@go-to-k/cdkd 0.284.16 → 0.284.17

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-CI0a6yLX.js";
-import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-D7DqNvVo.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-Bnu1WuRI.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
+import { t as ASGProvider } from "./asg-provider-BbLu5LGL.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -30,7 +30,7 @@ import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
@@ -3845,6 +3845,16 @@ var IAMInstanceProfileProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-access-key-provider.ts
 /**
+* How far before an attempt's start a key's `CreateDate` may fall and still be
+* treated as minted by that attempt (issue #2039).
+*
+* IAM stamps `CreateDate` from its own clock while the floor comes from ours,
+* so some tolerance is needed or ordinary skew disarms the check entirely. It
+* is deliberately small: every millisecond of it is a millisecond in which a
+* key created by something else becomes deletable.
+*/
+const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
+/**
 * AWS IAM AccessKey Provider (issue #1323)
 *
 * Implements resource provisioning for AWS::IAM::AccessKey using the IAM SDK.
@@ -3894,6 +3904,38 @@ var IAMAccessKeyProvider = class {
 		"Serial",
 		"Status"
 	])]]);
+	/**
+	* Serializes create attempts per IAM user, in this process (issue
+	* [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* The orphan reconcile below identifies "a key that appeared since my
+	* baseline". With two `AWS::IAM::AccessKey` resources on ONE user — the
+	* ordinary two-key rotation shape — the deploy engine dispatches both
+	* concurrently at the default `--concurrency 10`, and a key the SIBLING
+	* legitimately created lands inside that window and matches the same
+	* description. Deleting it destroys a live credential that is already in
+	* cdkd state and may already be piped into a downstream Secrets Manager
+	* secret via `Fn::GetAtt`, and `readCurrentState` returns `undefined` for a
+	* deleted key, so `cdkd drift` reports UNKNOWN rather than drift and the
+	* loss is invisible. That is strictly worse than the untracked-but-alive
+	* credential this whole mechanism exists to prevent.
+	*
+	* This lock removes that race rather than narrowing it: the baseline read,
+	* the create attempt, and the reconcile all happen under it, so no sibling
+	* create on the same user can interleave with them.
+	*/
+	userCreateLocks = /* @__PURE__ */ new Map();
+	/**
+	* Access key ids THIS process created successfully.
+	*
+	* The complement of the baseline: a baseline can only say "this key is
+	* newer than my snapshot", which is true both of the orphan left by my own
+	* failed attempt AND of a key someone else minted in the same window. This
+	* set names the keys cdkd itself owns and has already recorded, so they are
+	* never deletable however the timing falls — including the case the lock
+	* cannot cover, a second `cdkd` process sharing the user.
+	*/
+	accessKeyIdsCreatedByThisProcess = /* @__PURE__ */ new Set();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.iamClient = awsClients.iam;
@@ -3912,6 +3954,16 @@ var IAMAccessKeyProvider = class {
 		const userName = properties["UserName"];
 		if (!userName) throw new ProvisioningError(`AccessKey ${logicalId} requires UserName`, resourceType, logicalId);
 		const status = requireConfigString(properties["Status"], "Active", "AWS::IAM::AccessKey Status", replayWarn(this.logger, context));
+		return this.withUserCreateLock(userName, () => this.createAccessKeyUnderUserLock(logicalId, resourceType, userName, status));
+	}
+	/**
+	* The body of {@link IAMAccessKeyProvider.create}, running with this user's
+	* create lock held so the baseline, the create, and the reconcile are atomic
+	* against any sibling create on the same user.
+	*/
+	async createAccessKeyUnderUserLock(logicalId, resourceType, userName, status) {
+		const attemptStartMs = Date.now() - CREATE_DATE_SKEW_MARGIN_MS;
+		const baseline = await this.tryListAccessKeyIds(userName, logicalId);
 		try {
 			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
@@ -3946,6 +3998,7 @@ var IAMAccessKeyProvider = class {
 				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM access key ${logicalId}: ${accessKeyId}`);
+			this.accessKeyIdsCreatedByThisProcess.add(accessKeyId);
 			return {
 				physicalId: accessKeyId,
 				attributes: {
@@ -3954,11 +4007,135 @@ var IAMAccessKeyProvider = class {
 				}
 			};
 		} catch (error) {
+			await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs);
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
+	* Run `fn` with this IAM user's create lock held.
+	*
+	* Queue rather than mutual exclusion: each caller waits on its predecessor
+	* and publishes its own completion for the next one, so N concurrent creates
+	* on one user run strictly in arrival order. The stored promise only ever
+	* RESOLVES (the release is in a `finally`), so one create failing cannot
+	* wedge the queue behind it.
+	*
+	* Process-scoped, like every other guard here. A second `cdkd` process on the
+	* same user is out of its reach, which is why
+	* {@link IAMAccessKeyProvider.accessKeyIdsCreatedByThisProcess} and the
+	* `CreateDate` floor exist as well.
+	*/
+	async withUserCreateLock(userName, fn) {
+		const predecessor = this.userCreateLocks.get(userName) ?? Promise.resolve();
+		let release;
+		const held = new Promise((resolve) => {
+			release = resolve;
+		});
+		this.userCreateLocks.set(userName, predecessor.then(() => held));
+		await predecessor;
+		try {
+			return await fn();
+		} finally {
+			release();
+		}
+	}
+	/**
+	* Delete the access key THIS attempt minted before losing its response
+	* (issue [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* ## Why a reconcile rather than a token or an opt-out
+	*
+	* `CreateAccessKey` has no `ClientToken` / `ClientRequestToken` member, so
+	* there is nothing to make the call itself idempotent. The other candidate
+	* was `disableOuterRetry`, and it costs too much here: it would make the
+	* provider single-shot for EVERY transient error, including the IAM
+	* propagation window between a sibling `AWS::IAM::User` being created and
+	* being visible to `CreateAccessKey`.
+	*
+	* The orphan cannot be ADOPTED — its secret was returned once, in the
+	* response that was lost — so deleting it is the only remedy available.
+	*
+	* ## Three independent conditions, because deleting the wrong key is worse
+	* than leaving an orphan
+	*
+	* A key is deleted only when ALL of these hold:
+	*
+	*  1. It is absent from the baseline taken moments earlier, under the lock.
+	*  2. Its `CreateDate` is at or after this attempt started. IAM stamps that
+	*     date from ITS clock and the floor comes from ours, so a margin absorbs
+	*     ordinary skew; the residual risk is bounded by the length of ONE
+	*     `CreateAccessKey` call rather than by the retry schedule.
+	*  3. cdkd did not create it successfully in this process. This is the one
+	*     the baseline structurally cannot express — "newer than my snapshot" is
+	*     equally true of my orphan and of somebody else's key.
+	*
+	* Anything that fails 2 or 3 is reported and LEFT ALONE. That is the safe
+	* direction: an untracked key costs a quota slot and a manual cleanup, while
+	* a wrongly deleted one destroys a live credential that cdkd state still
+	* advertises — and because `readCurrentState` returns `undefined` for a
+	* deleted key, `cdkd drift` would report UNKNOWN rather than drift, so the
+	* loss would not even be visible.
+	*
+	* @param baseline `undefined` when the pre-create read failed, which disarms
+	* the reconcile entirely — see {@link IAMAccessKeyProvider.tryListAccessKeyIds}.
+	*/
+	async deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs) {
+		if (baseline === void 0) return;
+		const current = await this.tryListAccessKeyMetadata(userName, logicalId);
+		if (!current) return;
+		for (const key of current) {
+			const accessKeyId = key.accessKeyId;
+			if (baseline.has(accessKeyId) || this.accessKeyIdsCreatedByThisProcess.has(accessKeyId)) continue;
+			if (key.createDateMs === void 0 || key.createDateMs < attemptStartMs) {
+				this.logger.warn(`IAM access key ${accessKeyId} appeared on user ${userName} while creating ${logicalId}, but cdkd cannot attribute it to this attempt (created ${key.createDateMs === void 0 ? "at an unknown time" : new Date(key.createDateMs).toISOString()}, attempt started ${new Date(attemptStartMs).toISOString()}). Leaving it in place. If it is an orphan of a failed cdkd deploy, delete it with: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+				continue;
+			}
+			this.logger.warn(`IAM access key ${accessKeyId} was minted on user ${userName} by this failed attempt at ${logicalId} and its secret was lost with the response, so it is unusable and unrecorded; deleting it before the retry`);
+			try {
+				await this.iamClient.send(new DeleteAccessKeyCommand({
+					UserName: userName,
+					AccessKeyId: accessKeyId
+				}));
+			} catch (error) {
+				this.logger.warn(`Failed to delete the orphaned IAM access key ${accessKeyId} for user ${userName}: ${error instanceof Error ? error.message : String(error)}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+			}
+		}
+	}
+	/**
+	* The user's current access key ids, or `undefined` when the read failed.
+	*
+	* `undefined` disarms the reconcile rather than failing the create: a missing
+	* `iam:ListAccessKeys` permission must not turn a working deploy into a
+	* broken one over a safety net.
+	*/
+	async tryListAccessKeyIds(userName, logicalId) {
+		const metadata = await this.tryListAccessKeyMetadata(userName, logicalId);
+		return metadata && new Set(metadata.map((key) => key.accessKeyId));
+	}
+	/** `ListAccessKeys` with its `CreateDate`s, or `undefined` when the read failed. */
+	async tryListAccessKeyMetadata(userName, logicalId) {
+		const keys = [];
+		let marker;
+		try {
+			do {
+				const page = await this.iamClient.send(new ListAccessKeysCommand({
+					UserName: userName,
+					...marker && { Marker: marker }
+				}));
+				for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId) keys.push({
+					accessKeyId: key.AccessKeyId,
+					createDateMs: key.CreateDate ? key.CreateDate.getTime() : void 0
+				});
+				marker = page.IsTruncated ? page.Marker : void 0;
+			} while (marker);
+		} catch (error) {
+			this.logger.warn(`Could not list existing access keys for user ${userName} while creating ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: aws iam list-access-keys --user-name ${userName}`);
+			return;
+		}
+		return keys;
+	}
+	/**
 	* Update an IAM access key.
 	*
 	* `UserName` / `Serial` are createOnly (replacement — this method never
@@ -23206,6 +23383,118 @@ var EventBridgeBusProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/idempotency-token.ts
+/**
+* Retry-stable idempotency tokens for provider CREATE calls (issue
+* [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+*
+* ## The failure this exists to prevent
+*
+* The deploy engine wraps every `provider.create()` in an outer transient-error
+* retry (`src/deployment/retry.ts`), and issue #2026 made HTTP 500 / 502 / 504
+* retryable for the default classifier. A 500 whose request actually SUCCEEDED
+* server-side therefore re-invokes `create()` from the top. For a CREATE that
+* carries no name and no idempotency token, the replay mints a SECOND resource:
+* the first has no state entry, so `cdkd destroy` never reaches it and it bills
+* indefinitely. `RunInstances` is the worst instance of the class.
+*
+* ## What "stable" has to mean, precisely
+*
+* A token regenerated per attempt is not a fix — it is worse than none, because
+* the call site now LOOKS idempotent while behaving exactly as before. So the
+* value must be:
+*
+*  - **Identical across every attempt of one logical create.** Guaranteed here
+*    by memoising on `(scope, region, stackName, logicalId)` — a tuple the retry
+*    loop reproduces byte-for-byte, because it re-invokes the same closure with
+*    the same arguments. Deliberately NOT keyed on the resolved properties.
+*    (The earlier version of this note justified that by saying the properties
+*    are re-derived per attempt. They are NOT: `deploy-engine.ts` computes them
+*    once OUTSIDE the retry closure. The reason to keep them out of the key is
+*    that it makes the guarantee STRUCTURAL rather than contingent — an
+*    identity built from a logical id cannot be perturbed by a future change to
+*    how properties are resolved, whereas one built from their contents can.)
+*  - **Different for a genuinely NEW create of the same logical resource.**
+*    Reusing a token after a create SUCCEEDED is its own hazard: EC2 keeps a
+*    `RunInstances` token for ~24h and answers a repeat with the ORIGINAL
+*    instance, so a `--replace` re-create (delete old, then create with
+*    unchanged properties, all in one process) would be handed back the
+*    instance it had just terminated. {@link IdempotencyToken.release} is what
+*    prevents that: it is called only on the success path, and it bumps a
+*    per-key generation counter so the next acquire derives a fresh value.
+*  - **Never reused by a LATER cdkd run.** A per-process nonce is mixed into
+*    the digest, so two `cdkd deploy` invocations of the same template never
+*    collide even though every other input is identical.
+*
+* ## Why not a purely deterministic hash of the create inputs
+*
+* That is what `EFSProvider`'s `CreationToken` and `FSxFileSystemProvider`'s
+* `ClientRequestToken` do, and it is right FOR THEM: those APIs enforce token
+* uniqueness only among LIVE file systems, so a re-deploy after a destroy is
+* unaffected, and hashing the immutable inputs is what lets the new file system
+* coexist with the old one during a replacement. EC2 is the opposite shape —
+* the token survives the resource's own termination — so a value that is stable
+* across RUNS is a liability there rather than an asset. Both providers keep
+* their existing derivation; this module is for the APIs where the token must
+* be scoped to one process and one create.
+*/
+/**
+* Mixed into every digest so no two `cdkd` processes can derive the same token
+* from the same template. Evaluated once at module load; ESM guarantees a
+* single module instance per process, which is exactly the scope wanted.
+*/
+const PROCESS_NONCE = randomUUID();
+/** Tokens currently in flight, keyed by {@link tokenKey}. */
+const inFlight = /* @__PURE__ */ new Map();
+/**
+* How many times each key has been RELEASED. Folded into the digest so a
+* post-success re-acquire (the `--replace` delete-then-create path) yields a
+* different token than the create that already succeeded.
+*/
+const generations = /* @__PURE__ */ new Map();
+/**
+* Ceiling on {@link generations}. Chosen far above any realistic stack size so
+* eviction is unreachable in a normal `cdkd` run, and present only so a
+* long-lived process cannot grow the map without bound.
+*/
+const MAX_TRACKED_GENERATIONS = 1e5;
+const tokenKey = (scope, logicalId) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}`;
+const derive = (key, generation, maxLength) => {
+	return `cdkd-${createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex")}`.slice(0, maxLength);
+};
+/**
+* Get the idempotency token for one logical create, minting it on first use and
+* returning the SAME value for every retry of that create.
+*
+* @example
+* ```ts
+* const token = acquireIdempotencyToken({ scope: 'RunInstances', logicalId });
+* const response = await client.send(new RunInstancesCommand({ ...input, ClientToken: token.value }));
+* token.release(); // success path only
+* ```
+*/
+function acquireIdempotencyToken(options) {
+	const { scope, logicalId, maxLength = 64 } = options;
+	const key = tokenKey(scope, logicalId);
+	const existing = inFlight.get(key);
+	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength);
+	if (existing === void 0) inFlight.set(key, value);
+	return {
+		value,
+		release: () => {
+			if (!inFlight.has(key)) return;
+			inFlight.delete(key);
+			const generation = (generations.get(key) ?? 0) + 1;
+			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
+				const oldest = generations.keys().next();
+				if (!oldest.done) generations.delete(oldest.value);
+			}
+			generations.set(key, generation);
+		}
+	};
+}
+
 //#endregion
 //#region src/utils/ip-protocol.ts
 /**
@@ -24274,8 +24563,13 @@ var EC2Provider = class {
 		this.logger.debug(`Creating NatGateway ${logicalId}`);
 		const subnetId = properties["SubnetId"];
 		if (!subnetId) throw new ProvisioningError(`SubnetId is required for NatGateway ${logicalId}`, resourceType, logicalId);
+		const natGatewayToken = acquireIdempotencyToken({
+			scope: "CreateNatGateway",
+			logicalId
+		});
 		try {
 			const natGatewayId = (await this.ec2Client.send(new CreateNatGatewayCommand({
+				ClientToken: natGatewayToken.value,
 				SubnetId: subnetId,
 				AllocationId: properties["AllocationId"],
 				ConnectivityType: properties["ConnectivityType"] ?? void 0,
@@ -24296,6 +24590,7 @@ var EC2Provider = class {
 				this.logger.debug(`NatGateway ${natGatewayId} is available`);
 			} else this.logger.debug(`NatGateway ${natGatewayId} created (skipping available-state wait per --no-wait)`);
 			this.logger.debug(`Successfully created NatGateway ${logicalId}: ${natGatewayId}`);
+			natGatewayToken.release();
 			return {
 				physicalId: natGatewayId,
 				attributes: { NatGatewayId: natGatewayId }
@@ -24338,10 +24633,18 @@ var EC2Provider = class {
 		this.logger.debug(`Creating RouteTable ${logicalId}`);
 		const vpcId = properties["VpcId"];
 		if (!vpcId) throw new ProvisioningError(`VpcId is required for RouteTable ${logicalId}`, resourceType, logicalId);
+		const routeTableToken = acquireIdempotencyToken({
+			scope: "CreateRouteTable",
+			logicalId
+		});
 		try {
-			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({ VpcId: vpcId }))).RouteTable.RouteTableId;
+			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({
+				VpcId: vpcId,
+				ClientToken: routeTableToken.value
+			}))).RouteTable.RouteTableId;
 			await this.applyTags(routeTableId, properties, logicalId);
 			this.logger.debug(`Successfully created RouteTable ${logicalId}: ${routeTableId}`);
+			routeTableToken.release();
 			return {
 				physicalId: routeTableId,
 				attributes: { RouteTableId: routeTableId }
@@ -24890,7 +25193,12 @@ var EC2Provider = class {
 			const securityGroups = properties["SecurityGroups"];
 			const iamInstanceProfile = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
 			const networkInterfaces = this.buildNetworkInterfaces(properties);
+			const runInstancesToken = acquireIdempotencyToken({
+				scope: "RunInstances",
+				logicalId
+			});
 			const instance = (await this.ec2Client.send(new RunInstancesCommand({
+				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
 				KeyName: properties["KeyName"] ?? void 0,
@@ -24940,6 +25248,7 @@ var EC2Provider = class {
 					AvailabilityZone: runningInstance?.Placement?.AvailabilityZone ?? ""
 				};
 				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
+				runInstancesToken.release();
 				return {
 					physicalId: instanceId,
 					attributes
@@ -24947,6 +25256,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
 					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: aws ec2 terminate-instances --instance-ids ${instanceId}`);
@@ -25461,10 +25771,18 @@ var EC2Provider = class {
 		this.logger.debug(`Creating NetworkAcl ${logicalId}`);
 		const vpcId = properties["VpcId"];
 		if (!vpcId) throw new ProvisioningError(`VpcId is required for NetworkAcl ${logicalId}`, resourceType, logicalId);
+		const networkAclToken = acquireIdempotencyToken({
+			scope: "CreateNetworkAcl",
+			logicalId
+		});
 		try {
-			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({ VpcId: vpcId }))).NetworkAcl.NetworkAclId;
+			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({
+				VpcId: vpcId,
+				ClientToken: networkAclToken.value
+			}))).NetworkAcl.NetworkAclId;
 			await this.applyTags(networkAclId, properties, logicalId);
 			this.logger.debug(`Successfully created NetworkAcl ${logicalId}: ${networkAclId}`);
+			networkAclToken.release();
 			return {
 				physicalId: networkAclId,
 				attributes: { Id: networkAclId }
@@ -38735,9 +39053,14 @@ var Route53Provider = class {
 			const createComment = readConfigString(hostedZoneConfig, "Comment", "", "AWS::Route53::HostedZone HostedZoneConfig");
 			const vpcs = properties["VPCs"];
 			const firstVpc = vpcs && vpcs.length > 0 ? vpcs[0] : void 0;
-			const response = await this.getClient().send(new CreateHostedZoneCommand({
+			const callerReferenceToken = acquireIdempotencyToken({
+				scope: "CreateHostedZone",
+				logicalId,
+				maxLength: 128
+			});
+			const response = await this.createOrAdoptHostedZone({
 				Name: name,
-				CallerReference: `${logicalId}-${Date.now()}`,
+				CallerReference: callerReferenceToken.value,
 				...createComment !== "" ? { HostedZoneConfig: {
 					Comment: createComment,
 					...firstVpc ? { PrivateZone: true } : {}
@@ -38746,7 +39069,7 @@ var Route53Provider = class {
 					VPCId: firstVpc["VPCId"],
 					VPCRegion: firstVpc["VPCRegion"]
 				} } : {}
-			}));
+			});
 			const hostedZone = response.HostedZone;
 			if (!hostedZone?.Id) throw new Error("CreateHostedZone did not return HostedZone.Id");
 			const zoneId = hostedZone.Id.replace("/hostedzone/", "");
@@ -38773,6 +39096,7 @@ var Route53Provider = class {
 				try {
 					await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
+					callerReferenceToken.release();
 				} catch (deleteError) {
 					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)} — operator may need to clean up the orphan zone`);
 				}
@@ -38781,6 +39105,7 @@ var Route53Provider = class {
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
+			callerReferenceToken.release();
 			return {
 				physicalId: zoneId,
 				attributes: {
@@ -38794,6 +39119,77 @@ var Route53Provider = class {
 			throw new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* `CreateHostedZone`, with the retry-replay case ADOPTED rather than failed
+	* (issue [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* A stable `CallerReference` stops a replayed create from minting a second
+	* zone, but on its own it converts the replay into a hard
+	* `HostedZoneAlreadyExists` — so the first attempt's zone would still be live
+	* and still absent from state, only now the deploy fails as well. Route 53
+	* reports the caller reference back on every `HostedZone`, which is what lets
+	* the replay find the zone the lost response described and continue with it.
+	*
+	* The lookup is `ListHostedZonesByName`, which starts at the requested DNS
+	* name and returns zones in name order, so the walk stops as soon as the name
+	* changes rather than paging the whole account. A `GetHostedZone` follows,
+	* because only that call returns the `DelegationSet` whose `NameServers` are
+	* the resource's `Fn::GetAtt` value — an adopted zone must return the same
+	* attributes a first-attempt create would have.
+	*
+	* Finding nothing rethrows the original error: a caller reference AWS says is
+	* taken but that names no zone we can see is not something to paper over.
+	*/
+	async createOrAdoptHostedZone(input) {
+		try {
+			return await this.getClient().send(new CreateHostedZoneCommand(input));
+		} catch (error) {
+			if (!(error instanceof HostedZoneAlreadyExists || error?.name === "HostedZoneAlreadyExists")) throw error;
+			let adopted;
+			try {
+				adopted = await this.findHostedZoneByCallerReference(input.Name, input.CallerReference);
+			} catch (lookupError) {
+				this.logger.warn(`CreateHostedZone for ${input.Name} was refused as already-existing, and the lookup that would have adopted the existing zone failed: ${lookupError instanceof Error ? lookupError.message : String(lookupError)}. Reporting the original error.`);
+				throw error;
+			}
+			if (!adopted?.Id) throw error;
+			this.logger.warn(`CreateHostedZone for ${input.Name} was replayed after a lost response; adopting the hosted zone ${adopted.Id} the previous attempt already created instead of creating a second one`);
+			try {
+				const described = await this.getClient().send(new GetHostedZoneCommand({ Id: adopted.Id }));
+				return {
+					HostedZone: described.HostedZone ?? adopted,
+					...described.DelegationSet ? { DelegationSet: described.DelegationSet } : {}
+				};
+			} catch (describeError) {
+				this.logger.warn(`Adopted hosted zone ${adopted.Id} but could not read it back: ${describeError instanceof Error ? describeError.message : String(describeError)}. Reporting the original error rather than returning a zone with no NameServers.`);
+				throw error;
+			}
+		}
+	}
+	/**
+	* The hosted zone carrying `callerReference`, or `undefined`.
+	*
+	* Scoped to zones whose name matches `dnsName`: `ListHostedZonesByName` is
+	* ordered by name, so once the name differs no later page can hold ours.
+	*/
+	async findHostedZoneByCallerReference(dnsName, callerReference) {
+		const wanted = canonicalizeQueryName(dnsName);
+		let marker = { DNSName: wanted };
+		while (marker) {
+			const page = await this.getClient().send(new ListHostedZonesByNameCommand({
+				DNSName: marker.DNSName,
+				...marker.HostedZoneId ? { HostedZoneId: marker.HostedZoneId } : {}
+			}));
+			for (const zone of page.HostedZones ?? []) {
+				if (canonicalizeQueryName(zone.Name ?? "") !== wanted) return;
+				if (zone.CallerReference === callerReference) return zone;
+			}
+			marker = page.IsTruncated && page.NextDNSName ? {
+				DNSName: page.NextDNSName,
+				...page.NextHostedZoneId ? { HostedZoneId: page.NextHostedZoneId } : {}
+			} : void 0;
+		}
+	}
 	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
@@ -83294,7 +83690,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.17");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;