@go-to-k/cdkd 0.23.2 → 0.25.0

package/dist/cli.js

@@ -508,6 +508,51 @@ var stateOptions = [
   new Option("--state-prefix <prefix>", "S3 key prefix for state files").default("cdkd")
 ];
 var stackOptions = [new Option("--stack <name>", "Stack name to operate on")];
+function parseDuration(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(
+      `Invalid duration "${value}": expected <number>s, <number>m, or <number>h (e.g. 30s, 5m, 1h)`
+    );
+  }
+  const match = /^(\d+(?:\.\d+)?)([smh])$/.exec(value.trim());
+  if (!match) {
+    throw new Error(
+      `Invalid duration "${value}": expected <number>s, <number>m, or <number>h (e.g. 30s, 5m, 1h)`
+    );
+  }
+  const num = Number(match[1]);
+  if (!Number.isFinite(num) || num <= 0) {
+    throw new Error(`Invalid duration "${value}": must be greater than zero`);
+  }
+  const unit = match[2];
+  const multiplier = unit === "s" ? 1e3 : unit === "m" ? 6e4 : 36e5;
+  return Math.round(num * multiplier);
+}
+var resourceTimeoutOptions = [
+  // Default values are stored as parsed milliseconds (NOT the source
+  // string) because commander's `argParser` only runs on user-supplied
+  // values, never on defaults — without this every command handler
+  // would see `'5m'` (string) when the user did not pass the flag and
+  // `300_000` (number) when they did. The second `defaultValueDescription`
+  // argument keeps `--help` showing the human-readable form.
+  new Option(
+    "--resource-warn-after <duration>",
+    "Warn when a single resource operation exceeds this wall-clock duration (e.g. 5m, 90s, 1h)"
+  ).default(parseDuration("5m"), "5m").argParser(parseDuration),
+  new Option(
+    "--resource-timeout <duration>",
+    "Abort a single resource operation that exceeds this wall-clock duration. Custom-Resource-heavy stacks may need to raise this above the default 30m (the Custom Resource provider's polling cap is 1h)."
+  ).default(parseDuration("30m"), "30m").argParser(parseDuration)
+];
+function validateResourceTimeouts(opts) {
+  const warn = opts.resourceWarnAfter;
+  const timeout = opts.resourceTimeout;
+  if (typeof warn === "number" && typeof timeout === "number" && warn >= timeout) {
+    throw new Error(
+      `--resource-warn-after (${warn}ms) must be less than --resource-timeout (${timeout}ms)`
+    );
+  }
+}
 var deployOptions = [
   new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
   new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -523,7 +568,8 @@ var deployOptions = [
   new Option(
     "-e, --exclusively",
     "Only deploy requested stacks, do not include dependencies"
-  ).default(false)
+  ).default(false),
+  ...resourceTimeoutOptions
 ];
 var contextOptions = [
   new Option(
@@ -718,6 +764,22 @@ var LiveRenderer = class {
     if (this.active)
       this.draw();
   }
+  /**
+   * Replace the label of a previously-added task in place. No-op if the
+   * task is not currently tracked (e.g. it already finished). Used by the
+   * per-resource deadline wrapper to surface a "[taking longer than
+   * expected, Nm+]" suffix without disturbing the elapsed-time counter
+   * the renderer tracks via `startedAt`.
+   */
+  updateTaskLabel(id, label) {
+    const stackName = getCurrentStackName();
+    const task = this.tasks.get(scopedKey(id, stackName));
+    if (!task)
+      return;
+    task.label = label;
+    if (this.active)
+      this.draw();
+  }
   /**
    * Print content above the live area. Clears the live area, runs the writer,
    * then redraws the live area. When the renderer is inactive, the writer
@@ -1011,6 +1073,38 @@ var ProvisioningError = class _ProvisioningError extends CdkdError {
     Object.setPrototypeOf(this, _ProvisioningError.prototype);
   }
 };
+var ResourceTimeoutError = class _ResourceTimeoutError extends CdkdError {
+  constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+    const elapsedLabel = formatDuration(elapsedMs);
+    const timeoutLabel = formatDuration(timeoutMs);
+    super(
+      `Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).
+This may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
+slow ENI provisioning. Re-run with --resource-timeout 1h if the resource genuinely
+needs more time, or --verbose to see the underlying provider activity.`,
+      "RESOURCE_TIMEOUT"
+    );
+    this.logicalId = logicalId;
+    this.resourceType = resourceType;
+    this.region = region;
+    this.elapsedMs = elapsedMs;
+    this.operation = operation;
+    this.timeoutMs = timeoutMs;
+    this.name = "ResourceTimeoutError";
+    Object.setPrototypeOf(this, _ResourceTimeoutError.prototype);
+  }
+};
+function formatDuration(ms) {
+  if (ms < 6e4) {
+    return `${Math.round(ms / 1e3)}s`;
+  }
+  const totalMinutes = Math.round(ms / 6e4);
+  if (totalMinutes < 60)
+    return `${totalMinutes}m`;
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
 var DependencyError = class _DependencyError extends CdkdError {
   constructor(message, cause) {
     super(message, "DEPENDENCY_ERROR", cause);
@@ -30781,7 +30875,85 @@ async function withRetry(operation, logicalId, opts = {}) {
   throw lastError;
 }
 
+// src/deployment/resource-deadline.ts
+var InvalidResourceDeadlineError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidResourceDeadlineError";
+  }
+};
+function validateOptions(opts) {
+  const { warnAfterMs, timeoutMs } = opts;
+  if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) {
+    throw new InvalidResourceDeadlineError(
+      `withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`
+    );
+  }
+  if (warnAfterMs >= timeoutMs) {
+    throw new InvalidResourceDeadlineError(
+      `withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`
+    );
+  }
+}
+async function withResourceDeadline(operation, opts) {
+  validateOptions(opts);
+  const startedAt = Date.now();
+  return new Promise((resolve4, reject) => {
+    let settled = false;
+    let warnTimer;
+    let timeoutTimer;
+    const cleanup = () => {
+      if (warnTimer !== void 0)
+        clearTimeout(warnTimer);
+      if (timeoutTimer !== void 0)
+        clearTimeout(timeoutTimer);
+      warnTimer = void 0;
+      timeoutTimer = void 0;
+    };
+    if (opts.onWarn) {
+      warnTimer = setTimeout(() => {
+        if (settled)
+          return;
+        try {
+          opts.onWarn(Date.now() - startedAt);
+        } catch {
+        }
+      }, opts.warnAfterMs);
+      if (typeof warnTimer.unref === "function")
+        warnTimer.unref();
+    }
+    timeoutTimer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      const elapsed = Date.now() - startedAt;
+      reject(opts.onTimeout(elapsed));
+    }, opts.timeoutMs);
+    if (typeof timeoutTimer.unref === "function")
+      timeoutTimer.unref();
+    Promise.resolve().then(() => operation()).then(
+      (value) => {
+        if (settled)
+          return;
+        settled = true;
+        cleanup();
+        resolve4(value);
+      },
+      (err) => {
+        if (settled)
+          return;
+        settled = true;
+        cleanup();
+        reject(err);
+      }
+    );
+  });
+}
+
 // src/deployment/deploy-engine.ts
+var DEFAULT_RESOURCE_WARN_AFTER_MS = 5 * 60 * 1e3;
+var DEFAULT_RESOURCE_TIMEOUT_MS = 30 * 60 * 1e3;
 var InterruptedError = class extends Error {
   constructor() {
     super("Deployment interrupted by user (Ctrl+C)");
@@ -30802,6 +30974,8 @@ var DeployEngine = class {
     this.options.dryRun = options.dryRun ?? false;
     this.options.lockTimeout = options.lockTimeout ?? 5 * 60 * 1e3;
     this.options.noRollback = options.noRollback ?? false;
+    this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
+    this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
   }
   logger = getLogger().child("DeployEngine");
   resolver;
@@ -31400,259 +31574,305 @@ var DeployEngine = class {
    */
   async provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
     const resourceType = change.resourceType;
-    const provider = this.providerRegistry.getProvider(resourceType);
     const renderer = getLiveRenderer();
     const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
     const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-    renderer.addTask(logicalId, `${verb} ${logicalId} (${resourceType})`);
-    try {
-      switch (change.changeType) {
-        case "CREATE": {
-          const desiredProps = change.desiredProperties || {};
-          const context = {
+    const baseLabel = `${verb} ${logicalId} (${resourceType})`;
+    renderer.addTask(logicalId, baseLabel);
+    const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
+    const warnAfterMs = this.options.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
+    const timeoutMs = this.options.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
+    try {
+      await withResourceDeadline(
+        async () => {
+          await this.provisionResourceBody(
+            logicalId,
+            change,
+            stateResources,
+            stackName,
             template,
-            resources: stateResources,
-            ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-            ...conditions && Object.keys(conditions).length > 0 && { conditions },
-            stateBackend: this.stateBackend,
-            stackName
-          };
-          const resolvedProps = await this.resolver.resolve(desiredProps, context);
-          const { provider: createProvider, properties: createProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-          const result = await this.withRetry(
-            () => createProvider.create(logicalId, resourceType, createProps),
+            parameterValues,
+            conditions,
+            counts,
+            progress
+          );
+        },
+        {
+          warnAfterMs,
+          timeoutMs,
+          onWarn: (elapsedMs) => {
+            const minutes = Math.max(1, Math.round(elapsedMs / 6e4));
+            const warnSuffix = ` [taking longer than expected, ${minutes}m+]`;
+            renderer.updateTaskLabel(logicalId, `${baseLabel}${warnSuffix}`);
+            renderer.printAbove(() => {
+              this.logger.warn(
+                `${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m \u2014 still waiting`
+              );
+            });
+          },
+          onTimeout: (elapsedMs) => new ResourceTimeoutError(
+            logicalId,
+            resourceType,
+            this.stackRegion,
+            elapsedMs,
+            operationKind,
+            timeoutMs
+          )
+        }
+      );
+    } catch (error) {
+      renderer.removeTask(logicalId);
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+      throw new ProvisioningError(
+        `Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`,
+        resourceType,
+        logicalId,
+        stateResources[logicalId]?.physicalId,
+        error instanceof Error ? error : void 0
+      );
+    } finally {
+      renderer.removeTask(logicalId);
+    }
+  }
+  /**
+   * Inner body of provisionResource, extracted so the outer wrapper can
+   * apply the per-resource deadline (`withResourceDeadline`) without
+   * having the timeout / warn timer code dwarf the real provisioning
+   * logic. Behaviour is unchanged from the pre-deadline implementation.
+   */
+  async provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
+    const resourceType = change.resourceType;
+    const provider = this.providerRegistry.getProvider(resourceType);
+    const renderer = getLiveRenderer();
+    switch (change.changeType) {
+      case "CREATE": {
+        const desiredProps = change.desiredProperties || {};
+        const context = {
+          template,
+          resources: stateResources,
+          ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
+          ...conditions && Object.keys(conditions).length > 0 && { conditions },
+          stateBackend: this.stateBackend,
+          stackName
+        };
+        const resolvedProps = await this.resolver.resolve(desiredProps, context);
+        const { provider: createProvider, properties: createProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+        const result = await this.withRetry(
+          () => createProvider.create(logicalId, resourceType, createProps),
+          logicalId
+        );
+        const dependencies = this.extractAllDependencies(template, logicalId);
+        stateResources[logicalId] = {
+          physicalId: result.physicalId,
+          resourceType,
+          properties: resolvedProps,
+          ...result.attributes && { attributes: result.attributes },
+          ...dependencies && dependencies.length > 0 && { dependencies }
+        };
+        if (counts)
+          counts.created++;
+        if (progress)
+          progress.current++;
+        const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+        renderer.removeTask(logicalId);
+        this.logger.info(`${createPrefix}\u2705 ${logicalId} (${resourceType}) created`);
+        break;
+      }
+      case "UPDATE": {
+        const currentResource = stateResources[logicalId];
+        if (!currentResource) {
+          throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+        }
+        const desiredProps = change.desiredProperties || {};
+        const currentProps = change.currentProperties || {};
+        const context = {
+          template,
+          resources: stateResources,
+          ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
+          ...conditions && Object.keys(conditions).length > 0 && { conditions },
+          stateBackend: this.stateBackend,
+          stackName
+        };
+        const resolvedProps = await this.resolver.resolve(desiredProps, context);
+        if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
+          this.logger.debug(
+            `Skipping ${logicalId}: no actual changes after intrinsic function resolution`
+          );
+          if (counts)
+            counts.skipped++;
+          break;
+        }
+        const needsReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
+        const dependencies = this.extractAllDependencies(template, logicalId);
+        if (needsReplacement) {
+          const replacedProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
+          this.logger.info(
+            `Replacing ${logicalId} (${resourceType}) - immutable properties changed: ${replacedProps}`
+          );
+          this.logger.info(`  Creating new ${logicalId}...`);
+          const { provider: replaceProvider, properties: replaceProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+          const createResult = await this.withRetry(
+            () => replaceProvider.create(logicalId, resourceType, replaceProps),
             logicalId
           );
-          const dependencies = this.extractAllDependencies(template, logicalId);
+          const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
+          if (updateReplacePolicy === "Retain") {
+            this.logger.info(
+              `  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`
+            );
+          } else {
+            this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
+            try {
+              await provider.delete(
+                logicalId,
+                currentResource.physicalId,
+                resourceType,
+                currentResource.properties,
+                { expectedRegion: this.stackRegion }
+              );
+              this.logger.info(`  \u2713 Old resource deleted`);
+            } catch (deleteError) {
+              this.logger.warn(
+                `  \u26A0 Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`
+              );
+            }
+          }
           stateResources[logicalId] = {
-            physicalId: result.physicalId,
+            physicalId: createResult.physicalId,
             resourceType,
             properties: resolvedProps,
-            ...result.attributes && { attributes: result.attributes },
+            ...createResult.attributes && { attributes: createResult.attributes },
             ...dependencies && dependencies.length > 0 && { dependencies }
           };
           if (counts)
-            counts.created++;
+            counts.updated++;
           if (progress)
             progress.current++;
-          const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+          const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
           renderer.removeTask(logicalId);
-          this.logger.info(`${createPrefix}\u2705 ${logicalId} (${resourceType}) created`);
-          break;
-        }
-        case "UPDATE": {
-          const currentResource = stateResources[logicalId];
-          if (!currentResource) {
-            throw new Error(`Cannot update ${logicalId}: resource not found in state`);
-          }
-          const desiredProps = change.desiredProperties || {};
-          const currentProps = change.currentProperties || {};
-          const context = {
-            template,
-            resources: stateResources,
-            ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-            ...conditions && Object.keys(conditions).length > 0 && { conditions },
-            stateBackend: this.stateBackend,
-            stackName
-          };
-          const resolvedProps = await this.resolver.resolve(desiredProps, context);
-          if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
-            this.logger.debug(
-              `Skipping ${logicalId}: no actual changes after intrinsic function resolution`
-            );
-            if (counts)
-              counts.skipped++;
-            break;
-          }
-          const needsReplacement2 = change.propertyChanges?.some((pc) => pc.requiresReplacement);
-          const dependencies = this.extractAllDependencies(template, logicalId);
-          if (needsReplacement2) {
-            const replacedProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
-            this.logger.info(
-              `Replacing ${logicalId} (${resourceType}) - immutable properties changed: ${replacedProps}`
-            );
-            this.logger.info(`  Creating new ${logicalId}...`);
-            const { provider: replaceProvider, properties: replaceProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-            const createResult = await this.withRetry(
-              () => replaceProvider.create(logicalId, resourceType, replaceProps),
+          this.logger.info(`${replacePrefix}\u2705 ${logicalId} (${resourceType}) replaced`);
+        } else {
+          this.logger.debug(`Updating ${logicalId} (${resourceType})`);
+          const { provider: updateProvider, properties: updateProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+          let result;
+          try {
+            result = await this.withRetry(
+              () => updateProvider.update(
+                logicalId,
+                currentResource.physicalId,
+                resourceType,
+                updateProps,
+                currentProps
+              ),
               logicalId
             );
-            const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
-            if (updateReplacePolicy === "Retain") {
+          } catch (updateError) {
+            const msg = updateError instanceof Error ? updateError.message : String(updateError);
+            if (msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE")) {
               this.logger.info(
-                `  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`
+                `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE \u2192 CREATE)`
               );
-            } else {
-              this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
               try {
                 await provider.delete(
                   logicalId,
                   currentResource.physicalId,
                   resourceType,
-                  currentResource.properties,
+                  currentProps,
                   { expectedRegion: this.stackRegion }
                 );
-                this.logger.info(`  \u2713 Old resource deleted`);
               } catch (deleteError) {
-                this.logger.warn(
-                  `  \u26A0 Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`
-                );
-              }
-            }
-            stateResources[logicalId] = {
-              physicalId: createResult.physicalId,
-              resourceType,
-              properties: resolvedProps,
-              ...createResult.attributes && { attributes: createResult.attributes },
-              ...dependencies && dependencies.length > 0 && { dependencies }
-            };
-            if (counts)
-              counts.updated++;
-            if (progress)
-              progress.current++;
-            const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-            renderer.removeTask(logicalId);
-            this.logger.info(`${replacePrefix}\u2705 ${logicalId} (${resourceType}) replaced`);
-          } else {
-            this.logger.debug(`Updating ${logicalId} (${resourceType})`);
-            const { provider: updateProvider, properties: updateProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-            let result;
-            try {
-              result = await this.withRetry(
-                () => updateProvider.update(
-                  logicalId,
-                  currentResource.physicalId,
-                  resourceType,
-                  updateProps,
-                  currentProps
-                ),
-                logicalId
-              );
-            } catch (updateError) {
-              const msg = updateError instanceof Error ? updateError.message : String(updateError);
-              if (msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE")) {
-                this.logger.info(
-                  `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE \u2192 CREATE)`
-                );
-                try {
-                  await provider.delete(
-                    logicalId,
-                    currentResource.physicalId,
-                    resourceType,
-                    currentProps,
-                    { expectedRegion: this.stackRegion }
+                const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+                if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) {
+                  this.logger.debug(
+                    `Old resource ${logicalId} already gone, proceeding with CREATE`
                   );
-                } catch (deleteError) {
-                  const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-                  if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) {
-                    this.logger.debug(
-                      `Old resource ${logicalId} already gone, proceeding with CREATE`
-                    );
-                  } else {
-                    throw deleteError;
-                  }
+                } else {
+                  throw deleteError;
                 }
-                const { provider: replProvider, properties: replProps } = this.selectProviderWithSafetyNet(
-                  provider,
-                  resourceType,
-                  resolvedProps,
-                  logicalId
-                );
-                const createResult = await this.withRetry(
-                  () => replProvider.create(logicalId, resourceType, replProps),
-                  logicalId
-                );
-                result = {
-                  physicalId: createResult.physicalId,
-                  attributes: createResult.attributes,
-                  wasReplaced: true
-                };
-              } else {
-                throw updateError;
               }
-            }
-            if (result.wasReplaced) {
-              this.logger.info(
-                `Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`
+              const { provider: replProvider, properties: replProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+              const createResult = await this.withRetry(
+                () => replProvider.create(logicalId, resourceType, replProps),
+                logicalId
               );
+              result = {
+                physicalId: createResult.physicalId,
+                attributes: createResult.attributes,
+                wasReplaced: true
+              };
+            } else {
+              throw updateError;
             }
-            stateResources[logicalId] = {
-              physicalId: result.physicalId,
-              resourceType,
-              properties: resolvedProps,
-              ...result.attributes && { attributes: result.attributes },
-              ...dependencies && dependencies.length > 0 && { dependencies }
-            };
-            if (counts)
-              counts.updated++;
-            if (progress)
-              progress.current++;
-            const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-            renderer.removeTask(logicalId);
-            this.logger.info(`${updatePrefix}\u2705 ${logicalId} (${resourceType}) updated`);
           }
-          break;
-        }
-        case "DELETE": {
-          const currentResource = stateResources[logicalId];
-          if (!currentResource) {
-            throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
-          }
-          const deletionPolicy = template?.Resources?.[logicalId]?.DeletionPolicy;
-          if (deletionPolicy === "Retain") {
-            this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: Retain`);
-            delete stateResources[logicalId];
-            break;
-          }
-          this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
-          try {
-            await this.withRetry(
-              () => provider.delete(
-                logicalId,
-                currentResource.physicalId,
-                resourceType,
-                currentResource.properties,
-                { expectedRegion: this.stackRegion }
-              ),
-              logicalId,
-              3,
-              // fewer retries for DELETE
-              5e3
+          if (result.wasReplaced) {
+            this.logger.info(
+              `Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`
             );
-          } catch (deleteError) {
-            const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-            if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) {
-              this.logger.debug(
-                `Resource ${logicalId} already deleted (${msg}), removing from state`
-              );
-            } else {
-              throw deleteError;
-            }
           }
-          delete stateResources[logicalId];
+          stateResources[logicalId] = {
+            physicalId: result.physicalId,
+            resourceType,
+            properties: resolvedProps,
+            ...result.attributes && { attributes: result.attributes },
+            ...dependencies && dependencies.length > 0 && { dependencies }
+          };
           if (counts)
-            counts.deleted++;
+            counts.updated++;
           if (progress)
             progress.current++;
-          const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+          const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
           renderer.removeTask(logicalId);
-          this.logger.info(`${deletePrefix}\u2705 ${logicalId} (${resourceType}) deleted`);
+          this.logger.info(`${updatePrefix}\u2705 ${logicalId} (${resourceType}) updated`);
+        }
+        break;
+      }
+      case "DELETE": {
+        const currentResource = stateResources[logicalId];
+        if (!currentResource) {
+          throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
+        }
+        const deletionPolicy = template?.Resources?.[logicalId]?.DeletionPolicy;
+        if (deletionPolicy === "Retain") {
+          this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: Retain`);
+          delete stateResources[logicalId];
           break;
         }
+        this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+        try {
+          await this.withRetry(
+            () => provider.delete(
+              logicalId,
+              currentResource.physicalId,
+              resourceType,
+              currentResource.properties,
+              { expectedRegion: this.stackRegion }
+            ),
+            logicalId,
+            3,
+            // fewer retries for DELETE
+            5e3
+          );
+        } catch (deleteError) {
+          const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+          if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) {
+            this.logger.debug(
+              `Resource ${logicalId} already deleted (${msg}), removing from state`
+            );
+          } else {
+            throw deleteError;
+          }
+        }
+        delete stateResources[logicalId];
+        if (counts)
+          counts.deleted++;
+        if (progress)
+          progress.current++;
+        const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+        renderer.removeTask(logicalId);
+        this.logger.info(`${deletePrefix}\u2705 ${logicalId} (${resourceType}) deleted`);
+        break;
       }
-    } catch (error) {
-      renderer.removeTask(logicalId);
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
-      throw new ProvisioningError(
-        `Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`,
-        resourceType,
-        logicalId,
-        stateResources[logicalId]?.physicalId,
-        error instanceof Error ? error : void 0
-      );
-    } finally {
-      renderer.removeTask(logicalId);
     }
   }
   /**
@@ -31864,6 +32084,10 @@ async function deployCommand(stacks, options) {
     process.env["CDKD_NO_LIVE"] = "1";
   }
   warnIfDeprecatedRegion(options);
+  validateResourceTimeouts({
+    resourceWarnAfter: options.resourceWarnAfter,
+    resourceTimeout: options.resourceTimeout
+  });
   if (!options.wait) {
     process.env["CDKD_NO_WAIT"] = "true";
   }
@@ -32056,7 +32280,9 @@ Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region:
         {
           concurrency: options.concurrency,
           dryRun: options.dryRun,
-          noRollback: !options.rollback
+          noRollback: !options.rollback,
+          resourceWarnAfterMs: options.resourceWarnAfter,
+          resourceTimeoutMs: options.resourceTimeout
         },
         stackRegion
       );
@@ -32466,41 +32692,73 @@ Acquiring lock for stack ${stackName}...`);
       logger.debug(
         `Deletion level ${executionLevels.length - levelIndex}/${executionLevels.length} (${level.length} resources)`
       );
+      const warnAfterMs = ctx.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
+      const timeoutMs = ctx.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
+      const stackRegion2 = state.region ?? ctx.baseRegion;
       const deletePromises = level.map(async (logicalId) => {
         const resource = state.resources[logicalId];
         if (!resource) {
           logger.warn(`Resource ${logicalId} not found in state, skipping`);
           return;
         }
-        renderer.addTask(logicalId, `Deleting ${logicalId} (${resource.resourceType})`);
+        const baseLabel = `Deleting ${logicalId} (${resource.resourceType})`;
+        renderer.addTask(logicalId, baseLabel);
         try {
           const provider = destroyProviderRegistry.getProvider(resource.resourceType);
-          let lastDeleteError;
-          for (let attempt = 0; attempt <= 3; attempt++) {
-            try {
-              await provider.delete(
+          await withResourceDeadline(
+            async () => {
+              let lastDeleteError;
+              for (let attempt = 0; attempt <= 3; attempt++) {
+                try {
+                  await provider.delete(
+                    logicalId,
+                    resource.physicalId,
+                    resource.resourceType,
+                    resource.properties
+                  );
+                  lastDeleteError = null;
+                  break;
+                } catch (retryError) {
+                  lastDeleteError = retryError;
+                  const msg = retryError instanceof Error ? retryError.message : String(retryError);
+                  const isRetryable = msg.includes("Too Many Requests") || msg.includes("has dependencies") || msg.includes("can't be deleted since") || msg.includes("DependencyViolation");
+                  if (!isRetryable || attempt >= 3)
+                    break;
+                  const delay = 5e3 * Math.pow(2, attempt);
+                  logger.debug(
+                    `  \u23F3 Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/3)`
+                  );
+                  await new Promise((resolve4) => setTimeout(resolve4, delay));
+                }
+              }
+              if (lastDeleteError)
+                throw lastDeleteError;
+            },
+            {
+              warnAfterMs,
+              timeoutMs,
+              onWarn: (elapsedMs) => {
+                const minutes = Math.max(1, Math.round(elapsedMs / 6e4));
+                renderer.updateTaskLabel(
+                  logicalId,
+                  `${baseLabel} [taking longer than expected, ${minutes}m+]`
+                );
+                renderer.printAbove(() => {
+                  logger.warn(
+                    `${logicalId} (${resource.resourceType}) has been deleting for ${minutes}m \u2014 still waiting`
+                  );
+                });
+              },
+              onTimeout: (elapsedMs) => new ResourceTimeoutError(
                 logicalId,
-                resource.physicalId,
                 resource.resourceType,
-                resource.properties
-              );
-              lastDeleteError = null;
-              break;
-            } catch (retryError) {
-              lastDeleteError = retryError;
-              const msg = retryError instanceof Error ? retryError.message : String(retryError);
-              const isRetryable = msg.includes("Too Many Requests") || msg.includes("has dependencies") || msg.includes("can't be deleted since") || msg.includes("DependencyViolation");
-              if (!isRetryable || attempt >= 3)
-                break;
-              const delay = 5e3 * Math.pow(2, attempt);
-              logger.debug(
-                `  \u23F3 Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/3)`
-              );
-              await new Promise((resolve4) => setTimeout(resolve4, delay));
+                stackRegion2,
+                elapsedMs,
+                "DELETE",
+                timeoutMs
+              )
             }
-          }
-          if (lastDeleteError)
-            throw lastDeleteError;
+          );
           renderer.removeTask(logicalId);
           logger.info(`  \u2705 ${logicalId} (${resource.resourceType}) deleted`);
           result.deletedCount++;
@@ -32510,6 +32768,16 @@ Acquiring lock for stack ${stackName}...`);
           if (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException")) {
             logger.debug(`  ${logicalId} already deleted, removing from state`);
             result.deletedCount++;
+          } else if (error instanceof ResourceTimeoutError) {
+            const wrapped = new ProvisioningError(
+              error.message,
+              resource.resourceType,
+              logicalId,
+              resource.physicalId,
+              error
+            );
+            logger.error(`  \u2717 Failed to delete ${logicalId}:`, wrapped.message);
+            result.errorCount++;
           } else {
             logger.error(`  \u2717 Failed to delete ${logicalId}:`, String(error));
             result.errorCount++;
@@ -32552,6 +32820,10 @@ async function destroyCommand(stackArgs, options) {
     process.env["CDKD_NO_LIVE"] = "1";
   }
   warnIfDeprecatedRegion(options);
+  validateResourceTimeouts({
+    resourceWarnAfter: options.resourceWarnAfter,
+    resourceTimeout: options.resourceTimeout
+  });
   const region = options.region || process.env["AWS_REGION"] || "us-east-1";
   const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
   logger.info("Starting stack destruction...");
@@ -32683,7 +32955,9 @@ Preparing to destroy stack: ${stackName}`);
         baseRegion: region,
         ...options.profile && { profile: options.profile },
         stateBucket,
-        skipConfirmation: options.yes || options.force
+        skipConfirmation: options.yes || options.force,
+        resourceWarnAfterMs: options.resourceWarnAfter,
+        resourceTimeoutMs: options.resourceTimeout
       });
     }
   } finally {
@@ -32701,6 +32975,7 @@ function createDestroyCommand() {
     ...stateOptions,
     ...stackOptions,
     ...destroyOptions,
+    ...resourceTimeoutOptions,
     ...contextOptions
   ].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
@@ -33536,7 +33811,7 @@ function formatAttributeValue(value) {
   }
   return JSON.stringify(value);
 }
-function formatDuration(ms) {
+function formatDuration2(ms) {
   const seconds = Math.floor(ms / 1e3);
   if (seconds < 60)
     return `${seconds}s`;
@@ -33549,7 +33824,7 @@ function formatLockSummary(lockInfo) {
     return "unlocked";
   const opStr = lockInfo.operation ? ` (operation: ${lockInfo.operation})` : "";
   const expiresInMs = lockInfo.expiresAt - Date.now();
-  const expiresStr = expiresInMs > 0 ? `expires in ${formatDuration(expiresInMs)}` : `expired ${formatDuration(-expiresInMs)} ago`;
+  const expiresStr = expiresInMs > 0 ? `expires in ${formatDuration2(expiresInMs)}` : `expired ${formatDuration2(-expiresInMs)} ago`;
   return `locked by ${lockInfo.owner}${opStr}, ${expiresStr}`;
 }
 function createStateResourcesCommand() {
@@ -33737,6 +34012,10 @@ async function stateDestroyCommand(stackArgs, options) {
     logger.setLevel("debug");
     process.env["CDKD_NO_LIVE"] = "1";
   }
+  validateResourceTimeouts({
+    resourceWarnAfter: options.resourceWarnAfter,
+    resourceTimeout: options.resourceTimeout
+  });
   if (!options.all && stackArgs.length === 0) {
     throw new Error(
       "Stack name is required. Usage: cdkd state destroy <stack> [<stack>...] | --all"
@@ -33836,7 +34115,9 @@ Preparing to destroy stack: ${stackName}${ref.region ? ` (${ref.region})` : ""}`
           // and the per-stack prompt inside the runner. Per-stack prompts are
           // skipped when `options.yes` is set OR `--all` was set (the user
           // already accepted the batch prompt).
-          skipConfirmation: options.yes || options.all === true
+          skipConfirmation: options.yes || options.all === true,
+          resourceWarnAfterMs: options.resourceWarnAfter,
+          resourceTimeoutMs: options.resourceTimeout
         });
         totalErrors += result.errorCount;
       }
@@ -33867,7 +34148,9 @@ function createStateDestroyCommand() {
       "For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'."
     ].join("\n")
   ).action(withErrorHandling(stateDestroyCommand));
-  [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
+  [...commonOptions, ...stateOptions, ...resourceTimeoutOptions].forEach(
+    (opt) => cmd.addOption(opt)
+  );
   cmd.addOption(deprecatedRegionOption);
   return cmd;
 }
@@ -34070,7 +34353,11 @@ async function importCommand(stackArg, options) {
         `State already exists for stack '${stackInfo.stackName}' (${targetRegion}). Pass --force to overwrite. (cdkd state import rebuilds the resource map from AWS, so the existing state \u2014 including any drift you've manually edited \u2014 will be lost.)`
       );
     }
-    const overrides = parseResourceOverrides(options.resource, options.resourceMapping);
+    const overrides = parseResourceOverrides(
+      options.resource,
+      options.resourceMapping,
+      options.resourceMappingInline
+    );
     if (overrides.size > 0) {
       logger.debug(`User-supplied physical IDs: ${[...overrides.keys()].join(", ")}`);
     }
@@ -34213,28 +34500,30 @@ async function importOne(task) {
     };
   }
 }
-function parseResourceOverrides(flags, mappingFile) {
+function parseResourceOverrides(flags, mappingFile, mappingInline) {
   const map = /* @__PURE__ */ new Map();
+  if (mappingFile && mappingInline) {
+    throw new Error(
+      "--resource-mapping and --resource-mapping-inline are mutually exclusive; pass only one."
+    );
+  }
   if (mappingFile) {
-    let parsed;
+    let raw;
     try {
-      parsed = JSON.parse(readFileSync5(mappingFile, "utf-8"));
+      raw = readFileSync5(mappingFile, "utf-8");
     } catch (err) {
       throw new Error(
         `Failed to read --resource-mapping file '${mappingFile}': ` + (err instanceof Error ? err.message : String(err))
       );
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error(
-        `--resource-mapping file '${mappingFile}' must be a JSON object {logicalId: physicalId}`
-      );
+    const parsed = parseMappingJson(raw, `--resource-mapping file '${mappingFile}'`);
+    for (const [key, value] of Object.entries(parsed)) {
+      map.set(key, value);
     }
+  }
+  if (mappingInline) {
+    const parsed = parseMappingJson(mappingInline, "--resource-mapping-inline");
     for (const [key, value] of Object.entries(parsed)) {
-      if (typeof value !== "string") {
-        throw new Error(
-          `--resource-mapping: value for '${key}' must be a string, got ${typeof value}`
-        );
-      }
       map.set(key, value);
     }
   }
@@ -34247,6 +34536,27 @@ function parseResourceOverrides(flags, mappingFile) {
   }
   return map;
 }
+function parseMappingJson(raw, source) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${source} as JSON: ` + (err instanceof Error ? err.message : String(err))
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${source} must be a JSON object {logicalId: physicalId}`);
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "string") {
+      throw new Error(`${source}: value for '${key}' must be a string, got ${typeof value}`);
+    }
+    out[key] = value;
+  }
+  return out;
+}
 function readCdkPath(resource) {
   const meta = resource.Metadata;
   if (!meta)
@@ -34347,7 +34657,10 @@ function createImportCommand() {
     []
   ).option(
     "--resource-mapping <file>",
-    "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set."
+    "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline."
+  ).option(
+    "--resource-mapping-inline <json>",
+    "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string \u2014 useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping."
   ).option(
     "--auto",
     "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).",
@@ -34393,7 +34706,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command13();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.23.2");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.25.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());