /
+		* #2031): the shared catch below logs the thrown AWS message and persists it
+		* to the events store, and could not see a binding scoped to the arm that
+		* threw. Re-created per ITERATION, so one op's secrets can never mask
+		* another's text.
+		*/
+		const secrets = /* @__PURE__ */ new Map();
 		let createRollbackRoute;
 		try {
 			switch (action) {
@@ -23491,7 +24165,6 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
-					const secrets = /* @__PURE__ */ new Map();
 					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets);
 					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
@@ -23501,10 +24174,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						desiredProps ?? {},
 						attemptedProps ?? {},
 						{ maskSecrets: createSecretMasker(secrets) }
-					], op.logicalId, logger, options.isInterrupted);
+					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
-					if (revertFailedPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`);
+					if (revertFailedPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`, secrets));
 					else logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -23514,13 +24187,13 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
 						...op.provisionedBy && { provisionedBy: op.provisionedBy },
-						...revertFailedPartial !== void 0 && { reason: revertFailedPartial }
+						...revertFailedPartial !== void 0 && { reason: maskSecretsInText(revertFailedPartial, secrets) }
 					});
 					break;
 				}
 			}
 		} catch (revertError) {
-			logger.warn(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`);
+			logger.warn(maskSecretsInText(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`, secrets));
 			result.failures++;
 			pending.add(op);
 			const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -23531,7 +24204,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 				logicalId: op.logicalId,
 				resourceType: op.resourceType,
 				...failedRoute && { provisionedBy: failedRoute },
-				error: extractDeploymentEventError(revertError)
+				error: maskedRollbackEventError(revertError, secrets)
 			});
 		}
 	}
@@ -23631,7 +24304,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.10";
+	return "0.284.12";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -24096,6 +24769,14 @@ var DeploymentEventsReader = class {
 //#endregion
 //#region src/deployment/deploy-engine.ts
 /**
+* The bag a resource with no recorded secret masks against (issue #2038).
+* Shared so the "no entry" path allocates nothing and — more usefully — so
+* every masking site takes the SAME branch: `maskSecretsInText` /
+* `maskSecretsInError` both return their input unchanged for an empty bag, so
+* an absent entry and an empty one cannot behave differently. Never written to.
+*/
+const EMPTY_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Default per-resource warn threshold: warn the user when a single
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
@@ -25299,7 +25980,7 @@ var DeployEngine = class {
 		} catch (error) {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+			this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
 			this.recordEvent({
 				eventType: "RESOURCE_FAILED",
 				stackName,
@@ -25310,7 +25991,7 @@ var DeployEngine = class {
 				durationMs: Date.now() - resourceStartedAt,
 				error: extractDeploymentEventError(error)
 			});
-			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) : void 0);
 		} finally {
 			renderer.removeTask(logicalId);
 		}
@@ -25399,7 +26080,8 @@ var DeployEngine = class {
 	* #960 follow-up) and the name-idempotent same-id guard (issue #1238) so
 	* the two --replace escape hatches cannot drift apart.
 	*/
-	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, createContext, updateReplacePolicy) {
+	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
+		const createContext = { maskSecrets: createSecretMasker(secrets) };
 		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 		let deleteResult;
 		try {
@@ -25409,7 +26091,7 @@ var DeployEngine = class {
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 			});
 		} catch (deleteError) {
-			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+			throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets));
 		}
 		const replaceSkipReason = deleteSkipReason(deleteResult);
 		if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
@@ -25420,13 +26102,13 @@ var DeployEngine = class {
 				maxRetries: 8,
 				initialDelayMs: 2e3,
 				maxDelayMs: 1e4,
-				logger: this.logger,
+				logger: this.maskingRetryLoggerFor(secrets),
 				isInterrupted: () => this.interrupted,
 				onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 				isRetryable: isRecreateRetryableError
 			});
 		} catch (recreateError) {
-			throw new Error(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`);
+			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets));
 		}
 	}
 	/**
@@ -25448,10 +26130,10 @@ var DeployEngine = class {
 					...parameterValues && { parameters: parameterValues },
 					...conditions && { conditions }
 				}, stackName);
+				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
@@ -25492,9 +26174,9 @@ var DeployEngine = class {
 					...parameterValues && { parameters: parameterValues },
 					...conditions && { conditions }
 				}, stackName);
-				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
+				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -25575,7 +26257,7 @@ var DeployEngine = class {
 							maxRetries: 8,
 							initialDelayMs: 2e3,
 							maxDelayMs: 1e4,
-							logger: this.logger,
+							logger: this.maskingRetryLoggerFor(updateSecrets),
 							isInterrupted: () => this.interrupted,
 							onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 							isRetryable: isRecreateRetryableError
@@ -25594,7 +26276,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 							this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
 						if (!deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 							const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -25602,7 +26284,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
 						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 						else {
@@ -25993,12 +26675,74 @@ var DeployEngine = class {
 		return withRetry(operation, logicalId, {
 			...maxRetries !== void 0 && { maxRetries },
 			...initialDelayMs !== void 0 && { initialDelayMs },
-			logger: this.logger,
+			logger: this.maskingRetryLogger(logicalId),
 			isInterrupted: () => this.interrupted,
 			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user")
 		});
 	}
 	/**
+	* Mask one line of engine-authored text with a resource's OWN recorded
+	* secrets (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)).
+	*
+	* Per-resource, never session-wide — see the `perResourceSecrets` field doc
+	* for why one resource's secret must not rewrite another's literal. A
+	* `logicalId` with no entry (or an empty bag) forwards verbatim, so every
+	* non-secret resource is byte-identical to before.
+	*/
+	maskForResource(logicalId, text) {
+		return maskSecretsInText(text, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS);
+	}
+	/**
+	* The LAZY `RetryLogger` the engine's generic `withRetry` wrapper threads
+	* (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038) acceptance
+	* item 1) — the same masking shape `drift.ts` and `rollback-executor.ts`
+	* install, bound to the resource's OWN recorded secrets.
+	*
+	* `retry.ts` interpolates the AWS message verbatim into both the per-attempt
+	* `debug` line and the give-up `warn` summary, and the bag this engine hands
+	* a provider is RESOLVED — `perResourceSecrets` is populated immediately after
+	* `resolver.resolve` and BEFORE the create / update call, so a secret is in
+	* scope at every retried provider call. An AWS validation error routinely
+	* quotes the offending value back, so the give-up summary could print it at
+	* DEFAULT verbosity: the same hole #2038 found on the rollback path, one
+	* caller over.
+	*
+	* The bag is resolved PER LINE rather than captured, because `withRetry`
+	* (the private wrapper below) is reached from call sites that hold no bag —
+	* DELETE, the observed-capture drain, the Outputs pass — and a
+	* `logicalId`-keyed read is the only thing available there. The two
+	* `--replace` sites do hold their caller's bag and use
+	* {@link maskingRetryLoggerFor} instead; see the note on
+	* {@link replaceDeleteFirstAndRecreate}'s `secrets` parameter for why binding
+	* the bag beats looking it up whenever the bag is in scope.
+	*
+	* Do NOT restate that the engine "already masked its own error text" — an
+	* earlier revision of this comment did, and it was FALSE: `provisionResource`
+	* logged the raw AWS message at `error` level (a HIGHER level than this
+	* summary) until #2038's review round. Only the EVENT store was masked.
+	*/
+	maskingRetryLogger(logicalId) {
+		return {
+			debug: (msg) => this.logger.debug(this.maskForResource(logicalId, msg)),
+			warn: (msg) => this.logger.warn(this.maskForResource(logicalId, msg))
+		};
+	}
+	/**
+	* The EAGER `RetryLogger`, bound to the bag the caller actually resolved
+	* with (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)).
+	*
+	* Preferred over {@link maskingRetryLogger} wherever the resolution pass's
+	* own `RecordedSecretValues` is in scope, for the reason
+	* {@link replaceDeleteFirstAndRecreate}'s parameter list already states about
+	* the masker it threads: a map looked up by logical id is a DIFFERENT thing
+	* from the bag this call resolved with, and one file must not argue both
+	* sides. It delegates to the shared `masking-retry-logger.ts` so the deploy
+	* engine, `rollback-executor.ts` and `drift.ts` cannot drift apart.
+	*/
+	maskingRetryLoggerFor(secrets) {
+		return maskingRetryLogger(this.logger, secrets);
+	}
+	/**
 	* What a failed Output resolution does, shared by both passes of
 	* {@link resolveOutputs} so they cannot drift — the alias pass reports the
 	* SAME failure for a name it could not resolve as the value pass does for a
@@ -26099,5 +26843,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-DGuaeWaV.js.map
+export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
+//# sourceMappingURL=deploy-engine-nwoIJsLn.js.map