@go-to-k/cdkd 0.284.23 → 0.284.25

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as disableInstanceApiTermination, $n as NestedStackChildDirectDestroyError, $t as ensureAssetStorage, A as isStatefulRecreateTargetSync, An as uploadCfnTemplate, At as s3BucketWebsiteUrl, B as collectPublishedOutputNames, Bn as getAwsClients, Bt as rebuildClientForBucketRegion, C as createPreDeleteFinalSnapshot, Cn as resolveUseCdkBootstrapAssets, Ct as maskSecretsInText, D as makeCanonicalizePropertiesFn, Dn as CFN_TEMPLATE_URL_LIMIT, Dt as s3BucketDomainName, E as unsupportedFinalSnapshotError, En as CFN_TEMPLATE_BODY_LIMIT, Et as s3BucketArn, F as gray, Fn as AssemblyReader, Ft as withRetry, G as IAMRoleProvider, Gt as buildAssetRedirectMap, H as isExportAliasCollision, Hn as setAwsClients, Ht as AssetPublisher, I as green, In as processStackMessages, It as DagBuilder, J as ProviderRegistry, Jn as LocalInvokeBuildError$1, Jt as rewriteTemplateAssetReferences, K as collectInlinePolicyNamesManagedBySiblings, Kt as createAssetRedirectResolver, L as red, Lt as TemplateParser, M as formatResourceLine, Mn as PARTITION_TABLE, Mt as DiffCalculator, N as bold, Nn as canonicalizeRegion, Nt as INTRINSIC_KEYS, O as extractDeploymentEventError, On as MIGRATE_TMP_PREFIX, Ot as s3BucketDualStackDomainName, P as cyan, Pn as derivePartitionAndUrlSuffix, Pt as describeTypeWithThrottleRetry, Q as slowCcOperationTimeoutMs, Qn as MissingCdkCliError, Qt as BOOTSTRAP_MARKER_PREFIX, R as yellow, Rn as resolveBucketRegion, Rt as LockManager, S as ccRoutedFinalSnapshotError, Sn as resolveStateBucketWithDefaultAndSource, St as isSingleDynamicReferenceToken, T as refusesFinalSnapshot, Tn as warnDeprecatedNoPrefixCliFlag, Tt as scrubResourceRecord, U as secretBearingStateKeyWarning, Ut as stringifyValue, V as exportAliasCollisionScrubWarning, Vn as resetAwsClients, Vt as shouldRetainResource, W as stateKeySecretExposure, Wn as CdkdError, Wt as WorkGraph, X as findSilentDropProperties, Xn as LocalStartServiceError, Xt as stripControlChars, Y as findActionableSilentDrops, Yn as LocalMigrateError, Yt as escapeRegExp, Z as CloudControlProvider, Zt as AssetModeResolver, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as resolveApp, _t as STATE_SOURCED_CROSS_GENERATION_RULES, a as DeploymentEventsStore, an as buildDenyExternalAccessPolicy, ar as StackTerminationProtectionError, at as WAFv2WebACLProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bn as resolveSkipPrefix, bt as createSecretMasker, c as producerRegionsFromState, cn as getDockerCmd, ct as assertRegionMatch, d as updatePartialMessage, dn as AssetManifestLoader, dr as withErrorHandling, dt as configStringRefusal, en as getBootstrapMarkerKey, er as PartialFailureError, et as isTerminationProtectionPropagationError, f as updatePartialReason, fn as getDockerImageBySourceHash, fr as isMarkedNonRetryable, ft as readConfigString, g as maskingRetryLogger, gn as getLegacyStateBucketName, gt as requireConfigString, h as withResourceDeadline, hn as getDefaultStateBucketName, hr as markNonRetryable, ht as requireConfigObject, i as DeploymentEventsReader, in as validateContainerRepoName, ir as StackHasActiveImportsError, it as refStateLookupFromResource, j as renderStatefulReason, jn as expectedOwnerParam, jt as applyRoleArnIfSet, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as findLargeInlineResources, kt as s3BucketRegionalDomainName, l as replayFailedOperations, ln as runDockerForeground, lt as coerceCfnBoolean, m as deleteSkipReason, mn as synthesisStatusMessage, mr as isThrottlingError, mt as requireConfigArray, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as readBootstrapMarkerBody, nr as ResourceTimeoutError, nt as cfnRefValueFromPhysicalId, o as planFailedOps, on as buildDockerImage, ot as normalizeAwsTagsToCfn, p as UNSPECIFIED_SKIP_REASON, pn as Synthesizer, pr as isRetryableTransientError, pt as replayWarn, q as clearOnUpdateRemoval, qn as DeployCancelledError, qt as loadPublishableAssetManifest, r as DeployEngine, rn as validateAssetBucketName, rr as ResourceUpdateNotSupportedError, rt as getAccountInfo, s as planRollback, sn as formatDockerLoginError, st as resolveExplicitPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as parseBootstrapMarker, tr as ProvisioningError, tt as IntrinsicFunctionResolver, u as replayRollback, un as runDockerStreaming, ur as normalizeAwsError, ut as configBooleanRefusal, v as computeImplicitDeleteEdges, vn as resolveAutoAssetStorage, vt as STATE_SOURCED_READBACK_RULES, w as isFinalSnapshotError, wn as stateBucketExistenceConfirmed, wt as redactSecretsForState, x as buildFinalSnapshotIdentifier, xn as resolveStateBucketWithDefault, xt as dynamicReferenceTokens, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as resolveCaptureObservedState, yt as TEMPLATE_SOURCED_RULES, z as collectDeclaredOutputNames, zn as AwsClients, zt as S3StateBackend } from "./deploy-engine-HfFU96oJ.js";
+import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-BpZWPiaL.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Cucl2K22.js";
+import { t as ASGProvider } from "./asg-provider-B2lPfJBN.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17,7 +17,7 @@ import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, Cre
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, DistributionAlreadyExists, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
@@ -1774,6 +1774,7 @@ function createListCommand() {
 * handler of its own).
 */
 function forwardSigtermToSigint() {
+	beginCommandInterruptScope();
 	const handler = () => {
 		if (process.listenerCount("SIGINT") === 0) process.exit(143);
 		process.emit("SIGINT", "SIGINT");
@@ -1781,6 +1782,7 @@ function forwardSigtermToSigint() {
 	process.on("SIGTERM", handler);
 	return () => {
 		process.removeListener("SIGTERM", handler);
+		endCommandInterruptScope();
 	};
 }
 
@@ -10863,6 +10865,23 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
+* The "old subscription was not deleted" reason the THROWN-delete arm of
+* `update()` reports (issue
+* [#1967](https://github.com/go-to-k/cdkd/issues/1967)).
+*
+* A constant, and FIXED WORDING with no interpolation, for the reason the
+* abort block spells out at length: this string is rendered onto the warn line
+* beside a message that must stay clear of the substrings
+* `retryable-errors.ts` classifies on, and the underlying AWS error text — an
+* `Unsubscribe` throttle, a `does not exist` — is user-uncontrolled and
+* carries several of them. The AWS message goes out on its own warn line in
+* the `catch`, where nothing classifies it.
+*
+* Its skip-arm twin is the provider-supplied `ResourceDeleteResult.reason`,
+* which is subject to the same rule at its own producer.
+*/
+const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
+/**
 * AWS SNS Subscription Provider
 *
 * Implements resource provisioning for AWS::SNS::Subscription using the SNS SDK.
@@ -10941,14 +10960,17 @@ var SNSSubscriptionProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
 		let deleteResult = void 0;
+		let deleteThrew = false;
 		try {
 			deleteResult = await this.delete(logicalId, physicalId, resourceType);
 		} catch (error) {
+			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${String(error)}`);
 		}
-		if (deleteResult?.outcome === "skipped") {
-			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${deleteResult.reason}`);
-			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Repair the state record for ${logicalId}, or remove the old subscription in AWS if it is still live, then re-run.`, resourceType, logicalId, physicalId));
+		const notDeletedReason = deleteThrew ? SNS_SUBSCRIPTION_DELETE_THREW_REASON : deleteResult?.outcome === "skipped" ? deleteResult.reason : void 0;
+		if (notDeletedReason !== void 0) {
+			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${notDeletedReason}`);
+			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Usually the Unsubscribe itself failed (a throttle, a denied sns:Unsubscribe) and the state record is FINE — clear that cause and re-run, or remove the old subscription in AWS by hand. Repair the state record only when the warning says the recorded physical id is malformed, which is the latent skip arm rather than this one.`, resourceType, logicalId, physicalId));
 		}
 		const createResult = await this.create(logicalId, resourceType, properties);
 		return {
@@ -14819,28 +14841,37 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
 	const budgetWait = opts.budgetWait;
+	const watch = startInterruptWatch(`index settle wait on ${tableName}`);
 	let attempt = 0;
-	while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
-		attempt += 1;
-		try {
-			if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isThrottlingError(err)) {
-				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-				await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-				continue;
+	try {
+		while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+			attempt += 1;
+			if (watch.isInterrupted()) {
+				logger.debug(`Interrupted while waiting for indexes on ${tableName} (${logicalId}) after ${attempt - 1} DescribeTable polls; ${proceedNote}`);
+				return;
 			}
-			if (err instanceof ResourceNotFoundException$1) {
-				logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+			try {
+				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				if (isThrottlingError(err)) {
+					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+					continue;
+				}
+				if (err instanceof ResourceNotFoundException$1) {
+					logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+					return;
+				}
+				const errorName = err instanceof Error ? err.name : typeof err;
+				logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
+				logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
 				return;
 			}
-			const errorName = err instanceof Error ? err.name : typeof err;
-			logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
-			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
-			return;
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
-		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+	} finally {
+		watch.dispose();
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
 	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
@@ -14945,24 +14976,31 @@ function indexBusyRetryWarning(opts) {
 */
 async function deleteTableWithIndexBusyRetry(opts) {
 	let deleteAttempts = 0;
-	await withRetry(async () => {
-		if (deleteAttempts++ > 0) {
-			if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
-				typeLabel: opts.typeLabel,
-				logicalId: opts.logicalId,
-				physicalId: opts.physicalId,
-				attemptNumber: deleteAttempts,
-				maxRetries: opts.maxRetries
-			}));
-			await opts.reArm();
-		}
-		await opts.deleteTable();
-	}, opts.logicalId, {
-		maxRetries: opts.maxRetries,
-		isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
-		logger: opts.logger,
-		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
-	});
+	const watch = startInterruptWatch(`DynamoDB ${opts.typeLabel} ${opts.logicalId} delete`);
+	try {
+		await withRetry(async () => {
+			if (deleteAttempts++ > 0) {
+				if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+					typeLabel: opts.typeLabel,
+					logicalId: opts.logicalId,
+					physicalId: opts.physicalId,
+					attemptNumber: deleteAttempts,
+					maxRetries: opts.maxRetries
+				}));
+				await opts.reArm();
+			}
+			await opts.deleteTable();
+		}, opts.logicalId, {
+			maxRetries: opts.maxRetries,
+			isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
+			logger: opts.logger,
+			isInterrupted: watch.isInterrupted,
+			onInterrupted: watch.onInterrupted,
+			sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+		});
+	} finally {
+		watch.dispose();
+	}
 }
 
 //#endregion
@@ -18638,94 +18676,111 @@ var DynamoDBGlobalTableProvider = class {
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
 		if (!oldEnabled && !newEnabled) return;
-		if (newEnabled) {
-			const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
-			const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
-			if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-				warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
+		try {
+			if (newEnabled) {
+				const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
+				const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
+				if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
+					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+					return;
+				}
+				try {
+					await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						MinCapacity: minCapacity,
+						MaxCapacity: maxCapacity
+					})), `${resourceId} (${dimension})`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
+					return;
+				}
+				const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
+				const targetValue = Number(tttCfg["TargetValue"]);
+				if (!Number.isFinite(targetValue)) {
+					warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
+					return;
+				}
+				const targetTrackingConfig = {
+					PredefinedMetricSpecification: { PredefinedMetricType: metricType },
+					TargetValue: targetValue
+				};
+				if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
+				if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
+				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
+				try {
+					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
+						PolicyName: policyName,
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						PolicyType: "TargetTrackingScaling",
+						TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
+					})), `${policyName}`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+					this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				}
 				return;
 			}
+			const isObjectNotFound = (err) => {
+				if (!(err instanceof Error)) return false;
+				const name = err.name ?? "";
+				const msg = err.message ?? "";
+				return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
+			};
 			try {
-				await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+				await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
+					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					MinCapacity: minCapacity,
-					MaxCapacity: maxCapacity
+					ScalableDimension: dimension
 				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 			} catch (err) {
-				warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
-				return;
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
-			const targetValue = Number(tttCfg["TargetValue"]);
-			if (!Number.isFinite(targetValue)) {
-				warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
-				return;
-			}
-			const targetTrackingConfig = {
-				PredefinedMetricSpecification: { PredefinedMetricType: metricType },
-				TargetValue: targetValue
-			};
-			if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
-			if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
-			if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 			try {
-				await withRetry(() => asClient.send(new PutScalingPolicyCommand({
-					PolicyName: policyName,
+				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					PolicyType: "TargetTrackingScaling",
-					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
-				})), `${policyName}`, {
+					ScalableDimension: dimension
+				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
-				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 			} catch (err) {
-				warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			return;
-		}
-		const isObjectNotFound = (err) => {
-			if (!(err instanceof Error)) return false;
-			const name = err.name ?? "";
-			const msg = err.message ?? "";
-			return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
-		};
-		try {
-			await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
-				PolicyName: policyName,
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
-		}
-		try {
-			await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-			this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+		} finally {
+			watch.dispose();
 		}
 	}
 	/**
@@ -18923,6 +18978,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		} catch (describeErr) {
 			if (describeErr instanceof ProvisioningError) throw describeErr;
+			if (isInterruptedWaitError(describeErr)) throw describeErr;
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
 				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeErr instanceof Error ? describeErr.message : String(describeErr)}`, resourceType, logicalId, physicalId, cause);
@@ -19634,12 +19690,20 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB replica ${region} teardown on ${tableName}`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				try {
+					if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		throw new ProvisioningError(`Replica ${region} for table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
@@ -19659,12 +19723,23 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB table ${tableName} deletion wait`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) {
+					this.logger.warn(`DynamoDB GlobalTable ${logicalId}: interrupted while waiting for ${tableName} to disappear. AWS ACCEPTED the DeleteTable and will finish it; cdkd stopped watching.`);
+					return;
+				}
+				try {
+					await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		if (wait.cutShort) {
 			this.logger.warn(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${tableName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`);
@@ -30751,13 +30826,19 @@ var CloudFrontDistributionProvider = class {
 	/**
 	* Create a CloudFront Distribution
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CloudFront Distribution ${logicalId}`);
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const callerReferenceToken = acquireIdempotencyToken({
+			scope: "CreateDistribution",
+			logicalId,
+			maxLength: 128
+		});
 		try {
 			const distributionConfig = properties["DistributionConfig"] ?? {};
 			const sdkConfig = this.convertToSdkFormat({
 				...distributionConfig,
-				CallerReference: `${Date.now()}-${logicalId}-${Math.random().toString(36).slice(2, 8)}`
+				CallerReference: callerReferenceToken.value
 			});
 			const sdkTags = this.toSdkTags(properties["Tags"]);
 			const distribution = (sdkTags ? await this.cloudFrontClient.send(new CreateDistributionWithTagsCommand({ DistributionConfigWithTags: {
@@ -30768,6 +30849,7 @@ var CloudFrontDistributionProvider = class {
 			const domainName = distribution.DomainName;
 			this.logger.debug(`Created CloudFront Distribution: ${distributionId} (${domainName})`);
 			await this.settleDistribution(logicalId, distributionId);
+			callerReferenceToken.release();
 			return {
 				physicalId: distributionId,
 				attributes: {
@@ -30777,11 +30859,51 @@ var CloudFrontDistributionProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof DistributionAlreadyExists || error?.name === "DistributionAlreadyExists") {
+				const cause = error instanceof Error ? error : void 0;
+				throw markNonRetryable(new ProvisioningError(maskSecrets(`Failed to create CloudFront Distribution ${logicalId}: CloudFront refused the create because this deploy's CallerReference had been used before, which means an EARLIER attempt of this same create succeeded and cdkd never received its response. That distribution is LIVE, is not in cdkd state, and 'cdkd destroy' will not remove it — it bills until you delete it by hand. CloudFront does not return CallerReference from ListDistributions, so find it with 'aws cloudfront list-distributions' and match on ${this.orphanSearchHint(properties, maskSecrets)}; then disable and delete it (or import it with 'cdkd import') before re-running. The AWS error is on this error's cause.`), resourceType, logicalId, void 0, cause));
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
+	* The identifying fields of the distribution that WOULD have been created,
+	* for the `DistributionAlreadyExists` orphan message (issue #2079).
+	*
+	* Only fields `ListDistributions` actually returns are worth naming — the
+	* user has to match the orphan in that output by eye. `Origins[].DomainName`
+	* and `Comment` are both on `DistributionSummary`; `CallerReference` is not,
+	* which is the whole reason this message exists.
+	*
+	* Read from the RAW template properties rather than the converted SDK config
+	* so the helper stays usable from the catch, which is outside the scope
+	* where `sdkConfig` exists. Both the bare-array (CFn) and `{ Quantity,
+	* Items }` (SDK) spellings of `Origins` are accepted because a template may
+	* carry either.
+	*
+	* **Every value it returns is a RESOLVED template value, so each is masked
+	* HERE, at the leaf** (issue #1932 item 3, the shape
+	* `apigatewayv2-provider.ts`'s `toSdkResponseParameters` established). Two
+	* reasons the caller's outer mask cannot stand alone, both from
+	* `.claude/rules/providers.md`: `maskSecretsInText`'s SUBSTRING arm ignores a
+	* needle shorter than `MIN_NEEDLE_LENGTH` (4), and `JSON.stringify` escapes
+	* quotes — so a Secrets Manager JSON document no longer OCCURS literally in
+	* the finished sentence. Masking the raw string first reaches the
+	* WHOLE-VALUE arm at any length, and the mask is idempotent, so both layers
+	* are free.
+	*/
+	orphanSearchHint(properties, maskSecrets) {
+		const config = properties["DistributionConfig"] ?? {};
+		const origins = config["Origins"];
+		const domains = (Array.isArray(origins) ? origins : Array.isArray(origins?.Items) ? origins.Items ?? [] : []).map((origin) => origin?.DomainName).filter((domain) => typeof domain === "string" && domain !== "").map((domain) => maskSecrets(domain));
+		const comment = typeof config["Comment"] === "string" ? maskSecrets(config["Comment"]) : "";
+		const parts = [];
+		if (domains.length > 0) parts.push(`origin domain ${domains.join(" / ")}`);
+		if (comment !== "") parts.push(`comment ${JSON.stringify(comment)}`);
+		return parts.length > 0 ? parts.join(" and ") : "its creation time (the orphan is the newest distribution in this account)";
+	}
+	/**
 	* Update a CloudFront Distribution
 	*
 	* `UpdateDistribution` is a read-modify-write API that expects the COMPLETE
@@ -30938,11 +31060,14 @@ var CloudFrontDistributionProvider = class {
 	* false positive every run (mirrors the Lambda `Code.S3*` precedent).
 	*
 	* - `DistributionConfig.CallerReference`: a create-time idempotency
-	*   token. cdkd generates it internally (`<ts>-<logicalId>-<rand>`);
-	*   AWS echoes it back, but it is never templated by CDK, so comparing
-	*   it would diff cdkd's generated value on every run. `convertToCfnFormat`
-	*   already drops it from the AWS side; declaring it here also excludes
-	*   it from the observed-baseline side.
+	*   token. cdkd generates it internally (`acquireIdempotencyToken`, issue
+	*   #2079 — a per-process digest, `cdkd-<sha256 prefix>`); AWS echoes it
+	*   back, but it is never templated by CDK, so comparing it would diff
+	*   cdkd's generated value on every run. It is not even stable across
+	*   cdkd RUNS by design (a process nonce is mixed in), so suppression is
+	*   required rather than merely convenient. `convertToCfnFormat` already
+	*   drops it from the AWS side; declaring it here also excludes it from
+	*   the observed-baseline side.
 	* - `DistributionConfig.Logging.Bucket`: CloudFront normalizes the S3
 	*   logging bucket to its `<bucket>.s3.amazonaws.com` regional domain on
 	*   read, which never matches the bare bucket domain a template may
@@ -35329,13 +35454,23 @@ var ELBv2Provider = class {
 			try {
 				const listenerAttributes = this.normalizeAttributes(properties["ListenerAttributes"]);
 				if (listenerAttributes.length > 0) {
-					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-						ListenerArn: listenerArn,
-						Attributes: listenerAttributes
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+					try {
+						await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+							ListenerArn: listenerArn,
+							Attributes: listenerAttributes
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and neither rollback nor destroy could reach it. If that delete does not complete, remove it manually: aws elbv2 delete-listener --listener-arn ${listenerArn}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
@@ -35372,10 +35507,19 @@ var ELBv2Provider = class {
 			}));
 			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
-				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-					ListenerArn: physicalId,
-					Attributes: submittedAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+				const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+				try {
+					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+						ListenerArn: physicalId,
+						Attributes: submittedAttrs
+					})), logicalId, {
+						logger: this.maskedRetryLogger(maskSecrets),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
 				this.logger.debug(`Applied ${submittedAttrs.length} ListenerAttributes change(s) for ${logicalId}`);
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -42469,16 +42613,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
-			await withRetry(async () => {
-				const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			}, logicalId, {
-				maxRetries: 24,
-				initialDelayMs: 3e3,
-				maxDelayMs: 15e3,
-				isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
-				logger: this.logger
-			});
+			const watch = startInterruptWatch(`Cloud Map namespace ${logicalId}`);
+			try {
+				await withRetry(async () => {
+					const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
+					if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				}, logicalId, {
+					maxRetries: 24,
+					initialDelayMs: 3e3,
+					maxDelayMs: 15e3,
+					isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
+					logger: this.logger,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted
+				});
+			} finally {
+				watch.dispose();
+			}
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
@@ -42678,13 +42829,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 				if (Object.keys(attrs).length > 0) {
-					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-						ServiceId: serviceId,
-						Attributes: attrs
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+					try {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: serviceId,
+							Attributes: attrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete does not complete, remove it manually: aws servicediscovery delete-service --id ${serviceId}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
@@ -42754,19 +42915,34 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}))).OperationId;
 				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
-			if (hasAttrUpsert) {
-				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: upsertAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
-			}
-			if (hasAttrRemove) {
-				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: removedAttrKeys
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+			if (hasAttrUpsert || hasAttrRemove) {
+				const attrWatch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+				try {
+					if (hasAttrUpsert) {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: upsertAttrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
+					}
+					if (hasAttrRemove) {
+						await withRetry(() => client.send(new DeleteServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: removedAttrKeys
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+					}
+				} finally {
+					attrWatch.dispose();
+				}
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
 			return {
@@ -58128,7 +58304,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (!isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
+					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -58212,11 +58388,19 @@ async function runDestroyForStack(stackName, state, ctx) {
 			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, ${orphanHint} is the last resort: it removes the state record without deleting AWS resources.` + skippedClause);
 		}
 	} finally {
-		process.removeListener("SIGINT", sigintHandler);
-		renderer.stop();
-		await saveChain;
-		logger.debug("Releasing lock...");
-		await ctx.lockManager.releaseLock(stackName, regionForState);
+		try {
+			try {
+				renderer.stop();
+			} catch (rendererError) {
+				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${rendererError instanceof Error ? rendererError.message : String(rendererError)}`);
+			}
+			await saveChain;
+			logger.debug("Releasing lock...");
+			await ctx.lockManager.releaseLock(stackName, regionForState);
+		} finally {
+			process.removeListener("SIGINT", sigintHandler);
+		}
+		result.interrupted ||= draining;
 		if (destroyAwsClients) {
 			destroyAwsClients.destroy();
 			process.env["AWS_REGION"] = ctx.baseRegion;
@@ -83844,7 +84028,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.23");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.25");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;