@go-to-k/cdkd 0.284.22 → 0.284.24

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as PartialFailureError, $t as getBootstrapMarkerKey, A as renderStatefulReason, An as expectedOwnerParam, At as applyRoleArnIfSet, B as exportAliasCollisionScrubWarning, Bn as resetAwsClients, Bt as shouldRetainResource, C as isFinalSnapshotError, Cn as stateBucketExistenceConfirmed, Ct as redactSecretsForState, D as extractDeploymentEventError, Dn as MIGRATE_TMP_PREFIX, Dt as s3BucketDualStackDomainName, E as makeCanonicalizePropertiesFn, En as CFN_TEMPLATE_URL_LIMIT, Et as s3BucketDomainName, F as green, Fn as processStackMessages, Ft as DagBuilder, G as collectInlinePolicyNamesManagedBySiblings, Gt as createAssetRedirectResolver, H as secretBearingStateKeyWarning, Ht as stringifyValue, I as red, It as TemplateParser, J as findActionableSilentDrops, Jn as LocalMigrateError, Jt as escapeRegExp, K as clearOnUpdateRemoval, Kn as DeployCancelledError, Kt as loadPublishableAssetManifest, L as yellow, Ln as resolveBucketRegion, Lt as LockManager, M as bold, Mn as canonicalizeRegion, Mt as INTRINSIC_KEYS, N as cyan, Nn as derivePartitionAndUrlSuffix, Nt as describeTypeWithThrottleRetry, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as findLargeInlineResources, Ot as s3BucketRegionalDomainName, P as gray, Pn as AssemblyReader, Pt as withRetry, Q as disableInstanceApiTermination, Qn as NestedStackChildDirectDestroyError, Qt as ensureAssetStorage, R as collectDeclaredOutputNames, Rn as AwsClients, Rt as S3StateBackend, S as createPreDeleteFinalSnapshot, Sn as resolveUseCdkBootstrapAssets, St as maskSecretsInText, T as unsupportedFinalSnapshotError, Tn as CFN_TEMPLATE_BODY_LIMIT, Tt as s3BucketArn, U as stateKeySecretExposure, Un as CdkdError, Ut as WorkGraph, V as isExportAliasCollision, Vn as setAwsClients, Vt as AssetPublisher, W as IAMRoleProvider, Wt as buildAssetRedirectMap, X as CloudControlProvider, Xt as AssetModeResolver, Y as findSilentDropProperties, Yn as LocalStartServiceError, Yt as stripControlChars, Z as slowCcOperationTimeoutMs, Zn as MissingCdkCliError, Zt as BOOTSTRAP_MARKER_PREFIX, _ as computeImplicitDeleteEdges, _n as resolveAutoAssetStorage, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as buildDockerImage, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as resolveStateBucketWithDefault, bt as dynamicReferenceTokens, c as replayFailedOperations, cn as runDockerForeground, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDockerImageBySourceHash, dr as isMarkedNonRetryable, dt as readConfigString, en as parseBootstrapMarker, er as ProvisioningError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as Synthesizer, fr as isRetryableTransientError, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveApp, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as getLegacyStateBucketName, ht as requireConfigString, i as DeploymentEventsReader, in as buildDenyExternalAccessPolicy, ir as StackTerminationProtectionError, it as WAFv2WebACLProvider, j as formatResourceLine, jn as PARTITION_TABLE, jt as DiffCalculator, k as isStatefulRecreateTargetSync, kn as uploadCfnTemplate, kt as s3BucketWebsiteUrl, l as replayRollback, ln as runDockerStreaming, lr as normalizeAwsError, lt as configBooleanRefusal, m as withResourceDeadline, mn as getDefaultStateBucketName, mr as markNonRetryable, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as validateAssetBucketName, nr as ResourceUpdateNotSupportedError, nt as getAccountInfo, o as planFailedOps, on as formatDockerLoginError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as synthesisStatusMessage, pr as isThrottlingError, pt as requireConfigArray, q as ProviderRegistry, qn as LocalInvokeBuildError$1, qt as rewriteTemplateAssetReferences, r as DeployEngine, rn as validateContainerRepoName, rr as StackHasActiveImportsError, rt as refStateLookupFromResource, s as planRollback, sn as getDockerCmd, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as readBootstrapMarkerBody, tr as ResourceTimeoutError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as AssetManifestLoader, ur as withErrorHandling, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveCaptureObservedState, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as warnDeprecatedNoPrefixCliFlag, wt as scrubResourceRecord, x as ccRoutedFinalSnapshotError, xn as resolveStateBucketWithDefaultAndSource, xt as isSingleDynamicReferenceToken, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveSkipPrefix, yt as createSecretMasker, z as collectPublishedOutputNames, zn as getAwsClients, zt as rebuildClientForBucketRegion } from "./deploy-engine-DOlhIeGv.js";
+import { $ as disableInstanceApiTermination, $n as NestedStackChildDirectDestroyError, $t as ensureAssetStorage, A as isStatefulRecreateTargetSync, An as uploadCfnTemplate, At as s3BucketWebsiteUrl, B as collectPublishedOutputNames, Bn as getAwsClients, Bt as rebuildClientForBucketRegion, C as createPreDeleteFinalSnapshot, Cn as resolveUseCdkBootstrapAssets, Ct as maskSecretsInText, D as makeCanonicalizePropertiesFn, Dn as CFN_TEMPLATE_URL_LIMIT, Dt as s3BucketDomainName, E as unsupportedFinalSnapshotError, En as CFN_TEMPLATE_BODY_LIMIT, Et as s3BucketArn, F as gray, Fn as AssemblyReader, Ft as withRetry, G as IAMRoleProvider, Gt as buildAssetRedirectMap, H as isExportAliasCollision, Hn as setAwsClients, Ht as AssetPublisher, I as green, In as processStackMessages, It as DagBuilder, J as ProviderRegistry, Jn as LocalInvokeBuildError$1, Jt as rewriteTemplateAssetReferences, K as collectInlinePolicyNamesManagedBySiblings, Kt as createAssetRedirectResolver, L as red, Lt as TemplateParser, M as formatResourceLine, Mn as PARTITION_TABLE, Mt as DiffCalculator, N as bold, Nn as canonicalizeRegion, Nt as INTRINSIC_KEYS, O as extractDeploymentEventError, On as MIGRATE_TMP_PREFIX, Ot as s3BucketDualStackDomainName, P as cyan, Pn as derivePartitionAndUrlSuffix, Pt as describeTypeWithThrottleRetry, Q as slowCcOperationTimeoutMs, Qn as MissingCdkCliError, Qt as BOOTSTRAP_MARKER_PREFIX, R as yellow, Rn as resolveBucketRegion, Rt as LockManager, S as ccRoutedFinalSnapshotError, Sn as resolveStateBucketWithDefaultAndSource, St as isSingleDynamicReferenceToken, T as refusesFinalSnapshot, Tn as warnDeprecatedNoPrefixCliFlag, Tt as scrubResourceRecord, U as secretBearingStateKeyWarning, Ut as stringifyValue, V as exportAliasCollisionScrubWarning, Vn as resetAwsClients, Vt as shouldRetainResource, W as stateKeySecretExposure, Wn as CdkdError, Wt as WorkGraph, X as findSilentDropProperties, Xn as LocalStartServiceError, Xt as stripControlChars, Y as findActionableSilentDrops, Yn as LocalMigrateError, Yt as escapeRegExp, Z as CloudControlProvider, Zt as AssetModeResolver, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as resolveApp, _t as STATE_SOURCED_CROSS_GENERATION_RULES, a as DeploymentEventsStore, an as buildDenyExternalAccessPolicy, ar as StackTerminationProtectionError, at as WAFv2WebACLProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bn as resolveSkipPrefix, bt as createSecretMasker, c as producerRegionsFromState, cn as getDockerCmd, ct as assertRegionMatch, d as updatePartialMessage, dn as AssetManifestLoader, dr as withErrorHandling, dt as configStringRefusal, en as getBootstrapMarkerKey, er as PartialFailureError, et as isTerminationProtectionPropagationError, f as updatePartialReason, fn as getDockerImageBySourceHash, fr as isMarkedNonRetryable, ft as readConfigString, g as maskingRetryLogger, gn as getLegacyStateBucketName, gt as requireConfigString, h as withResourceDeadline, hn as getDefaultStateBucketName, hr as markNonRetryable, ht as requireConfigObject, i as DeploymentEventsReader, in as validateContainerRepoName, ir as StackHasActiveImportsError, it as refStateLookupFromResource, j as renderStatefulReason, jn as expectedOwnerParam, jt as applyRoleArnIfSet, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as findLargeInlineResources, kt as s3BucketRegionalDomainName, l as replayFailedOperations, ln as runDockerForeground, lt as coerceCfnBoolean, m as deleteSkipReason, mn as synthesisStatusMessage, mr as isThrottlingError, mt as requireConfigArray, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as readBootstrapMarkerBody, nr as ResourceTimeoutError, nt as cfnRefValueFromPhysicalId, o as planFailedOps, on as buildDockerImage, ot as normalizeAwsTagsToCfn, p as UNSPECIFIED_SKIP_REASON, pn as Synthesizer, pr as isRetryableTransientError, pt as replayWarn, q as clearOnUpdateRemoval, qn as DeployCancelledError, qt as loadPublishableAssetManifest, r as DeployEngine, rn as validateAssetBucketName, rr as ResourceUpdateNotSupportedError, rt as getAccountInfo, s as planRollback, sn as formatDockerLoginError, st as resolveExplicitPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as parseBootstrapMarker, tr as ProvisioningError, tt as IntrinsicFunctionResolver, u as replayRollback, un as runDockerStreaming, ur as normalizeAwsError, ut as configBooleanRefusal, v as computeImplicitDeleteEdges, vn as resolveAutoAssetStorage, vt as STATE_SOURCED_READBACK_RULES, w as isFinalSnapshotError, wn as stateBucketExistenceConfirmed, wt as redactSecretsForState, x as buildFinalSnapshotIdentifier, xn as resolveStateBucketWithDefault, xt as dynamicReferenceTokens, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as resolveCaptureObservedState, yt as TEMPLATE_SOURCED_RULES, z as collectDeclaredOutputNames, zn as AwsClients, zt as S3StateBackend } from "./deploy-engine-BJQbni1s.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DLU0EEhO.js";
+import { t as ASGProvider } from "./asg-provider-Bh0odlSk.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17,7 +17,7 @@ import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, Cre
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, DistributionAlreadyExists, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
@@ -10863,6 +10863,23 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
+* The "old subscription was not deleted" reason the THROWN-delete arm of
+* `update()` reports (issue
+* [#1967](https://github.com/go-to-k/cdkd/issues/1967)).
+*
+* A constant, and FIXED WORDING with no interpolation, for the reason the
+* abort block spells out at length: this string is rendered onto the warn line
+* beside a message that must stay clear of the substrings
+* `retryable-errors.ts` classifies on, and the underlying AWS error text — an
+* `Unsubscribe` throttle, a `does not exist` — is user-uncontrolled and
+* carries several of them. The AWS message goes out on its own warn line in
+* the `catch`, where nothing classifies it.
+*
+* Its skip-arm twin is the provider-supplied `ResourceDeleteResult.reason`,
+* which is subject to the same rule at its own producer.
+*/
+const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
+/**
 * AWS SNS Subscription Provider
 *
 * Implements resource provisioning for AWS::SNS::Subscription using the SNS SDK.
@@ -10941,14 +10958,17 @@ var SNSSubscriptionProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
 		let deleteResult = void 0;
+		let deleteThrew = false;
 		try {
 			deleteResult = await this.delete(logicalId, physicalId, resourceType);
 		} catch (error) {
+			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${String(error)}`);
 		}
-		if (deleteResult?.outcome === "skipped") {
-			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${deleteResult.reason}`);
-			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Repair the state record for ${logicalId}, or remove the old subscription in AWS if it is still live, then re-run.`, resourceType, logicalId, physicalId));
+		const notDeletedReason = deleteThrew ? SNS_SUBSCRIPTION_DELETE_THREW_REASON : deleteResult?.outcome === "skipped" ? deleteResult.reason : void 0;
+		if (notDeletedReason !== void 0) {
+			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${notDeletedReason}`);
+			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Usually the Unsubscribe itself failed (a throttle, a denied sns:Unsubscribe) and the state record is FINE — clear that cause and re-run, or remove the old subscription in AWS by hand. Repair the state record only when the warning says the recorded physical id is malformed, which is the latent skip arm rather than this one.`, resourceType, logicalId, physicalId));
 		}
 		const createResult = await this.create(logicalId, resourceType, properties);
 		return {
@@ -30751,13 +30771,19 @@ var CloudFrontDistributionProvider = class {
 	/**
 	* Create a CloudFront Distribution
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CloudFront Distribution ${logicalId}`);
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const callerReferenceToken = acquireIdempotencyToken({
+			scope: "CreateDistribution",
+			logicalId,
+			maxLength: 128
+		});
 		try {
 			const distributionConfig = properties["DistributionConfig"] ?? {};
 			const sdkConfig = this.convertToSdkFormat({
 				...distributionConfig,
-				CallerReference: `${Date.now()}-${logicalId}-${Math.random().toString(36).slice(2, 8)}`
+				CallerReference: callerReferenceToken.value
 			});
 			const sdkTags = this.toSdkTags(properties["Tags"]);
 			const distribution = (sdkTags ? await this.cloudFrontClient.send(new CreateDistributionWithTagsCommand({ DistributionConfigWithTags: {
@@ -30768,6 +30794,7 @@ var CloudFrontDistributionProvider = class {
 			const domainName = distribution.DomainName;
 			this.logger.debug(`Created CloudFront Distribution: ${distributionId} (${domainName})`);
 			await this.settleDistribution(logicalId, distributionId);
+			callerReferenceToken.release();
 			return {
 				physicalId: distributionId,
 				attributes: {
@@ -30777,11 +30804,51 @@ var CloudFrontDistributionProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof DistributionAlreadyExists || error?.name === "DistributionAlreadyExists") {
+				const cause = error instanceof Error ? error : void 0;
+				throw markNonRetryable(new ProvisioningError(maskSecrets(`Failed to create CloudFront Distribution ${logicalId}: CloudFront refused the create because this deploy's CallerReference had been used before, which means an EARLIER attempt of this same create succeeded and cdkd never received its response. That distribution is LIVE, is not in cdkd state, and 'cdkd destroy' will not remove it — it bills until you delete it by hand. CloudFront does not return CallerReference from ListDistributions, so find it with 'aws cloudfront list-distributions' and match on ${this.orphanSearchHint(properties, maskSecrets)}; then disable and delete it (or import it with 'cdkd import') before re-running. The AWS error is on this error's cause.`), resourceType, logicalId, void 0, cause));
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
+	* The identifying fields of the distribution that WOULD have been created,
+	* for the `DistributionAlreadyExists` orphan message (issue #2079).
+	*
+	* Only fields `ListDistributions` actually returns are worth naming — the
+	* user has to match the orphan in that output by eye. `Origins[].DomainName`
+	* and `Comment` are both on `DistributionSummary`; `CallerReference` is not,
+	* which is the whole reason this message exists.
+	*
+	* Read from the RAW template properties rather than the converted SDK config
+	* so the helper stays usable from the catch, which is outside the scope
+	* where `sdkConfig` exists. Both the bare-array (CFn) and `{ Quantity,
+	* Items }` (SDK) spellings of `Origins` are accepted because a template may
+	* carry either.
+	*
+	* **Every value it returns is a RESOLVED template value, so each is masked
+	* HERE, at the leaf** (issue #1932 item 3, the shape
+	* `apigatewayv2-provider.ts`'s `toSdkResponseParameters` established). Two
+	* reasons the caller's outer mask cannot stand alone, both from
+	* `.claude/rules/providers.md`: `maskSecretsInText`'s SUBSTRING arm ignores a
+	* needle shorter than `MIN_NEEDLE_LENGTH` (4), and `JSON.stringify` escapes
+	* quotes — so a Secrets Manager JSON document no longer OCCURS literally in
+	* the finished sentence. Masking the raw string first reaches the
+	* WHOLE-VALUE arm at any length, and the mask is idempotent, so both layers
+	* are free.
+	*/
+	orphanSearchHint(properties, maskSecrets) {
+		const config = properties["DistributionConfig"] ?? {};
+		const origins = config["Origins"];
+		const domains = (Array.isArray(origins) ? origins : Array.isArray(origins?.Items) ? origins.Items ?? [] : []).map((origin) => origin?.DomainName).filter((domain) => typeof domain === "string" && domain !== "").map((domain) => maskSecrets(domain));
+		const comment = typeof config["Comment"] === "string" ? maskSecrets(config["Comment"]) : "";
+		const parts = [];
+		if (domains.length > 0) parts.push(`origin domain ${domains.join(" / ")}`);
+		if (comment !== "") parts.push(`comment ${JSON.stringify(comment)}`);
+		return parts.length > 0 ? parts.join(" and ") : "its creation time (the orphan is the newest distribution in this account)";
+	}
+	/**
 	* Update a CloudFront Distribution
 	*
 	* `UpdateDistribution` is a read-modify-write API that expects the COMPLETE
@@ -30938,11 +31005,14 @@ var CloudFrontDistributionProvider = class {
 	* false positive every run (mirrors the Lambda `Code.S3*` precedent).
 	*
 	* - `DistributionConfig.CallerReference`: a create-time idempotency
-	*   token. cdkd generates it internally (`<ts>-<logicalId>-<rand>`);
-	*   AWS echoes it back, but it is never templated by CDK, so comparing
-	*   it would diff cdkd's generated value on every run. `convertToCfnFormat`
-	*   already drops it from the AWS side; declaring it here also excludes
-	*   it from the observed-baseline side.
+	*   token. cdkd generates it internally (`acquireIdempotencyToken`, issue
+	*   #2079 — a per-process digest, `cdkd-<sha256 prefix>`); AWS echoes it
+	*   back, but it is never templated by CDK, so comparing it would diff
+	*   cdkd's generated value on every run. It is not even stable across
+	*   cdkd RUNS by design (a process nonce is mixed in), so suppression is
+	*   required rather than merely convenient. `convertToCfnFormat` already
+	*   drops it from the AWS side; declaring it here also excludes it from
+	*   the observed-baseline side.
 	* - `DistributionConfig.Logging.Bucket`: CloudFront normalizes the S3
 	*   logging bucket to its `<bucket>.s3.amazonaws.com` regional domain on
 	*   read, which never matches the bare bucket domain a template may
@@ -70553,7 +70623,8 @@ async function rollbackCommand(stackArg, options) {
 				logger: logger.child("rollback"),
 				recordEvent: (e) => eventRecorder.record(e),
 				finalSnapshotClients,
-				skipFinalSnapshot: options.skipFinalSnapshot === true
+				skipFinalSnapshot: options.skipFinalSnapshot === true,
+				importedProducerRegions: producerRegionsFromState(baseState)
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
@@ -83843,7 +83914,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.22");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.24");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;