@go-to-k/cdkd 0.284.16 → 0.284.18

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-CI0a6yLX.js";
-import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-D7DqNvVo.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-HK-oROJf.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
+import { t as ASGProvider } from "./asg-provider-IPF2MfAC.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -30,7 +30,7 @@ import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
@@ -3845,6 +3845,16 @@ var IAMInstanceProfileProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-access-key-provider.ts
 /**
+* How far before an attempt's start a key's `CreateDate` may fall and still be
+* treated as minted by that attempt (issue #2039).
+*
+* IAM stamps `CreateDate` from its own clock while the floor comes from ours,
+* so some tolerance is needed or ordinary skew disarms the check entirely. It
+* is deliberately small: every millisecond of it is a millisecond in which a
+* key created by something else becomes deletable.
+*/
+const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
+/**
 * AWS IAM AccessKey Provider (issue #1323)
 *
 * Implements resource provisioning for AWS::IAM::AccessKey using the IAM SDK.
@@ -3894,6 +3904,38 @@ var IAMAccessKeyProvider = class {
 		"Serial",
 		"Status"
 	])]]);
+	/**
+	* Serializes create attempts per IAM user, in this process (issue
+	* [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* The orphan reconcile below identifies "a key that appeared since my
+	* baseline". With two `AWS::IAM::AccessKey` resources on ONE user — the
+	* ordinary two-key rotation shape — the deploy engine dispatches both
+	* concurrently at the default `--concurrency 10`, and a key the SIBLING
+	* legitimately created lands inside that window and matches the same
+	* description. Deleting it destroys a live credential that is already in
+	* cdkd state and may already be piped into a downstream Secrets Manager
+	* secret via `Fn::GetAtt`, and `readCurrentState` returns `undefined` for a
+	* deleted key, so `cdkd drift` reports UNKNOWN rather than drift and the
+	* loss is invisible. That is strictly worse than the untracked-but-alive
+	* credential this whole mechanism exists to prevent.
+	*
+	* This lock removes that race rather than narrowing it: the baseline read,
+	* the create attempt, and the reconcile all happen under it, so no sibling
+	* create on the same user can interleave with them.
+	*/
+	userCreateLocks = /* @__PURE__ */ new Map();
+	/**
+	* Access key ids THIS process created successfully.
+	*
+	* The complement of the baseline: a baseline can only say "this key is
+	* newer than my snapshot", which is true both of the orphan left by my own
+	* failed attempt AND of a key someone else minted in the same window. This
+	* set names the keys cdkd itself owns and has already recorded, so they are
+	* never deletable however the timing falls — including the case the lock
+	* cannot cover, a second `cdkd` process sharing the user.
+	*/
+	accessKeyIdsCreatedByThisProcess = /* @__PURE__ */ new Set();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.iamClient = awsClients.iam;
@@ -3912,6 +3954,16 @@ var IAMAccessKeyProvider = class {
 		const userName = properties["UserName"];
 		if (!userName) throw new ProvisioningError(`AccessKey ${logicalId} requires UserName`, resourceType, logicalId);
 		const status = requireConfigString(properties["Status"], "Active", "AWS::IAM::AccessKey Status", replayWarn(this.logger, context));
+		return this.withUserCreateLock(userName, () => this.createAccessKeyUnderUserLock(logicalId, resourceType, userName, status));
+	}
+	/**
+	* The body of {@link IAMAccessKeyProvider.create}, running with this user's
+	* create lock held so the baseline, the create, and the reconcile are atomic
+	* against any sibling create on the same user.
+	*/
+	async createAccessKeyUnderUserLock(logicalId, resourceType, userName, status) {
+		const attemptStartMs = Date.now() - CREATE_DATE_SKEW_MARGIN_MS;
+		const baseline = await this.tryListAccessKeyIds(userName, logicalId);
 		try {
 			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
@@ -3946,6 +3998,7 @@ var IAMAccessKeyProvider = class {
 				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM access key ${logicalId}: ${accessKeyId}`);
+			this.accessKeyIdsCreatedByThisProcess.add(accessKeyId);
 			return {
 				physicalId: accessKeyId,
 				attributes: {
@@ -3954,11 +4007,135 @@ var IAMAccessKeyProvider = class {
 				}
 			};
 		} catch (error) {
+			await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs);
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
+	* Run `fn` with this IAM user's create lock held.
+	*
+	* Queue rather than mutual exclusion: each caller waits on its predecessor
+	* and publishes its own completion for the next one, so N concurrent creates
+	* on one user run strictly in arrival order. The stored promise only ever
+	* RESOLVES (the release is in a `finally`), so one create failing cannot
+	* wedge the queue behind it.
+	*
+	* Process-scoped, like every other guard here. A second `cdkd` process on the
+	* same user is out of its reach, which is why
+	* {@link IAMAccessKeyProvider.accessKeyIdsCreatedByThisProcess} and the
+	* `CreateDate` floor exist as well.
+	*/
+	async withUserCreateLock(userName, fn) {
+		const predecessor = this.userCreateLocks.get(userName) ?? Promise.resolve();
+		let release;
+		const held = new Promise((resolve) => {
+			release = resolve;
+		});
+		this.userCreateLocks.set(userName, predecessor.then(() => held));
+		await predecessor;
+		try {
+			return await fn();
+		} finally {
+			release();
+		}
+	}
+	/**
+	* Delete the access key THIS attempt minted before losing its response
+	* (issue [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* ## Why a reconcile rather than a token or an opt-out
+	*
+	* `CreateAccessKey` has no `ClientToken` / `ClientRequestToken` member, so
+	* there is nothing to make the call itself idempotent. The other candidate
+	* was `disableOuterRetry`, and it costs too much here: it would make the
+	* provider single-shot for EVERY transient error, including the IAM
+	* propagation window between a sibling `AWS::IAM::User` being created and
+	* being visible to `CreateAccessKey`.
+	*
+	* The orphan cannot be ADOPTED — its secret was returned once, in the
+	* response that was lost — so deleting it is the only remedy available.
+	*
+	* ## Three independent conditions, because deleting the wrong key is worse
+	* than leaving an orphan
+	*
+	* A key is deleted only when ALL of these hold:
+	*
+	*  1. It is absent from the baseline taken moments earlier, under the lock.
+	*  2. Its `CreateDate` is at or after this attempt started. IAM stamps that
+	*     date from ITS clock and the floor comes from ours, so a margin absorbs
+	*     ordinary skew; the residual risk is bounded by the length of ONE
+	*     `CreateAccessKey` call rather than by the retry schedule.
+	*  3. cdkd did not create it successfully in this process. This is the one
+	*     the baseline structurally cannot express — "newer than my snapshot" is
+	*     equally true of my orphan and of somebody else's key.
+	*
+	* Anything that fails 2 or 3 is reported and LEFT ALONE. That is the safe
+	* direction: an untracked key costs a quota slot and a manual cleanup, while
+	* a wrongly deleted one destroys a live credential that cdkd state still
+	* advertises — and because `readCurrentState` returns `undefined` for a
+	* deleted key, `cdkd drift` would report UNKNOWN rather than drift, so the
+	* loss would not even be visible.
+	*
+	* @param baseline `undefined` when the pre-create read failed, which disarms
+	* the reconcile entirely — see {@link IAMAccessKeyProvider.tryListAccessKeyIds}.
+	*/
+	async deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs) {
+		if (baseline === void 0) return;
+		const current = await this.tryListAccessKeyMetadata(userName, logicalId);
+		if (!current) return;
+		for (const key of current) {
+			const accessKeyId = key.accessKeyId;
+			if (baseline.has(accessKeyId) || this.accessKeyIdsCreatedByThisProcess.has(accessKeyId)) continue;
+			if (key.createDateMs === void 0 || key.createDateMs < attemptStartMs) {
+				this.logger.warn(`IAM access key ${accessKeyId} appeared on user ${userName} while creating ${logicalId}, but cdkd cannot attribute it to this attempt (created ${key.createDateMs === void 0 ? "at an unknown time" : new Date(key.createDateMs).toISOString()}, attempt started ${new Date(attemptStartMs).toISOString()}). Leaving it in place. If it is an orphan of a failed cdkd deploy, delete it with: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+				continue;
+			}
+			this.logger.warn(`IAM access key ${accessKeyId} was minted on user ${userName} by this failed attempt at ${logicalId} and its secret was lost with the response, so it is unusable and unrecorded; deleting it before the retry`);
+			try {
+				await this.iamClient.send(new DeleteAccessKeyCommand({
+					UserName: userName,
+					AccessKeyId: accessKeyId
+				}));
+			} catch (error) {
+				this.logger.warn(`Failed to delete the orphaned IAM access key ${accessKeyId} for user ${userName}: ${error instanceof Error ? error.message : String(error)}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+			}
+		}
+	}
+	/**
+	* The user's current access key ids, or `undefined` when the read failed.
+	*
+	* `undefined` disarms the reconcile rather than failing the create: a missing
+	* `iam:ListAccessKeys` permission must not turn a working deploy into a
+	* broken one over a safety net.
+	*/
+	async tryListAccessKeyIds(userName, logicalId) {
+		const metadata = await this.tryListAccessKeyMetadata(userName, logicalId);
+		return metadata && new Set(metadata.map((key) => key.accessKeyId));
+	}
+	/** `ListAccessKeys` with its `CreateDate`s, or `undefined` when the read failed. */
+	async tryListAccessKeyMetadata(userName, logicalId) {
+		const keys = [];
+		let marker;
+		try {
+			do {
+				const page = await this.iamClient.send(new ListAccessKeysCommand({
+					UserName: userName,
+					...marker && { Marker: marker }
+				}));
+				for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId) keys.push({
+					accessKeyId: key.AccessKeyId,
+					createDateMs: key.CreateDate ? key.CreateDate.getTime() : void 0
+				});
+				marker = page.IsTruncated ? page.Marker : void 0;
+			} while (marker);
+		} catch (error) {
+			this.logger.warn(`Could not list existing access keys for user ${userName} while creating ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: aws iam list-access-keys --user-name ${userName}`);
+			return;
+		}
+		return keys;
+	}
+	/**
 	* Update an IAM access key.
 	*
 	* `UserName` / `Serial` are createOnly (replacement — this method never
@@ -23206,6 +23383,118 @@ var EventBridgeBusProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/idempotency-token.ts
+/**
+* Retry-stable idempotency tokens for provider CREATE calls (issue
+* [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+*
+* ## The failure this exists to prevent
+*
+* The deploy engine wraps every `provider.create()` in an outer transient-error
+* retry (`src/deployment/retry.ts`), and issue #2026 made HTTP 500 / 502 / 504
+* retryable for the default classifier. A 500 whose request actually SUCCEEDED
+* server-side therefore re-invokes `create()` from the top. For a CREATE that
+* carries no name and no idempotency token, the replay mints a SECOND resource:
+* the first has no state entry, so `cdkd destroy` never reaches it and it bills
+* indefinitely. `RunInstances` is the worst instance of the class.
+*
+* ## What "stable" has to mean, precisely
+*
+* A token regenerated per attempt is not a fix — it is worse than none, because
+* the call site now LOOKS idempotent while behaving exactly as before. So the
+* value must be:
+*
+*  - **Identical across every attempt of one logical create.** Guaranteed here
+*    by memoising on `(scope, region, stackName, logicalId)` — a tuple the retry
+*    loop reproduces byte-for-byte, because it re-invokes the same closure with
+*    the same arguments. Deliberately NOT keyed on the resolved properties.
+*    (The earlier version of this note justified that by saying the properties
+*    are re-derived per attempt. They are NOT: `deploy-engine.ts` computes them
+*    once OUTSIDE the retry closure. The reason to keep them out of the key is
+*    that it makes the guarantee STRUCTURAL rather than contingent — an
+*    identity built from a logical id cannot be perturbed by a future change to
+*    how properties are resolved, whereas one built from their contents can.)
+*  - **Different for a genuinely NEW create of the same logical resource.**
+*    Reusing a token after a create SUCCEEDED is its own hazard: EC2 keeps a
+*    `RunInstances` token for ~24h and answers a repeat with the ORIGINAL
+*    instance, so a `--replace` re-create (delete old, then create with
+*    unchanged properties, all in one process) would be handed back the
+*    instance it had just terminated. {@link IdempotencyToken.release} is what
+*    prevents that: it is called only on the success path, and it bumps a
+*    per-key generation counter so the next acquire derives a fresh value.
+*  - **Never reused by a LATER cdkd run.** A per-process nonce is mixed into
+*    the digest, so two `cdkd deploy` invocations of the same template never
+*    collide even though every other input is identical.
+*
+* ## Why not a purely deterministic hash of the create inputs
+*
+* That is what `EFSProvider`'s `CreationToken` and `FSxFileSystemProvider`'s
+* `ClientRequestToken` do, and it is right FOR THEM: those APIs enforce token
+* uniqueness only among LIVE file systems, so a re-deploy after a destroy is
+* unaffected, and hashing the immutable inputs is what lets the new file system
+* coexist with the old one during a replacement. EC2 is the opposite shape —
+* the token survives the resource's own termination — so a value that is stable
+* across RUNS is a liability there rather than an asset. Both providers keep
+* their existing derivation; this module is for the APIs where the token must
+* be scoped to one process and one create.
+*/
+/**
+* Mixed into every digest so no two `cdkd` processes can derive the same token
+* from the same template. Evaluated once at module load; ESM guarantees a
+* single module instance per process, which is exactly the scope wanted.
+*/
+const PROCESS_NONCE = randomUUID();
+/** Tokens currently in flight, keyed by {@link tokenKey}. */
+const inFlight = /* @__PURE__ */ new Map();
+/**
+* How many times each key has been RELEASED. Folded into the digest so a
+* post-success re-acquire (the `--replace` delete-then-create path) yields a
+* different token than the create that already succeeded.
+*/
+const generations = /* @__PURE__ */ new Map();
+/**
+* Ceiling on {@link generations}. Chosen far above any realistic stack size so
+* eviction is unreachable in a normal `cdkd` run, and present only so a
+* long-lived process cannot grow the map without bound.
+*/
+const MAX_TRACKED_GENERATIONS = 1e5;
+const tokenKey = (scope, logicalId) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}`;
+const derive = (key, generation, maxLength) => {
+	return `cdkd-${createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex")}`.slice(0, maxLength);
+};
+/**
+* Get the idempotency token for one logical create, minting it on first use and
+* returning the SAME value for every retry of that create.
+*
+* @example
+* ```ts
+* const token = acquireIdempotencyToken({ scope: 'RunInstances', logicalId });
+* const response = await client.send(new RunInstancesCommand({ ...input, ClientToken: token.value }));
+* token.release(); // success path only
+* ```
+*/
+function acquireIdempotencyToken(options) {
+	const { scope, logicalId, maxLength = 64 } = options;
+	const key = tokenKey(scope, logicalId);
+	const existing = inFlight.get(key);
+	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength);
+	if (existing === void 0) inFlight.set(key, value);
+	return {
+		value,
+		release: () => {
+			if (!inFlight.has(key)) return;
+			inFlight.delete(key);
+			const generation = (generations.get(key) ?? 0) + 1;
+			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
+				const oldest = generations.keys().next();
+				if (!oldest.done) generations.delete(oldest.value);
+			}
+			generations.set(key, generation);
+		}
+	};
+}
+
 //#endregion
 //#region src/utils/ip-protocol.ts
 /**
@@ -24274,8 +24563,13 @@ var EC2Provider = class {
 		this.logger.debug(`Creating NatGateway ${logicalId}`);
 		const subnetId = properties["SubnetId"];
 		if (!subnetId) throw new ProvisioningError(`SubnetId is required for NatGateway ${logicalId}`, resourceType, logicalId);
+		const natGatewayToken = acquireIdempotencyToken({
+			scope: "CreateNatGateway",
+			logicalId
+		});
 		try {
 			const natGatewayId = (await this.ec2Client.send(new CreateNatGatewayCommand({
+				ClientToken: natGatewayToken.value,
 				SubnetId: subnetId,
 				AllocationId: properties["AllocationId"],
 				ConnectivityType: properties["ConnectivityType"] ?? void 0,
@@ -24296,6 +24590,7 @@ var EC2Provider = class {
 				this.logger.debug(`NatGateway ${natGatewayId} is available`);
 			} else this.logger.debug(`NatGateway ${natGatewayId} created (skipping available-state wait per --no-wait)`);
 			this.logger.debug(`Successfully created NatGateway ${logicalId}: ${natGatewayId}`);
+			natGatewayToken.release();
 			return {
 				physicalId: natGatewayId,
 				attributes: { NatGatewayId: natGatewayId }
@@ -24338,10 +24633,18 @@ var EC2Provider = class {
 		this.logger.debug(`Creating RouteTable ${logicalId}`);
 		const vpcId = properties["VpcId"];
 		if (!vpcId) throw new ProvisioningError(`VpcId is required for RouteTable ${logicalId}`, resourceType, logicalId);
+		const routeTableToken = acquireIdempotencyToken({
+			scope: "CreateRouteTable",
+			logicalId
+		});
 		try {
-			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({ VpcId: vpcId }))).RouteTable.RouteTableId;
+			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({
+				VpcId: vpcId,
+				ClientToken: routeTableToken.value
+			}))).RouteTable.RouteTableId;
 			await this.applyTags(routeTableId, properties, logicalId);
 			this.logger.debug(`Successfully created RouteTable ${logicalId}: ${routeTableId}`);
+			routeTableToken.release();
 			return {
 				physicalId: routeTableId,
 				attributes: { RouteTableId: routeTableId }
@@ -24890,7 +25193,12 @@ var EC2Provider = class {
 			const securityGroups = properties["SecurityGroups"];
 			const iamInstanceProfile = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
 			const networkInterfaces = this.buildNetworkInterfaces(properties);
+			const runInstancesToken = acquireIdempotencyToken({
+				scope: "RunInstances",
+				logicalId
+			});
 			const instance = (await this.ec2Client.send(new RunInstancesCommand({
+				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
 				KeyName: properties["KeyName"] ?? void 0,
@@ -24940,6 +25248,7 @@ var EC2Provider = class {
 					AvailabilityZone: runningInstance?.Placement?.AvailabilityZone ?? ""
 				};
 				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
+				runInstancesToken.release();
 				return {
 					physicalId: instanceId,
 					attributes
@@ -24947,6 +25256,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
 					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: aws ec2 terminate-instances --instance-ids ${instanceId}`);
@@ -25461,10 +25771,18 @@ var EC2Provider = class {
 		this.logger.debug(`Creating NetworkAcl ${logicalId}`);
 		const vpcId = properties["VpcId"];
 		if (!vpcId) throw new ProvisioningError(`VpcId is required for NetworkAcl ${logicalId}`, resourceType, logicalId);
+		const networkAclToken = acquireIdempotencyToken({
+			scope: "CreateNetworkAcl",
+			logicalId
+		});
 		try {
-			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({ VpcId: vpcId }))).NetworkAcl.NetworkAclId;
+			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({
+				VpcId: vpcId,
+				ClientToken: networkAclToken.value
+			}))).NetworkAcl.NetworkAclId;
 			await this.applyTags(networkAclId, properties, logicalId);
 			this.logger.debug(`Successfully created NetworkAcl ${logicalId}: ${networkAclId}`);
+			networkAclToken.release();
 			return {
 				physicalId: networkAclId,
 				attributes: { Id: networkAclId }
@@ -34435,10 +34753,18 @@ var ELBv2Provider = class {
 	* `withRetry`, whose per-attempt `debug` line and give-up `warn` summary
 	* interpolate the AWS message verbatim — and that payload is built from
 	* RESOLVED template properties. See {@link maskedRetryLogger}.
+	*
+	* The LoadBalancer arm receives it too (issue #2063). It runs no `withRetry`,
+	* but it has the two surfaces that do not need one: the `ProvisioningError`
+	* its catch throws (printed at ERROR — DEFAULT verbosity — by
+	* `deploy-engine.ts`) and its partial-create cleanup `warn`. Its payload is
+	* `Name` / `Subnets` / `SecurityGroups` / `LoadBalancerAttributes` values /
+	* `Tags` values straight out of the resolved bag, and AWS quotes a rejected
+	* value back.
 	*/
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties);
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.createLoadBalancer(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.createTargetGroup(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::Listener": return this.createListener(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
@@ -34447,6 +34773,15 @@ var ELBv2Provider = class {
 	/**
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
 	* update-path twin of the `create()` note above.
+	*
+	* The catch below is the LoadBalancer arm's masking site (issue #2063), and
+	* the reason that arm needs no `maskSecrets` parameter of its own.
+	* `updateLoadBalancer` has no try/catch: its `ModifyLoadBalancerAttributes` /
+	* `SetSubnets` / `SetSecurityGroups` / `AddTags` rejections — every one of
+	* them built from the resolved `properties` bag — propagate RAW to here.
+	* The sibling arms wrap their own errors into a `ProvisioningError` first,
+	* so the `CdkdError` passthrough short-circuits them and this frame masks
+	* only what actually escapes unwrapped.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
@@ -34454,12 +34789,12 @@ var ELBv2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${this.maskErrorMessage(error, context?.maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
@@ -34473,7 +34808,7 @@ var ELBv2Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createLoadBalancer(logicalId, resourceType, properties) {
+	async createLoadBalancer(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating LoadBalancer ${logicalId}`);
 		try {
 			const tags = this.extractTags(properties);
@@ -34520,7 +34855,7 @@ var ELBv2Provider = class {
 						SecurityGroups: properties["SecurityGroups"] ?? [],
 						EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: enforcePrivateLink
 					}));
-					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${enforcePrivateLink} for ${logicalId}`);
+					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${maskerOrIdentity(maskSecrets)(String(enforcePrivateLink))} for ${logicalId}`);
 				}
 				const minCapacity = properties["MinimumLoadBalancerCapacity"];
 				if (minCapacity?.CapacityUnits !== void 0) {
@@ -34528,7 +34863,7 @@ var ELBv2Provider = class {
 						LoadBalancerArn: lbArn,
 						MinimumLoadBalancerCapacity: { CapacityUnits: Number(minCapacity.CapacityUnits) }
 					}));
-					this.logger.debug(`Requested capacity reservation of ${minCapacity.CapacityUnits} LCU for ${logicalId}`);
+					this.logger.debug(`Requested capacity reservation of ${maskerOrIdentity(maskSecrets)(String(minCapacity.CapacityUnits))} LCU for ${logicalId}`);
 					if (isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(lbArn, logicalId);
 				}
 			} catch (innerError) {
@@ -34536,7 +34871,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
 					this.logger.debug(`Cleaned up partially-created LoadBalancer ${logicalId} (${lbArn}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created LoadBalancer ${logicalId} (${lbArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`);
+					this.logger.warn(`Failed to clean up partially-created LoadBalancer ${logicalId} (${lbArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`);
 				}
 				throw innerError;
 			}
@@ -34552,10 +34887,10 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateLoadBalancer(logicalId, physicalId, _resourceType, properties, previousProperties) {
+	async updateLoadBalancer(logicalId, physicalId, _resourceType, properties, previousProperties, maskSecrets) {
 		const handledKeys = /* @__PURE__ */ new Set([
 			"LoadBalancerAttributes",
 			"Subnets",
@@ -34637,7 +34972,7 @@ var ELBv2Provider = class {
 				LoadBalancerArn: physicalId,
 				...newCapacityUnits !== void 0 ? { MinimumLoadBalancerCapacity: { CapacityUnits: newCapacityUnits } } : { ResetCapacityReservation: true }
 			}));
-			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${newCapacityUnits} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
+			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${maskerOrIdentity(maskSecrets)(String(newCapacity?.CapacityUnits))} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
 			if (newCapacityUnits !== void 0 && isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(physicalId, logicalId);
 		}
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -34655,6 +34990,16 @@ var ELBv2Provider = class {
 	* a timeout WARNS and continues (the reservation keeps provisioning
 	* asynchronously and the ModifyCapacityReservation was accepted), while a
 	* `failed` zonal state throws — that reservation will never provision.
+	*
+	* Takes NO masker, deliberately (issue #2063 audit). Its only request is
+	* `DescribeCapacityReservation({ LoadBalancerArn })` with an AWS-issued ARN,
+	* so no resolved template value is in the payload for AWS to quote back into
+	* the transient-failure `debug` line; the timeout `warn` and the `failed`
+	* throw are assembled from a logical id, a count and an AWS-supplied zonal
+	* reason. A structural reason, not a likelihood judgement — add the
+	* parameter if this ever sends a template-derived member. The `failed` throw
+	* is an ordinary `Error`, so it lands in `createLoadBalancer`'s masked catch
+	* on the create path and in `update()`'s on the update path either way.
 	*/
 	async waitForCapacityReservationProvisioned(lbArn, logicalId) {
 		const maxAttempts = 40;
@@ -38735,9 +39080,14 @@ var Route53Provider = class {
 			const createComment = readConfigString(hostedZoneConfig, "Comment", "", "AWS::Route53::HostedZone HostedZoneConfig");
 			const vpcs = properties["VPCs"];
 			const firstVpc = vpcs && vpcs.length > 0 ? vpcs[0] : void 0;
-			const response = await this.getClient().send(new CreateHostedZoneCommand({
+			const callerReferenceToken = acquireIdempotencyToken({
+				scope: "CreateHostedZone",
+				logicalId,
+				maxLength: 128
+			});
+			const response = await this.createOrAdoptHostedZone({
 				Name: name,
-				CallerReference: `${logicalId}-${Date.now()}`,
+				CallerReference: callerReferenceToken.value,
 				...createComment !== "" ? { HostedZoneConfig: {
 					Comment: createComment,
 					...firstVpc ? { PrivateZone: true } : {}
@@ -38746,7 +39096,7 @@ var Route53Provider = class {
 					VPCId: firstVpc["VPCId"],
 					VPCRegion: firstVpc["VPCRegion"]
 				} } : {}
-			}));
+			});
 			const hostedZone = response.HostedZone;
 			if (!hostedZone?.Id) throw new Error("CreateHostedZone did not return HostedZone.Id");
 			const zoneId = hostedZone.Id.replace("/hostedzone/", "");
@@ -38773,6 +39123,7 @@ var Route53Provider = class {
 				try {
 					await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
+					callerReferenceToken.release();
 				} catch (deleteError) {
 					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)} — operator may need to clean up the orphan zone`);
 				}
@@ -38781,6 +39132,7 @@ var Route53Provider = class {
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
+			callerReferenceToken.release();
 			return {
 				physicalId: zoneId,
 				attributes: {
@@ -38794,6 +39146,77 @@ var Route53Provider = class {
 			throw new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* `CreateHostedZone`, with the retry-replay case ADOPTED rather than failed
+	* (issue [#2039](https://github.com/go-to-k/cdkd/issues/2039)).
+	*
+	* A stable `CallerReference` stops a replayed create from minting a second
+	* zone, but on its own it converts the replay into a hard
+	* `HostedZoneAlreadyExists` — so the first attempt's zone would still be live
+	* and still absent from state, only now the deploy fails as well. Route 53
+	* reports the caller reference back on every `HostedZone`, which is what lets
+	* the replay find the zone the lost response described and continue with it.
+	*
+	* The lookup is `ListHostedZonesByName`, which starts at the requested DNS
+	* name and returns zones in name order, so the walk stops as soon as the name
+	* changes rather than paging the whole account. A `GetHostedZone` follows,
+	* because only that call returns the `DelegationSet` whose `NameServers` are
+	* the resource's `Fn::GetAtt` value — an adopted zone must return the same
+	* attributes a first-attempt create would have.
+	*
+	* Finding nothing rethrows the original error: a caller reference AWS says is
+	* taken but that names no zone we can see is not something to paper over.
+	*/
+	async createOrAdoptHostedZone(input) {
+		try {
+			return await this.getClient().send(new CreateHostedZoneCommand(input));
+		} catch (error) {
+			if (!(error instanceof HostedZoneAlreadyExists || error?.name === "HostedZoneAlreadyExists")) throw error;
+			let adopted;
+			try {
+				adopted = await this.findHostedZoneByCallerReference(input.Name, input.CallerReference);
+			} catch (lookupError) {
+				this.logger.warn(`CreateHostedZone for ${input.Name} was refused as already-existing, and the lookup that would have adopted the existing zone failed: ${lookupError instanceof Error ? lookupError.message : String(lookupError)}. Reporting the original error.`);
+				throw error;
+			}
+			if (!adopted?.Id) throw error;
+			this.logger.warn(`CreateHostedZone for ${input.Name} was replayed after a lost response; adopting the hosted zone ${adopted.Id} the previous attempt already created instead of creating a second one`);
+			try {
+				const described = await this.getClient().send(new GetHostedZoneCommand({ Id: adopted.Id }));
+				return {
+					HostedZone: described.HostedZone ?? adopted,
+					...described.DelegationSet ? { DelegationSet: described.DelegationSet } : {}
+				};
+			} catch (describeError) {
+				this.logger.warn(`Adopted hosted zone ${adopted.Id} but could not read it back: ${describeError instanceof Error ? describeError.message : String(describeError)}. Reporting the original error rather than returning a zone with no NameServers.`);
+				throw error;
+			}
+		}
+	}
+	/**
+	* The hosted zone carrying `callerReference`, or `undefined`.
+	*
+	* Scoped to zones whose name matches `dnsName`: `ListHostedZonesByName` is
+	* ordered by name, so once the name differs no later page can hold ours.
+	*/
+	async findHostedZoneByCallerReference(dnsName, callerReference) {
+		const wanted = canonicalizeQueryName(dnsName);
+		let marker = { DNSName: wanted };
+		while (marker) {
+			const page = await this.getClient().send(new ListHostedZonesByNameCommand({
+				DNSName: marker.DNSName,
+				...marker.HostedZoneId ? { HostedZoneId: marker.HostedZoneId } : {}
+			}));
+			for (const zone of page.HostedZones ?? []) {
+				if (canonicalizeQueryName(zone.Name ?? "") !== wanted) return;
+				if (zone.CallerReference === callerReference) return zone;
+			}
+			marker = page.IsTruncated && page.NextDNSName ? {
+				DNSName: page.NextDNSName,
+				...page.NextHostedZoneId ? { HostedZoneId: page.NextHostedZoneId } : {}
+			} : void 0;
+		}
+	}
 	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
@@ -41818,25 +42241,38 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050). The
 	* Service create path runs a post-create `UpdateServiceAttributes` through
 	* `withRetry` — see {@link maskedRetryLogger}.
+	*
+	* EVERY arm receives it, not just the Service one (issue #2063). The three
+	* namespace arms build their `Create*NamespaceCommand` payload out of the
+	* RESOLVED `properties` bag — `Name`, `Description`, `Tags` — and each has
+	* two disclosure surfaces for it: the `ProvisioningError` its catch throws
+	* (printed at ERROR, i.e. DEFAULT verbosity, by `deploy-engine.ts`) and the
+	* AWS `ErrorMessage` that {@link pollOperation} raises for a FAILED
+	* operation. Cloud Map's create is operation-based, so the second one is the
+	* NORMAL rejection path for those arms, not an edge case.
 	*/
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
-			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	/**
 	* `context` is read for ONE thing today: `maskSecrets` (issue #2050) — the
-	* update-path twin of the `create()` note above.
+	* update-path twin of the `create()` note above, and threaded into every arm
+	* for the same reason (issue #2063). The namespace update arms carry one
+	* payload surface the create arms do not: {@link syncNamespaceTags} sends
+	* `TagResource` with the resolved `Tags` VALUES, whose rejection lands in
+	* the arm's own catch.
 	*/
 	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -41850,7 +42286,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createNamespace(logicalId, resourceType, properties) {
+	async createNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating private DNS namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -41869,7 +42305,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...inputProperties && { Properties: inputProperties }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePrivateDnsNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			const arn = await this.buildNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created private DNS namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -41882,7 +42318,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -41908,7 +42344,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* kind's Cloud Map default ({@link PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
 	* the CFn-parity shape, live A/B'd 2026-08-11 on the private kind itself.
 	*/
-	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
@@ -41922,7 +42358,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			} else this.logger.debug(`No mutable namespace-body diff for PrivateDnsNamespace ${logicalId}`);
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
@@ -41933,7 +42369,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -41967,7 +42403,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createHttpNamespace(logicalId, resourceType, properties) {
+	async createHttpNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating HTTP namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -41981,7 +42417,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...tags && tags.length > 0 && { Tags: tags }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			const arn = await this.resolveNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -41994,7 +42430,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -42015,7 +42451,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* the template must be cleared explicitly via the `''` sentinel — the
 	* CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
-	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
@@ -42026,7 +42462,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated HTTP namespace ${logicalId}`);
@@ -42037,10 +42473,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createPublicDnsNamespace(logicalId, resourceType, properties) {
+	async createPublicDnsNamespace(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating public DNS namespace ${logicalId}`);
 		const client = this.getClient();
 		const name = properties["Name"];
@@ -42056,7 +42492,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				...inputProperties && { Properties: inputProperties }
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
-			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			let arn;
 			let hostedZoneId;
 			try {
@@ -42079,7 +42515,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
@@ -42097,7 +42533,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* kind's Cloud Map default ({@link PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
 	* the CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
-	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
@@ -42111,7 +42547,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Namespace: namespaceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated public DNS namespace ${logicalId}`);
@@ -42122,7 +42558,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${this.maskErrorMessage(error, maskSecrets)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createService(logicalId, resourceType, properties, maskSecrets) {
@@ -42228,7 +42664,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					Id: physicalId,
 					Service: serviceChange
 				}))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
 			if (hasAttrUpsert) {
 				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
@@ -42299,6 +42735,15 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
 	* deterministic STS-based construction as fallback so a transient read
 	* failure right after create does not fail the whole resource.
+	*
+	* Takes NO masker, deliberately (issue #2063 audit). Its request is
+	* `GetNamespace({ Id })` with an AWS-issued namespace id — no resolved
+	* template value is in the payload, so the AWS error text it logs cannot
+	* echo one back. That is a structural reason, not an assessment of
+	* likelihood; add the parameter if this call ever grows a template-derived
+	* member. The `TagResource` / `UntagResource` calls in
+	* {@link syncNamespaceTags} DO carry resolved values, but they throw rather
+	* than log, and the throw lands in the calling arm's masked catch.
 	*/
 	async resolveNamespaceArn(namespaceId) {
 		try {
@@ -42341,8 +42786,39 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/**
 	* Poll a Service Discovery operation until it completes.
 	* Returns the target resource ID from the operation result.
-	*/
-	async pollOperation(operationId, logicalId, resourceType) {
+	*
+	* MASKS `Operation.ErrorMessage` (issue #2063), and this is the only place
+	* that can. Cloud Map's create / update are operation-based: the caller's
+	* `Create*Namespace` / `Update*` request carried the RESOLVED `properties`
+	* bag — `Name`, `Description`, `Tags`, `DnsConfig` — and AWS reports its
+	* rejection here rather than by rejecting the submit call, quoting the
+	* offending value back in `ErrorMessage`. A FAILED operation is therefore
+	* the NORMAL rejection path for these arms, not an edge case.
+	*
+	* Why not leave it to the arms' own catch: every namespace arm and
+	* `updateService` open with `if (error instanceof ProvisioningError) throw
+	* error;`, so a `ProvisioningError` raised here is re-thrown VERBATIM and
+	* never reaches their `maskErrorMessage`. `deploy-engine.ts` then prints it
+	* at ERROR — DEFAULT verbosity. That passthrough is correct (it preserves
+	* the resource/logical-id context this frame added), which is exactly why
+	* the mask has to be applied at the point of construction.
+	*
+	* `errorMessage` is masked RAW, before any interpolation. Stating precisely
+	* what that buys, because the obvious phrasing over-claims (issue #2063
+	* review): `maskSecretsInText`'s WHOLE-VALUE arm fires only when
+	* `secrets.has(text)` — i.e. when the text IS the secret in its entirety —
+	* so masking raw covers the case where AWS returns the offending value as
+	* the whole `ErrorMessage`, at ANY length, including below the substring
+	* arm's 4-character `MIN_NEEDLE_LENGTH` floor. When AWS instead quotes the
+	* value INSIDE a sentence, the substring arm handles it and that floor
+	* applies either way, raw or not. So masking here is strictly better than
+	* masking the assembled message, but it is not general sub-4-character
+	* coverage. See `SecretMaskingContext` in `src/types/resource.ts`.
+	*
+	* The `operationId` / timeout message below carries no template-derived
+	* value (an AWS-issued opaque id), so it is left as-is.
+	*/
+	async pollOperation(operationId, logicalId, resourceType, maskSecrets) {
 		const client = this.getClient();
 		const maxAttempts = 60;
 		let delay = 1e3;
@@ -42354,7 +42830,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				if (targets) return targets["NAMESPACE"] || targets["SERVICE"] || operationId;
 				return operationId;
 			}
-			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${result.Operation?.ErrorMessage || "Unknown error"}`, resourceType, logicalId);
+			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error")}`, resourceType, logicalId);
 			await new Promise((resolve) => setTimeout(resolve, delay));
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -83294,7 +83770,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.18");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;