@go-to-k/cdkd 0.284.39 → 0.284.41

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-rKBFVifY.js";
+import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-CCWl_tAH.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Db6lnsaA.js";
+import { t as ASGProvider } from "./asg-provider-D0lenV1M.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10324,6 +10324,121 @@ function isSqsQueueUrl(value) {
 	return value.startsWith("https://sqs.") && value.includes("/");
 }
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+/**
+* Depth cap for {@link maskDeep}.
+*
+* What it actually bounds is unbounded WORK on a pathologically deep bag — see
+* the rationale at the cap itself, which is the authority. It is NOT primarily
+* a cycle guard: a template-derived bag cannot be cyclic, so that justification
+* over-claims (issue #2176 security review). It does still terminate one, which
+* is why the walk is safe to share with a caller that might hand it something
+* other than a template bag.
+*
+* Deliberately generous. Every shape these warnings exist to describe is a
+* scalar, a list of scalars, or a small record, so the walk does not reach
+* depth 2 in practice.
+*/
+const MASK_WALK_MAX_DEPTH = 8;
+/**
+* What {@link maskDeep} substitutes for a subtree it declines to descend into.
+*
+* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
+* spelled here rather than imported so this module keeps its single-import leaf
+* property (see the module note above); the two are fenced against drift by a
+* test that imports both.
+*/
+const MASK_WALK_DEPTH_CAP_MARKER = "***";
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line or an error message (issue
+* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
+*
+* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
+* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
+*
+*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
+*     containing any of them no longer OCCURS in the stringified text and a
+*     mask applied afterwards cannot find it. That is not an exotic case — it
+*     is every Secrets Manager JSON document, the commonest real secret shape.
+*     Measured on the pre-fix tree for #2176: a plaintext of
+*     `{"user":"admin","pw":"hunter2"}` interpolated as
+*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
+*     unchanged, while masking the leaves first rendered it `"***"`.
+*  2. LENGTH. A finished message is always longer than the value inside it, so
+*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
+*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
+*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
+*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
+*
+* Neither pass subsumes the other, so providers do BOTH — this walk on the
+* value, and the assembled message through the masker as well. The masker is
+* idempotent, so the overlap is free.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
+* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
+* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
+* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
+* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
+* the point at which this should move into `../masked-retry-logger.ts` ... and
+* all three converge on it". That trigger had fired and been missed twice over,
+* and the copies had already diverged exactly as predicted: FOUR of the six
+* carried NO depth cap at all.
+*
+* Worth recording how the last two were nearly missed AGAIN, because it is the
+* same failure one level up: the first sweep for this issue grepped for
+* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
+* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
+* constant. Grep for the SHAPE, not the name. These copies encode a security
+* contract, and a hardening applied to one silently leaves the others behind.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= 8) return "***";
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+
 //#endregion
 //#region src/provisioning/providers/sns-topic-provider.ts
 /**
@@ -10979,12 +11094,7 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed, maskSe
 	const warn = (message) => {
 		getLogger().child("SNSTopicProvider").warn(maskSecrets(message));
 	};
-	const maskLeaf = (value) => {
-		if (typeof value === "string") return maskSecrets(value);
-		if (Array.isArray(value)) return value.map(maskLeaf);
-		if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
-		return value;
-	};
+	const maskLeaf = (value) => maskDeep(value, maskSecrets);
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(maskLeaf(logging))}`);
@@ -13955,10 +14065,11 @@ function idShape(segments) {
 * mis-names one value frequently mis-names its sibling too, and reporting them
 * one deploy at a time is the shape of remedy nobody finishes.
 */
-function compositeIdSeparatorRefusal(resourceType, logicalId, segments) {
+function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
 	const offending = segments.filter((segment) => String(segment.value).includes("|"));
 	if (offending.length === 0) return void 0;
-	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${String(segment.value)}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
+	const mask = maskerOrIdentity(maskSecrets);
+	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${mask(String(segment.value))}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
 }
 /**
 * Join the segments into a composite physicalId, REFUSING one that would be
@@ -13970,7 +14081,7 @@ function compositeIdSeparatorRefusal(resourceType, logicalId, segments) {
 *   behavior.
 */
 function packCompositeId(resourceType, logicalId, segments, options) {
-	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments);
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
 	if (refusal !== void 0) if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
 	else throw new ProvisioningError(refusal, resourceType, logicalId);
 	return segments.map((segment) => String(segment.value)).join("|");
@@ -14163,7 +14274,10 @@ var LambdaEventInvokeConfigProvider = class {
 			coerceNumber: true,
 			...replayWarn(this.logger, context)
 		});
-		const physicalId = this.buildPhysicalId(logicalId, functionName, qualifier, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		const physicalId = this.buildPhysicalId(logicalId, functionName, qualifier, {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
 			this.logger.debug(`Successfully created Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
@@ -16333,10 +16447,7 @@ const deleteTableRetryDelays$1 = {};
 * leaf is stringified — and escaped — identically.
 */
 function maskLeafValue$1(value, maskSecrets) {
-	if (typeof value === "string") return maskSecrets(value);
-	if (Array.isArray(value)) return value.map((v) => maskLeafValue$1(v, maskSecrets));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue$1(v, maskSecrets)]));
-	return value;
+	return maskDeep(value, maskSecrets);
 }
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
@@ -17245,7 +17356,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
-		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
+		if (coerced.dropped.length > 0) warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(maskLeafValue$1(coerced.spec, maskSecrets))}. Check for an unresolved intrinsic or a non-numeric value.`);
 		return coerced.spec;
 	}
 	/**
@@ -17895,18 +18006,17 @@ const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 * by value rather than by position, so the two layers compose.
 *
 * Walks rather than testing the top level, because a secret nested in an object
-* or array leaf is stringified — and escaped — identically. The sibling
-* `dynamodb-table-provider.ts` carries the same helper; it is duplicated rather
-* than shared because these two files deliberately hold no common module today
-* beyond the narrow rule modules (`dynamodb-warm-throughput.ts`,
-* `dynamodb-index-busy-delete.ts`), each of which exists for a MEASURED
-* divergence rather than for convenience.
+* or array leaf is stringified — and escaped — identically.
+*
+* Issue #2176 hoisted the walk into `../masked-retry-logger.js`. The previous
+* note here said the helper was "duplicated rather than shared because these two
+* files deliberately hold no common module today" — that rationale expired the
+* moment a shared LEAF module existed for exactly this, and it had already cost
+* something: this copy carried NO depth cap, so it was one of SIX copies that
+* had drifted apart on the one property that matters.
 */
 function maskLeafValue(value, maskSecrets) {
-	if (typeof value === "string") return maskSecrets(value);
-	if (Array.isArray(value)) return value.map((v) => maskLeafValue(v, maskSecrets));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeafValue(v, maskSecrets)]));
-	return value;
+	return maskDeep(value, maskSecrets);
 }
 var DynamoDBGlobalTableProvider = class {
 	dynamoDBClient;
@@ -22786,11 +22896,11 @@ var SSMParameterProvider = class {
 	* whole body is wrapped: an unexpected failure degrades to "no Arn recorded"
 	* exactly as the fabricated-account arm does.
 	*/
-	async buildParameterArn(name) {
+	async buildParameterArn(name, mask) {
 		try {
-			return await this.buildParameterArnUnguarded(name);
+			return await this.buildParameterArnUnguarded(name, mask);
 		} catch (error) {
-			this.logger.warn(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`);
+			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
 			return;
 		}
 	}
@@ -22810,10 +22920,10 @@ var SSMParameterProvider = class {
 	* import RECORDED it, so the fix belongs at the import boundary — where
 	* `import()` now refuses it — and not here. Do not re-add it.
 	*/
-	async buildParameterArnUnguarded(name) {
+	async buildParameterArnUnguarded(name, mask) {
 		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
 		if (accountInfo.fabricated) {
-			this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
 		}
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
@@ -22823,8 +22933,11 @@ var SSMParameterProvider = class {
 	/**
 	* Create an SSM parameter
 	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating SSM parameter ${logicalId}`);
+	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const warn = (message) => this.logger.warn(mask(message));
+		const debug = (message) => this.logger.debug(mask(message));
+		debug(`Creating SSM parameter ${logicalId}`);
 		const name = properties["Name"] || `/${generateResourceName(logicalId, {
 			maxLength: 1023,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
@@ -22855,14 +22968,14 @@ var SSMParameterProvider = class {
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					this.logger.debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
+					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
+					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
 				}
 				throw innerError;
 			}
-			this.logger.debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
-			const arn = await this.buildParameterArn(name);
+			debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			const arn = await this.buildParameterArn(name, mask);
 			return {
 				physicalId: name,
 				attributes: {
@@ -22873,14 +22986,16 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	/**
 	* Update an SSM parameter
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const debug = (message) => this.logger.debug(mask(message));
+		debug(`Updating SSM parameter ${logicalId}: ${physicalId}`);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${logicalId}`, resourceType, logicalId, physicalId);
@@ -22912,10 +23027,10 @@ var SSMParameterProvider = class {
 					ResourceId: physicalId,
 					Tags: newTags
 				}));
-				this.logger.debug(`Updated tags for SSM parameter ${physicalId}`);
+				debug(`Updated tags for SSM parameter ${physicalId}`);
 			}
-			this.logger.debug(`Successfully updated SSM parameter ${logicalId}`);
-			const arn = await this.buildParameterArn(physicalId);
+			debug(`Successfully updated SSM parameter ${logicalId}`);
+			const arn = await this.buildParameterArn(physicalId, mask);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -22927,7 +23042,7 @@ var SSMParameterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SSM parameter ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
@@ -23919,9 +24034,10 @@ const generations = /* @__PURE__ */ new Map();
 * long-lived process cannot grow the map without bound.
 */
 const MAX_TRACKED_GENERATIONS = 1e5;
-const tokenKey = (scope, logicalId) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}`;
-const derive = (key, generation, maxLength) => {
-	return `cdkd-${createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex")}`.slice(0, maxLength);
+const tokenKey = (scope, logicalId, maxLength, charset) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}\u0000${maxLength}\u0000${charset}`;
+const derive = (key, generation, maxLength, charset) => {
+	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
+	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
 };
 /**
 * Get the idempotency token for one logical create, minting it on first use and
@@ -23935,10 +24051,10 @@ const derive = (key, generation, maxLength) => {
 * ```
 */
 function acquireIdempotencyToken(options) {
-	const { scope, logicalId, maxLength = 64 } = options;
-	const key = tokenKey(scope, logicalId);
+	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
+	const key = tokenKey(scope, logicalId, maxLength, charset);
 	const existing = inFlight.get(key);
-	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength);
+	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
 	if (existing === void 0) inFlight.set(key, value);
 	return {
 		value,
@@ -24401,10 +24517,10 @@ var EC2Provider = class {
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
-			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0, context?.maskSecrets);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.createSubnetRouteTableAssociation(logicalId, resourceType, properties);
 			case "AWS::EC2::SecurityGroup": return this.createSecurityGroup(logicalId, resourceType, properties);
-			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0, context?.maskSecrets);
 			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NetworkAcl": return this.createNetworkAcl(logicalId, resourceType, properties);
 			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties, context);
@@ -24412,16 +24528,16 @@ var EC2Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -24430,10 +24546,10 @@ var EC2Provider = class {
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId);
 			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
-			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::NetworkAcl":
 			case "AWS::EC2::NetworkAclEntry":
@@ -24897,7 +25013,10 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 		return {
-			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, {
+				maskSecrets: context?.maskSecrets,
+				...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+			}),
 			attributes: {
 				AllocationId: allocationId,
 				PublicIp: publicIp
@@ -24979,7 +25098,10 @@ var EC2Provider = class {
 		}, {
 			name: "vpcId",
 			value: vpcId
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.ec2Client.send(new AttachInternetGatewayCommand({
 				VpcId: vpcId,
@@ -25132,7 +25254,7 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createRoute(logicalId, resourceType, properties, onMultipleDestinations) {
+	async createRoute(logicalId, resourceType, properties, onMultipleDestinations, maskSecrets) {
 		this.logger.debug(`Creating Route ${logicalId}`);
 		const routeTableId = properties["RouteTableId"];
 		const destinationCidrBlock = properties["DestinationCidrBlock"];
@@ -25156,7 +25278,10 @@ var EC2Provider = class {
 		}, {
 			name: "destination",
 			value: destination
-		}], onMultipleDestinations ? { onRefusal: onMultipleDestinations } : void 0);
+		}], {
+			maskSecrets,
+			...onMultipleDestinations && { onRefusal: onMultipleDestinations }
+		});
 		try {
 			await this.ec2Client.send(new CreateRouteCommand({
 				RouteTableId: routeTableId,
@@ -25184,7 +25309,7 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating Route ${logicalId}: ${physicalId}`);
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
 			physicalId,
@@ -25192,7 +25317,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteRoute(logicalId, physicalId, resourceType);
-			const createResult = await this.createRoute(logicalId, resourceType, properties, (message) => this.logger.warn(message));
+			const createResult = await this.createRoute(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets);
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -25475,7 +25600,7 @@ var EC2Provider = class {
 	*   and on a rollback replay the value comes from a STATE record, which no
 	*   template edit can fix. Absent (the plain CREATE dispatch) it throws.
 	*/
-	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol) {
+	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol, maskSecrets) {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
@@ -25500,7 +25625,10 @@ var EC2Provider = class {
 				name: "toPort",
 				value: toPort ?? "-1"
 			}
-		], onUnusableProtocol ? { onRefusal: onUnusableProtocol } : void 0);
+		], {
+			maskSecrets,
+			...onUnusableProtocol && { onRefusal: onUnusableProtocol }
+		});
 		try {
 			const ruleId = singleSecurityGroupRuleId((await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
@@ -25596,7 +25724,7 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
 			physicalId,
@@ -25604,7 +25732,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteSecurityGroupIngress(logicalId, physicalId, resourceType, previousProperties);
-			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message));
+			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets);
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -26288,7 +26416,10 @@ var EC2Provider = class {
 				name: "egress",
 				value: egress
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const cidrBlock = properties["CidrBlock"];
 			const ipv6CidrBlock = properties["Ipv6CidrBlock"];
@@ -28337,7 +28468,10 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				name: "httpMethod",
 				value: httpMethod
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
@@ -30381,12 +30515,7 @@ var ApiGatewayV2Provider = class {
 	*/
 	toSdkResponseParameters(value, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		const maskLeaf = (value) => {
-			if (typeof value === "string") return maskSecrets(value);
-			if (Array.isArray(value)) return value.map(maskLeaf);
-			if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [maskSecrets(k), maskLeaf(v)]));
-			return value;
-		};
+		const maskLeaf = (value) => maskDeep(value, maskSecrets);
 		if (value == null) return void 0;
 		if (typeof value !== "object" || Array.isArray(value)) return value;
 		const out = {};
@@ -34955,44 +35084,6 @@ var ECSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/masked-retry-logger.ts
-/**
-* The masker a caller supplied, or the identity function when it supplied
-* none.
-*
-* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
-* mandates — `create()` / `update()` are also reached from the import path,
-* from `cdkd drift --revert`, and from tests, and a provider must not care
-* which caller it got. Centralised here so no call site re-spells the `??`
-* and accidentally makes the capability required.
-*/
-function maskerOrIdentity(maskSecrets) {
-	return maskSecrets ?? ((text) => text);
-}
-/**
-* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
-*
-* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
-* and dropping it would silence the give-up summary on the calling path only —
-* trading a disclosure for the reporting hole issue #2018 closed. It goes
-* through the SAME mask as `debug` precisely because it is the line that
-* survives a run without `--verbose`; forwarding it unmasked would defeat the
-* fence at a HIGHER log level than the one the fence was written for.
-*
-* `logger` is typed structurally rather than as the concrete `Logger` so this
-* module stays a leaf and a test can pass two spies. That matches the
-* precedent already in the tree (`buildMfaConfigRequest` in
-* `cognito-provider.ts` takes an injected `logger?: { warn }`).
-*/
-function createMaskedRetryLogger(logger, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	return {
-		debug: (message) => logger.debug(mask(message)),
-		warn: (message) => logger.warn(mask(message))
-	};
-}
-
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
@@ -35002,41 +35093,6 @@ function createMaskedRetryLogger(logger, maskSecrets) {
 */
 const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
-* Depth cap for {@link maskDeep}. Bounds a self-referential bag rather than
-* hanging; `JSON.stringify` would throw on one anyway, and a throw is the
-* better failure of the two.
-*/
-const MASK_WALK_MAX_DEPTH$1 = 8;
-/**
-* Mask every string LEAF and KEY of an arbitrary value, returning a structure
-* safe to `JSON.stringify` into a log line (issue #2050).
-*
-* The ordering is the whole point. `maskSecretsInText` matches by literal
-* occurrence, and `JSON.stringify` escapes `"`, `\` and newlines — so a Secrets
-* Manager JSON document (the commonest real secret shape) does not occur in the
-* stringified text and survives a mask applied afterwards. Masking the leaves
-* first also hands the masker each RAW value, which reaches
-* `maskSecretsInText`'s whole-value arm at any length instead of only the
-* substring arm's 4-character floor. See the "three gaps" note in
-* `src/deployment/secret-redaction.ts`.
-*
-* Keys are masked as well as values: `JSON.stringify` renders them into the
-* same line, so a resolved secret used as a map key would otherwise escape.
-*
-* `cognito-provider.ts` carries an equivalent private walk for its own
-* stringified warnings. Two copies is the current cost of keeping this a leaf;
-* a THIRD site is the point at which this should move into
-* `../masked-retry-logger.ts` (already the shared provider-side masking module)
-* and all three converge on it.
-*/
-function maskDeep(value, mask, depth = 0) {
-	if (typeof value === "string") return mask(value);
-	if (depth >= MASK_WALK_MAX_DEPTH$1) return value;
-	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
-	return value;
-}
-/**
 * Documented AWS defaults for TargetGroup attributes, used to reset a
 * removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
 * / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
@@ -39580,10 +39636,10 @@ var Route53Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties);
+			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -39901,7 +39957,10 @@ var Route53Provider = class {
 				name: "recordType",
 				value: recordType
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -39926,7 +39985,7 @@ var Route53Provider = class {
 			throw new ProvisioningError(`Failed to create record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRecordSet(logicalId, physicalId, resourceType, properties) {
+	async updateRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Updating Route 53 record set ${logicalId}: ${physicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId);
 		const recordName = properties["Name"];
@@ -39944,7 +40003,10 @@ var Route53Provider = class {
 				name: "recordType",
 				value: recordType
 			}
-		], { onRefusal: (message) => this.logger.warn(message) });
+		], {
+			onRefusal: (message) => this.logger.warn(message),
+			maskSecrets: context?.maskSecrets
+		});
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -40977,15 +41039,6 @@ function readDeclaredMfaConfiguration(raw, options) {
 	return value.trim() === "" ? "" : value;
 }
 /**
-* Depth cap for the pre-stringify secret walk in {@link buildMfaConfigRequest}.
-*
-* Only a guard against a self-referential bag, not a real bound: a resolved
-* `EnabledMfas` is a list of factor-name scalars, so the walk never reaches
-* depth 2 on any shape this warning exists to describe. Deliberately generous
-* so no plausible mis-shape is left unmasked by it.
-*/
-const MASK_WALK_MAX_DEPTH = 8;
-/**
 * Read `EnabledMfas` as the pair (recognized list, "the template asked for a
 * factor at all").
 *
@@ -41119,15 +41172,9 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
 	const anyFactorBlock = hasAnyMfaFactorBlock(request);
-	const maskDeep = (v, depth = 0) => {
-		if (typeof v === "string") return maskSecrets(v);
-		if (depth >= MASK_WALK_MAX_DEPTH) return v;
-		if (Array.isArray(v)) return v.map((e) => maskDeep(e, depth + 1));
-		if (v !== null && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [maskSecrets(k), maskDeep(x, depth + 1)]));
-		return v;
-	};
-	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskDeep(f)) ?? String(f));
-	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskDeep(properties["EnabledMfas"]))} (not a list)`);
+	const maskLeaves = (v) => maskDeep(v, maskSecrets);
+	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskLeaves(f)) ?? String(f));
+	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskLeaves(properties["EnabledMfas"]))} (not a list)`);
 	if (dropped.length > 0) {
 		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
@@ -44885,7 +44932,10 @@ var AppSyncProvider = class {
 		}, {
 			name: "name",
 			value: name
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		let reportedArn;
 		try {
 			const input = {
@@ -44951,7 +45001,10 @@ var AppSyncProvider = class {
 				name: "fieldName",
 				value: fieldName
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		let reportedArn;
 		try {
 			const input = {
@@ -45018,7 +45071,10 @@ var AppSyncProvider = class {
 		}, {
 			name: "apiKeyId",
 			value: apiKeyId
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
 		return {
 			physicalId,
@@ -45704,7 +45760,10 @@ var GlueProvider = class {
 		}, {
 			name: "tableName",
 			value: tableName
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
@@ -57184,7 +57243,10 @@ var S3TablesProvider = class {
 		}, {
 			name: "namespace",
 			value: namespaceName
-		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		}], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			await this.getClient().send(new CreateNamespaceCommand({
 				tableBucketARN,
@@ -57244,7 +57306,10 @@ var S3TablesProvider = class {
 				name: "name",
 				value: name
 			}
-		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		], {
+			maskSecrets: context?.maskSecrets,
+			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
+		});
 		try {
 			const response = await this.getClient().send(new CreateTableCommand$2({
 				tableBucketARN,
@@ -59380,6 +59445,19 @@ function isCertificateInUseError(error) {
 * consumers (CloudFront, ALB) will fail to start if they reach the cert
 * before it issues, but that's the documented trade-off.
 *
+* **A create that fails after requesting DELETES its certificate** (issue
+* [#2169](https://github.com/go-to-k/cdkd/issues/2169)). `RequestCertificate`
+* materializes the certificate immediately and everything after it can fail —
+* most commonly the ISSUED wait, which a DNS-validated certificate whose
+* validation records are not live yet exhausts by construction. Before this,
+* the ARN was thrown away with the error: the certificate existed in AWS with
+* nothing naming it (absent from state, so invisible to `cdkd state show` and
+* unreachable by `cdkd destroy`), and the next `cdkd deploy` requested another
+* one — an orphan per attempt. `create()` now retires the certificate it just
+* requested before re-throwing, so a failed deploy leaves nothing behind and a
+* retry starts clean. See {@link ACMCertificateProvider.cleanupRequestedCertificate}
+* for why deleting is safe and why it is preferred over recording the remnant.
+*
 * **CloudFront cross-region note**: ACM certificates referenced by a
 * CloudFront Distribution MUST live in `us-east-1`. cdkd does not enforce
 * this — it's the developer's responsibility to deploy the certificate
@@ -59429,12 +59507,22 @@ var ACMCertificateProvider = class {
 		if (Object.keys(options).length > 0) input["Options"] = options;
 		const tags = properties["Tags"];
 		if (tags && Array.isArray(tags) && tags.length > 0) input["Tags"] = tags;
+		const idempotencyToken = acquireIdempotencyToken({
+			scope: "RequestCertificate",
+			logicalId,
+			maxLength: 32,
+			charset: "alphanumeric"
+		});
+		input["IdempotencyToken"] = idempotencyToken.value;
+		let requestedArn;
 		try {
 			const certificateArn = (await this.acmClient.send(new RequestCertificateCommand(input))).CertificateArn;
 			if (!certificateArn) throw new ProvisioningError(`RequestCertificate succeeded but no CertificateArn returned for ${logicalId}`, resourceType, logicalId);
+			requestedArn = certificateArn;
 			this.logger.debug(`Requested ACM certificate: ${certificateArn}`);
-			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId);
+			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType);
 			else this.logger.warn(`Skipping wait for ACM certificate ${logicalId} (CDKD_NO_WAIT=true). Downstream consumers (CloudFront / ALB) will fail until the cert reaches ISSUED.`);
+			idempotencyToken.release();
 			return {
 				physicalId: certificateArn,
 				attributes: {
@@ -59443,9 +59531,84 @@ var ACMCertificateProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof CdkdError) throw error;
+			const survivorNote = requestedArn ? await this.cleanupRequestedCertificate(requestedArn, logicalId, idempotencyToken) : void 0;
+			if (error instanceof CdkdError) {
+				if (survivorNote === void 0) throw error;
+				throw new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
+			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
+		}
+	}
+	/**
+	* Retire the certificate a FAILED `create()` just requested, so the failure
+	* leaves nothing behind (issue
+	* [#2169](https://github.com/go-to-k/cdkd/issues/2169)).
+	*
+	* Returns `undefined` when the certificate is gone, or a one-line note naming
+	* the survivor when it could not be deleted. Never throws: the original
+	* create error is what the user needs to see, and a cleanup failure must
+	* degrade that message rather than replace it.
+	*
+	* ## Why DELETING is right, when the obvious objection is that it throws away
+	* the user's DNS work
+	*
+	* It does not. ACM derives a domain's validation CNAME from the domain and
+	* the account, not from the certificate, and documents that the record "must
+	* be added to your DNS database only once": *"Without the need to repeat
+	* validation, you can request additional ACM certificates for your fully
+	* qualified domain name (FQDN) for as long as the CNAME record remains in
+	* place ... You can also replace a deleted certificate."*
+	* (https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)
+	* So the CNAMEs a user adds after seeing this failure validate the NEXT
+	* certificate too, and the retry issues normally. The intuition that a
+	* `PENDING_VALIDATION` certificate is precious does not hold for ACM.
+	*
+	* ## Why not RECORD the remnant in cdkd state instead
+	*
+	* That was this fix's first shape, and it does not work. A state record makes
+	* the next deploy diff the resource as `NO_CHANGE` -- the recorded properties
+	* ARE the template's -- so cdkd would never touch that certificate again:
+	* `cdkd deploy` would print "No changes detected" and exit 0 over a
+	* certificate that is still unusable, and the CloudFront / ALB consuming it
+	* would fail with no explanation. Turning a loud failure into a silent one is
+	* worse than the orphan it fixes. Making the diff re-provision it instead
+	* needs a marker on the state record -- a schema bump -- to buy behaviour
+	* that deleting gives for free.
+	*
+	* ## The "keep it" escape hatch already exists
+	*
+	* A user who WANTS the certificate to outlive the deploy has
+	* `CDKD_NO_WAIT=true` (`cdkd deploy --no-wait`), which returns success with
+	* the certificate recorded in state and never reaches this path. "Wait for
+	* it" and "keep it even if the wait fails" are different requests, and cdkd
+	* already has a flag for the second.
+	*/
+	/**
+	* The region an ACM ARN names, for the manual retire command. Taken from the
+	* ARN rather than from the client so the command a user pastes matches the
+	* certificate it names even when their shell default differs. Falls back to
+	* the literal placeholder for a shape this cannot parse -- a wrong region
+	* would make the command silently address a different account/region.
+	*/
+	regionOfArn(arn) {
+		return arn.split(":")[3] || "<region>";
+	}
+	async cleanupRequestedCertificate(certificateArn, logicalId, idempotencyToken) {
+		try {
+			await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: certificateArn }));
+			this.logger.info(`Deleted the ACM certificate ${certificateArn} that the failed create of ${logicalId} requested, so nothing is left behind. DNS validation records you have already added stay valid for the retry.`);
+			idempotencyToken.release();
+			return;
+		} catch (cleanupError) {
+			if (cleanupError instanceof ResourceNotFoundException$7 || cleanupError instanceof Error && cleanupError.name === "ResourceNotFoundException") {
+				this.logger.info(`The ACM certificate ${certificateArn} that the failed create of ${logicalId} requested was already gone; nothing to clean up.`);
+				idempotencyToken.release();
+				return;
+			}
+			const detail = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			this.logger.warn(`Could not delete the ACM certificate ${certificateArn} that the failed create of ${logicalId} requested: ${detail}`);
+			return `The certificate ${certificateArn} this attempt created could NOT be deleted, and cdkd is not tracking it -- retire it with \`aws acm delete-certificate --certificate-arn ${certificateArn} --region ${this.regionOfArn(certificateArn)}\` (the reason is in the warning above).`;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -59618,11 +59781,25 @@ var ACMCertificateProvider = class {
 	* Throws on `VALIDATION_TIMED_OUT` / `FAILED` (terminal failures) and on
 	* polling-cap exhaustion (treated as timeout). SIGINT short-circuits the
 	* loop and returns control to the deploy engine's cleanup path.
+	*
+	* Both throws are `ProvisioningError`s carrying `certificateArn` as their
+	* `physicalId` (issue
+	* [#2169](https://github.com/go-to-k/cdkd/issues/2169)). They used to be
+	* plain `Error`s whose only reference to the certificate was the message
+	* TEXT, which is not something a caller can act on. The certificate is real
+	* by the time either fires, so the error that reports the failure is the one
+	* piece of the failure path that should still be able to name it.
+	*
+	* Says nothing about what happens to the certificate afterwards: the caller
+	* owns that. `create()`'s catch retires it (see
+	* {@link ACMCertificateProvider.cleanupRequestedCertificate}) and appends a
+	* note to this message only when that cleanup could NOT.
 	*/
-	async waitForCertificateIssued(certificateArn, logicalId) {
+	async waitForCertificateIssued(certificateArn, logicalId, resourceType) {
 		this.logger.debug(`Waiting for ACM certificate ${certificateArn} to reach ISSUED status...`);
 		let interrupted = false;
-		let validationOptionsLogged = false;
+		/** The last validation-record block printed, so we re-print only on a CHANGE. */
+		let lastValidationOptions;
 		const sigintHandler = () => {
 			interrupted = true;
 		};
@@ -59640,17 +59817,20 @@ var ACMCertificateProvider = class {
 					this.logger.debug(`ACM certificate ${certificateArn} is ISSUED`);
 					return;
 				}
-				if (status === "FAILED" || status === "VALIDATION_TIMED_OUT" || status === "INACTIVE" || status === "REVOKED" || status === "EXPIRED") throw new Error(`ACM certificate ${logicalId} (${certificateArn}) entered terminal status ${status} during validation. Check ACM console / DNS records to diagnose.`);
-				if (status === "PENDING_VALIDATION" && !validationOptionsLogged && validations.length > 0) {
-					this.logValidationOptions(validations);
-					validationOptionsLogged = true;
+				if (status === "FAILED" || status === "VALIDATION_TIMED_OUT" || status === "INACTIVE" || status === "REVOKED" || status === "EXPIRED") throw new ProvisioningError(`ACM certificate ${logicalId} (${certificateArn}) entered terminal status ${status} during validation. Check ACM console / DNS records to diagnose.`, resourceType, logicalId, certificateArn);
+				if (status === "PENDING_VALIDATION") {
+					const rendered = this.renderValidationOptions(validations);
+					if (rendered !== void 0 && rendered !== lastValidationOptions) {
+						this.logger.info(rendered);
+						lastValidationOptions = rendered;
+					}
 				}
 				this.logger.debug(`ACM certificate ${certificateArn} status: ${status} (attempt ${attempt}/${this.maxPollAttempts})`);
 				const sleepEnd = Date.now() + this.pollIntervalMs;
 				const tickMs = Math.min(1e3, this.pollIntervalMs);
 				while (Date.now() < sleepEnd && !interrupted) await new Promise((resolve) => setTimeout(resolve, tickMs));
 			}
-			throw new Error(`ACM certificate ${logicalId} (${certificateArn}) did not reach ISSUED status within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. If your DNS zone is manually managed, you may need to increase --resource-timeout AWS::CertificateManager::Certificate=<duration> or set CDKD_NO_WAIT=true.`);
+			throw new ProvisioningError(`ACM certificate ${logicalId} (${certificateArn}) did not reach ISSUED status within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. ` + (lastValidationOptions === void 0 ? "AWS had not published this certificate's validation records before the wait ran out, so none were printed — re-run the deploy to request them again. " : `Add the validation records printed above to your DNS zone and re-run the deploy. `) + "ACM reuses a domain's validation CNAME across certificates, so records you add now validate the next attempt. To wait LONGER, raise CDKD_ACM_POLL_ATTEMPTS / CDKD_ACM_POLL_INTERVAL_MS — this cap is the provider's OWN and is what just fired; --resource-timeout alone will not lengthen it. Past ~30m also raise --resource-timeout AWS::CertificateManager::Certificate=<duration>, or the engine's per-resource deadline becomes the shorter of the two. Or set CDKD_NO_WAIT=true to keep the certificate and validate it out of band.", resourceType, logicalId, certificateArn);
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
 		}
@@ -59660,16 +59840,13 @@ var ACMCertificateProvider = class {
 	* user can copy / paste them into Route 53 / Cloudflare / etc. while the
 	* cert is still PENDING_VALIDATION.
 	*/
-	logValidationOptions(validations) {
+	renderValidationOptions(validations) {
 		const lines = ["ACM certificate is PENDING_VALIDATION. Add the following DNS records to validate:"];
 		for (const v of validations) if (v.ValidationMethod === "DNS" && v.ResourceRecord) {
 			const r = v.ResourceRecord;
 			lines.push(`  ${v.DomainName} — ${r.Type} ${r.Name} -> ${r.Value}`);
-		} else if (v.ValidationMethod === "EMAIL") {
-			const emails = (v.ValidationEmails ?? []).join(", ");
-			lines.push(`  ${v.DomainName} — confirmation email sent to: ${emails || "<none>"}`);
-		}
-		this.logger.info(lines.join("\n"));
+		} else if (v.ValidationMethod === "EMAIL" && (v.ValidationEmails ?? []).length > 0) lines.push(`  ${v.DomainName} — confirmation email sent to: ${v.ValidationEmails.join(", ")}`);
+		return lines.length === 1 ? void 0 : lines.join("\n");
 	}
 	async updateTags(certificateArn, newTags, oldTags) {
 		const newTagMap = new Map((newTags || []).map((t) => [t.Key, t.Value]));
@@ -86442,7 +86619,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.39");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.41");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;