@go-to-k/cdkd 0.284.39 → 0.284.40

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-rKBFVifY.js";
+import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-B3MQFW1K.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Db6lnsaA.js";
+import { t as ASGProvider } from "./asg-provider-BeKDzUe9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -23919,9 +23919,10 @@ const generations = /* @__PURE__ */ new Map();
 * long-lived process cannot grow the map without bound.
 */
 const MAX_TRACKED_GENERATIONS = 1e5;
-const tokenKey = (scope, logicalId) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}`;
-const derive = (key, generation, maxLength) => {
-	return `cdkd-${createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex")}`.slice(0, maxLength);
+const tokenKey = (scope, logicalId, maxLength, charset) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}\u0000${maxLength}\u0000${charset}`;
+const derive = (key, generation, maxLength, charset) => {
+	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
+	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
 };
 /**
 * Get the idempotency token for one logical create, minting it on first use and
@@ -23935,10 +23936,10 @@ const derive = (key, generation, maxLength) => {
 * ```
 */
 function acquireIdempotencyToken(options) {
-	const { scope, logicalId, maxLength = 64 } = options;
-	const key = tokenKey(scope, logicalId);
+	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
+	const key = tokenKey(scope, logicalId, maxLength, charset);
 	const existing = inFlight.get(key);
-	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength);
+	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
 	if (existing === void 0) inFlight.set(key, value);
 	return {
 		value,
@@ -59380,6 +59381,19 @@ function isCertificateInUseError(error) {
 * consumers (CloudFront, ALB) will fail to start if they reach the cert
 * before it issues, but that's the documented trade-off.
 *
+* **A create that fails after requesting DELETES its certificate** (issue
+* [#2169](https://github.com/go-to-k/cdkd/issues/2169)). `RequestCertificate`
+* materializes the certificate immediately and everything after it can fail —
+* most commonly the ISSUED wait, which a DNS-validated certificate whose
+* validation records are not live yet exhausts by construction. Before this,
+* the ARN was thrown away with the error: the certificate existed in AWS with
+* nothing naming it (absent from state, so invisible to `cdkd state show` and
+* unreachable by `cdkd destroy`), and the next `cdkd deploy` requested another
+* one — an orphan per attempt. `create()` now retires the certificate it just
+* requested before re-throwing, so a failed deploy leaves nothing behind and a
+* retry starts clean. See {@link ACMCertificateProvider.cleanupRequestedCertificate}
+* for why deleting is safe and why it is preferred over recording the remnant.
+*
 * **CloudFront cross-region note**: ACM certificates referenced by a
 * CloudFront Distribution MUST live in `us-east-1`. cdkd does not enforce
 * this — it's the developer's responsibility to deploy the certificate
@@ -59429,12 +59443,22 @@ var ACMCertificateProvider = class {
 		if (Object.keys(options).length > 0) input["Options"] = options;
 		const tags = properties["Tags"];
 		if (tags && Array.isArray(tags) && tags.length > 0) input["Tags"] = tags;
+		const idempotencyToken = acquireIdempotencyToken({
+			scope: "RequestCertificate",
+			logicalId,
+			maxLength: 32,
+			charset: "alphanumeric"
+		});
+		input["IdempotencyToken"] = idempotencyToken.value;
+		let requestedArn;
 		try {
 			const certificateArn = (await this.acmClient.send(new RequestCertificateCommand(input))).CertificateArn;
 			if (!certificateArn) throw new ProvisioningError(`RequestCertificate succeeded but no CertificateArn returned for ${logicalId}`, resourceType, logicalId);
+			requestedArn = certificateArn;
 			this.logger.debug(`Requested ACM certificate: ${certificateArn}`);
-			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId);
+			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType);
 			else this.logger.warn(`Skipping wait for ACM certificate ${logicalId} (CDKD_NO_WAIT=true). Downstream consumers (CloudFront / ALB) will fail until the cert reaches ISSUED.`);
+			idempotencyToken.release();
 			return {
 				physicalId: certificateArn,
 				attributes: {
@@ -59443,9 +59467,84 @@ var ACMCertificateProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof CdkdError) throw error;
+			const survivorNote = requestedArn ? await this.cleanupRequestedCertificate(requestedArn, logicalId, idempotencyToken) : void 0;
+			if (error instanceof CdkdError) {
+				if (survivorNote === void 0) throw error;
+				throw new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
+			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
+		}
+	}
+	/**
+	* Retire the certificate a FAILED `create()` just requested, so the failure
+	* leaves nothing behind (issue
+	* [#2169](https://github.com/go-to-k/cdkd/issues/2169)).
+	*
+	* Returns `undefined` when the certificate is gone, or a one-line note naming
+	* the survivor when it could not be deleted. Never throws: the original
+	* create error is what the user needs to see, and a cleanup failure must
+	* degrade that message rather than replace it.
+	*
+	* ## Why DELETING is right, when the obvious objection is that it throws away
+	* the user's DNS work
+	*
+	* It does not. ACM derives a domain's validation CNAME from the domain and
+	* the account, not from the certificate, and documents that the record "must
+	* be added to your DNS database only once": *"Without the need to repeat
+	* validation, you can request additional ACM certificates for your fully
+	* qualified domain name (FQDN) for as long as the CNAME record remains in
+	* place ... You can also replace a deleted certificate."*
+	* (https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)
+	* So the CNAMEs a user adds after seeing this failure validate the NEXT
+	* certificate too, and the retry issues normally. The intuition that a
+	* `PENDING_VALIDATION` certificate is precious does not hold for ACM.
+	*
+	* ## Why not RECORD the remnant in cdkd state instead
+	*
+	* That was this fix's first shape, and it does not work. A state record makes
+	* the next deploy diff the resource as `NO_CHANGE` -- the recorded properties
+	* ARE the template's -- so cdkd would never touch that certificate again:
+	* `cdkd deploy` would print "No changes detected" and exit 0 over a
+	* certificate that is still unusable, and the CloudFront / ALB consuming it
+	* would fail with no explanation. Turning a loud failure into a silent one is
+	* worse than the orphan it fixes. Making the diff re-provision it instead
+	* needs a marker on the state record -- a schema bump -- to buy behaviour
+	* that deleting gives for free.
+	*
+	* ## The "keep it" escape hatch already exists
+	*
+	* A user who WANTS the certificate to outlive the deploy has
+	* `CDKD_NO_WAIT=true` (`cdkd deploy --no-wait`), which returns success with
+	* the certificate recorded in state and never reaches this path. "Wait for
+	* it" and "keep it even if the wait fails" are different requests, and cdkd
+	* already has a flag for the second.
+	*/
+	/**
+	* The region an ACM ARN names, for the manual retire command. Taken from the
+	* ARN rather than from the client so the command a user pastes matches the
+	* certificate it names even when their shell default differs. Falls back to
+	* the literal placeholder for a shape this cannot parse -- a wrong region
+	* would make the command silently address a different account/region.
+	*/
+	regionOfArn(arn) {
+		return arn.split(":")[3] || "<region>";
+	}
+	async cleanupRequestedCertificate(certificateArn, logicalId, idempotencyToken) {
+		try {
+			await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: certificateArn }));
+			this.logger.info(`Deleted the ACM certificate ${certificateArn} that the failed create of ${logicalId} requested, so nothing is left behind. DNS validation records you have already added stay valid for the retry.`);
+			idempotencyToken.release();
+			return;
+		} catch (cleanupError) {
+			if (cleanupError instanceof ResourceNotFoundException$7 || cleanupError instanceof Error && cleanupError.name === "ResourceNotFoundException") {
+				this.logger.info(`The ACM certificate ${certificateArn} that the failed create of ${logicalId} requested was already gone; nothing to clean up.`);
+				idempotencyToken.release();
+				return;
+			}
+			const detail = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			this.logger.warn(`Could not delete the ACM certificate ${certificateArn} that the failed create of ${logicalId} requested: ${detail}`);
+			return `The certificate ${certificateArn} this attempt created could NOT be deleted, and cdkd is not tracking it -- retire it with \`aws acm delete-certificate --certificate-arn ${certificateArn} --region ${this.regionOfArn(certificateArn)}\` (the reason is in the warning above).`;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -59618,11 +59717,25 @@ var ACMCertificateProvider = class {
 	* Throws on `VALIDATION_TIMED_OUT` / `FAILED` (terminal failures) and on
 	* polling-cap exhaustion (treated as timeout). SIGINT short-circuits the
 	* loop and returns control to the deploy engine's cleanup path.
+	*
+	* Both throws are `ProvisioningError`s carrying `certificateArn` as their
+	* `physicalId` (issue
+	* [#2169](https://github.com/go-to-k/cdkd/issues/2169)). They used to be
+	* plain `Error`s whose only reference to the certificate was the message
+	* TEXT, which is not something a caller can act on. The certificate is real
+	* by the time either fires, so the error that reports the failure is the one
+	* piece of the failure path that should still be able to name it.
+	*
+	* Says nothing about what happens to the certificate afterwards: the caller
+	* owns that. `create()`'s catch retires it (see
+	* {@link ACMCertificateProvider.cleanupRequestedCertificate}) and appends a
+	* note to this message only when that cleanup could NOT.
 	*/
-	async waitForCertificateIssued(certificateArn, logicalId) {
+	async waitForCertificateIssued(certificateArn, logicalId, resourceType) {
 		this.logger.debug(`Waiting for ACM certificate ${certificateArn} to reach ISSUED status...`);
 		let interrupted = false;
-		let validationOptionsLogged = false;
+		/** The last validation-record block printed, so we re-print only on a CHANGE. */
+		let lastValidationOptions;
 		const sigintHandler = () => {
 			interrupted = true;
 		};
@@ -59640,17 +59753,20 @@ var ACMCertificateProvider = class {
 					this.logger.debug(`ACM certificate ${certificateArn} is ISSUED`);
 					return;
 				}
-				if (status === "FAILED" || status === "VALIDATION_TIMED_OUT" || status === "INACTIVE" || status === "REVOKED" || status === "EXPIRED") throw new Error(`ACM certificate ${logicalId} (${certificateArn}) entered terminal status ${status} during validation. Check ACM console / DNS records to diagnose.`);
-				if (status === "PENDING_VALIDATION" && !validationOptionsLogged && validations.length > 0) {
-					this.logValidationOptions(validations);
-					validationOptionsLogged = true;
+				if (status === "FAILED" || status === "VALIDATION_TIMED_OUT" || status === "INACTIVE" || status === "REVOKED" || status === "EXPIRED") throw new ProvisioningError(`ACM certificate ${logicalId} (${certificateArn}) entered terminal status ${status} during validation. Check ACM console / DNS records to diagnose.`, resourceType, logicalId, certificateArn);
+				if (status === "PENDING_VALIDATION") {
+					const rendered = this.renderValidationOptions(validations);
+					if (rendered !== void 0 && rendered !== lastValidationOptions) {
+						this.logger.info(rendered);
+						lastValidationOptions = rendered;
+					}
 				}
 				this.logger.debug(`ACM certificate ${certificateArn} status: ${status} (attempt ${attempt}/${this.maxPollAttempts})`);
 				const sleepEnd = Date.now() + this.pollIntervalMs;
 				const tickMs = Math.min(1e3, this.pollIntervalMs);
 				while (Date.now() < sleepEnd && !interrupted) await new Promise((resolve) => setTimeout(resolve, tickMs));
 			}
-			throw new Error(`ACM certificate ${logicalId} (${certificateArn}) did not reach ISSUED status within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. If your DNS zone is manually managed, you may need to increase --resource-timeout AWS::CertificateManager::Certificate=<duration> or set CDKD_NO_WAIT=true.`);
+			throw new ProvisioningError(`ACM certificate ${logicalId} (${certificateArn}) did not reach ISSUED status within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. ` + (lastValidationOptions === void 0 ? "AWS had not published this certificate's validation records before the wait ran out, so none were printed — re-run the deploy to request them again. " : `Add the validation records printed above to your DNS zone and re-run the deploy. `) + "ACM reuses a domain's validation CNAME across certificates, so records you add now validate the next attempt. To wait LONGER, raise CDKD_ACM_POLL_ATTEMPTS / CDKD_ACM_POLL_INTERVAL_MS — this cap is the provider's OWN and is what just fired; --resource-timeout alone will not lengthen it. Past ~30m also raise --resource-timeout AWS::CertificateManager::Certificate=<duration>, or the engine's per-resource deadline becomes the shorter of the two. Or set CDKD_NO_WAIT=true to keep the certificate and validate it out of band.", resourceType, logicalId, certificateArn);
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
 		}
@@ -59660,16 +59776,13 @@ var ACMCertificateProvider = class {
 	* user can copy / paste them into Route 53 / Cloudflare / etc. while the
 	* cert is still PENDING_VALIDATION.
 	*/
-	logValidationOptions(validations) {
+	renderValidationOptions(validations) {
 		const lines = ["ACM certificate is PENDING_VALIDATION. Add the following DNS records to validate:"];
 		for (const v of validations) if (v.ValidationMethod === "DNS" && v.ResourceRecord) {
 			const r = v.ResourceRecord;
 			lines.push(`  ${v.DomainName} — ${r.Type} ${r.Name} -> ${r.Value}`);
-		} else if (v.ValidationMethod === "EMAIL") {
-			const emails = (v.ValidationEmails ?? []).join(", ");
-			lines.push(`  ${v.DomainName} — confirmation email sent to: ${emails || "<none>"}`);
-		}
-		this.logger.info(lines.join("\n"));
+		} else if (v.ValidationMethod === "EMAIL" && (v.ValidationEmails ?? []).length > 0) lines.push(`  ${v.DomainName} — confirmation email sent to: ${v.ValidationEmails.join(", ")}`);
+		return lines.length === 1 ? void 0 : lines.join("\n");
 	}
 	async updateTags(certificateArn, newTags, oldTags) {
 		const newTagMap = new Map((newTags || []).map((t) => [t.Key, t.Value]));
@@ -86442,7 +86555,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.39");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.40");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;