@go-to-k/cdkd 0.267.16 → 0.267.18

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-BjGr3po1.js";
+import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-D_KHeGjJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Ge0MCN5U.js";
+import { t as ASGProvider } from "./asg-provider-C6uxCStq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -30,7 +30,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
-import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
+import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
@@ -45,7 +45,7 @@ import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$8, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
@@ -348,7 +348,8 @@ function ensureWarnAfter(opts) {
 }
 /**
 * Skip waiting for async-stabilization resources (CloudFront, RDS,
-* ElastiCache, NAT Gateway, Lambda MicroVM Image) on deploy. Setting the flag mutates
+* ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda
+* MicroVM Image) on deploy. Setting the flag mutates
 * `process.env.CDKD_NO_WAIT='true'`; provider code checks that env
 * var, not the parsed CLI option (this lets nested call paths — e.g.
 * asset publish, lifecycle hooks — see the same setting without
@@ -360,7 +361,48 @@ function ensureWarnAfter(opts) {
 * destroy paths don't wait to begin with — so `destroy --no-wait`
 * would be a no-op flag.
 */
-const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway, Lambda MicroVM Image)");
+const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image)");
+/**
+* Opt in to the stabilization waits cdkd deliberately SKIPS by default:
+* the ones where CloudFormation waits and Terraform does not. Today that
+* is ECS Service steady state (create and update).
+*
+* `--no-wait`, the default, and `--full-wait` are three points on one
+* axis, from least to most waiting:
+*
+* - `--no-wait`      skip the stabilization waits cdkd performs by default
+* - (default)        wait where CloudFormation and Terraform agree
+* - `--full-wait`    also wait where only CloudFormation waits
+*
+* Which one is right depends on whether anything downstream needs the
+* resource to actually be serving, NOT on where the deploy runs: cutting
+* billed CI minutes is a legitimate reason to pass `--no-wait` in CI, and
+* a local smoke test is a legitimate reason to pass `--full-wait` on a
+* laptop.
+*
+* Setting the flag mutates `process.env.CDKD_FULL_WAIT='true'`, the same
+* mechanism `--no-wait` uses, so nested call paths see it without
+* threading it through every signature.
+*
+* Mutually exclusive with `--no-wait` (see {@link validateWaitFlags}).
+* Per-resource-type wait control is deliberately NOT expressible with
+* these two whole-run flags; that would be a separate feature.
+*
+* Deploy-only, like `--no-wait`.
+*/
+const fullWaitOption = new Option("--full-wait", "Also wait for stabilizations cdkd skips by default, matching CloudFormation (ECS Service steady state)");
+/**
+* Reject `--no-wait --full-wait`. They sit at opposite ends of one axis,
+* so a combination has no coherent meaning: the user is asking to both
+* skip waits and add waits in the same run.
+*
+* Note the Commander shape: `--no-wait` is the negation form of a boolean
+* `wait` option, so it surfaces as `wait === false` rather than as a
+* `noWait` key.
+*/
+function validateWaitFlags(opts) {
+	if (opts.wait === false && opts.fullWait === true) throw new Error("--no-wait and --full-wait cannot be combined: --no-wait skips stabilization waits, --full-wait adds them. Pick one.");
+}
 /**
 * Drop the CDK-injected defensive `DependsOn` edges from VPC Lambdas (and
 * adjacent IAM Role / Policy / Lambda::Url / EventSourceMapping resources)
@@ -537,6 +579,7 @@ const deployOptions = [
 	new Option("--no-capture-observed-state", "Skip capturing AWS-current properties after each create/update (adds a fire-and-forget readCurrentState per resource so cdkd drift can compare against the real deploy-time AWS snapshot instead of the template). On by default. Disable when deploy speed matters more than rich drift detection — falls back to comparing against template properties (the pre-v3 behavior)."),
 	new Option("--prefix-user-supplied-names", "Opt in to LEGACY behavior: prepend the stack name to physical names the user explicitly supplied in their CDK code (e.g. `new iam.Role(this, \"X\", { roleName: \"my-role\" })` → AWS resource named `MyStack-my-role` instead of `my-role`). Since v0.94.0 the default is to NOT prefix user-supplied names — this flag restores the pre-v0.94.0 behavior on Pattern B providers (IAM Role / User / Group / InstanceProfile / ELBv2 LoadBalancer / TargetGroup). Enable via this flag, CDKD_PREFIX_USER_SUPPLIED_NAMES=true, or cdk.json context.cdkd.prefixUserSuppliedNames=true. Applies to `cdkd deploy` only.").default(false),
 	noWaitOption,
+	fullWaitOption,
 	aggressiveVpcParallelOption,
 	new Option("-e, --exclusively", "Only deploy requested stacks, do not include dependencies").default(false),
 	allowUnsupportedTypesOption,
@@ -2870,6 +2913,7 @@ var IAMManagedPolicyProvider = class {
 				attributes: { PolicyArn: policyArn }
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create IAM managed policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, policyName, cause);
 		}
@@ -14831,6 +14875,15 @@ var EC2Provider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId);
@@ -15213,7 +15266,8 @@ var EC2Provider = class {
 			const publicIp = response.PublicIp;
 			await this.applyTags(allocationId, properties, logicalId);
 			const instanceId = properties["InstanceId"];
-			if (instanceId) {
+			if (instanceId) if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
+			else {
 				await this.ec2Client.send(new AssociateAddressCommand({
 					AllocationId: allocationId,
 					InstanceId: instanceId
@@ -15240,11 +15294,16 @@ var EC2Provider = class {
 			await this.applyTagDiff(allocationId, previousProperties["Tags"], properties["Tags"]);
 			const oldInstanceId = previousProperties["InstanceId"];
 			const newInstanceId = properties["InstanceId"];
-			if (oldInstanceId !== newInstanceId) if (newInstanceId) await this.ec2Client.send(new AssociateAddressCommand({
-				AllocationId: allocationId,
-				InstanceId: newInstanceId,
-				AllowReassociation: true
-			}));
+			if (oldInstanceId !== newInstanceId) if (newInstanceId) try {
+				await this.ec2Client.send(new AssociateAddressCommand({
+					AllocationId: allocationId,
+					InstanceId: newInstanceId,
+					AllowReassociation: true
+				}));
+			} catch (error) {
+				if (process.env["CDKD_NO_WAIT"] === "true" && this.isIncorrectInstanceStateError(error)) this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${newInstanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${newInstanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${newInstanceId} --allow-reassociation`);
+				else throw error;
+			}
 			else {
 				const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
 				if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
@@ -15358,7 +15417,7 @@ var EC2Provider = class {
 					client: this.ec2Client,
 					maxWaitTime: 900,
 					minDelay: 5,
-					maxDelay: 15
+					maxDelay: 10
 				}, { NatGatewayIds: [natGatewayId] });
 				this.logger.debug(`NatGateway ${natGatewayId} is available`);
 			} else this.logger.debug(`NatGateway ${natGatewayId} created (skipping available-state wait per --no-wait)`);
@@ -15394,7 +15453,7 @@ var EC2Provider = class {
 				client: this.ec2Client,
 				maxWaitTime: 900,
 				minDelay: 5,
-				maxDelay: 15
+				maxDelay: 10
 			}, { NatGatewayIds: [physicalId] });
 		} catch (error) {
 			this.logger.warn(`Wait for NatGateway ${physicalId} deletion did not complete cleanly: ${error instanceof Error ? error.message : String(error)} — proceeding with downstream delete steps`);
@@ -15481,6 +15540,7 @@ var EC2Provider = class {
 				...createResult.attributes && { attributes: createResult.attributes }
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
@@ -15735,6 +15795,7 @@ var EC2Provider = class {
 				...createResult.attributes && { attributes: createResult.attributes }
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
@@ -15799,14 +15860,19 @@ var EC2Provider = class {
 			const instanceId = instance.InstanceId;
 			try {
 				await this.applyTags(instanceId, properties, logicalId);
-				this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
-				await waitUntilInstanceRunning({
-					client: this.ec2Client,
-					maxWaitTime: 300,
-					minDelay: 5,
-					maxDelay: 15
-				}, { InstanceIds: [instanceId] });
-				if (iamInstanceProfile) await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
+				if (process.env["CDKD_NO_WAIT"] !== "true") {
+					this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
+					await waitUntilInstanceRunning({
+						client: this.ec2Client,
+						maxWaitTime: 300,
+						minDelay: 2,
+						maxDelay: 5
+					}, { InstanceIds: [instanceId] });
+				} else this.logger.debug(`Instance ${instanceId} launched (skipping running-state wait per --no-wait)`);
+				if (iamInstanceProfile) if (process.env["CDKD_NO_WAIT"] === "true") {
+					const profileRef = iamInstanceProfile.arn ?? iamInstanceProfile.name;
+					this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId} — and if it is missing, re-associate with: aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? `Arn=${profileRef}` : `Name=${profileRef}`}`);
+				} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
 				const attributes = {
 					InstanceId: instanceId,
@@ -16054,8 +16120,8 @@ var EC2Provider = class {
 			await waitUntilInstanceTerminated({
 				client: this.ec2Client,
 				maxWaitTime: 300,
-				minDelay: 5,
-				maxDelay: 15
+				minDelay: 2,
+				maxDelay: 5
 			}, { InstanceIds: [physicalId] });
 			this.logger.debug(`EC2 Instance ${logicalId} terminated: ${physicalId}`);
 			return;
@@ -16544,6 +16610,21 @@ var EC2Provider = class {
 		return message.includes("DependencyViolation") || message.includes("has dependencies and cannot be deleted") || message.includes("Network has some mapped public address");
 	}
 	/**
+	* AWS rejects AssociateAddress (and several other instance operations)
+	* against an instance that is not `running` / `stopped` with the
+	* `IncorrectInstanceState` code. Under --no-wait that is the expected
+	* outcome for an instance created in the same deploy, not a transient
+	* fault -- it stays true exactly until the wait --no-wait skipped would
+	* have completed.
+	*/
+	isIncorrectInstanceStateError(error) {
+		if (!(error instanceof Error)) return false;
+		const code = error.Code ?? "";
+		const name = error.name ?? "";
+		if (code === "IncorrectInstanceState" || name === "IncorrectInstanceState") return true;
+		return error.message.includes("IncorrectInstanceState");
+	}
+	/**
 	* Indirect sleep so unit tests can swap in a fake-timer-aware
 	* implementation via `vi.useFakeTimers()` without monkey-patching
 	* `setTimeout` globally.
@@ -19926,6 +20007,7 @@ var CloudFrontDistributionProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
@@ -22057,6 +22139,23 @@ var ECSProvider = class {
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			this.logger.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
+			try {
+				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"]);
+			} catch (waitError) {
+				try {
+					await client.send(new DeleteServiceCommand({
+						cluster: properties["Cluster"],
+						service: service.serviceArn,
+						force: true
+					}));
+					this.logger.debug(`Cleaned up partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed`);
+				} catch (cleanupError) {
+					const cleanupCluster = properties["Cluster"];
+					const clusterArg = cleanupCluster ? ` --cluster ${cleanupCluster}` : "";
+					this.logger.warn(`Failed to clean up partially-created ECS service ${logicalId} (${service.serviceArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`);
+				}
+				throw waitError;
+			}
 			return {
 				physicalId: service.serviceArn,
 				attributes: {
@@ -22069,6 +22168,43 @@ var ECSProvider = class {
 			throw new ProvisioningError(`Failed to create ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, serviceName, cause);
 		}
 	}
+	/**
+	* Settle an ECS Service according to the run's wait mode.
+	*
+	* cdkd does NOT wait for steady state by default (issue #1275). The three
+	* engines genuinely disagree on what "done" means for a Service:
+	* CloudFormation waits for steady state, Terraform's `aws_ecs_service`
+	* defaults `wait_for_steady_state` to false, and nothing downstream needs
+	* the service to be running (`Fn::GetAtt` yields Name / ServiceArn, both
+	* valid the instant CreateService returns). cdkd takes the fast side and
+	* documents the divergence.
+	*
+	* There is deliberately no health probe on the default path. Right after
+	* CreateService a healthy service and a doomed one are indistinguishable
+	* (`ACTIVE`, `runningCount: 0`, `rolloutState: IN_PROGRESS`); a circuit
+	* breaker failure surfaces tens of seconds to minutes later. A one-shot
+	* check would warn on every deploy AND imply a guarantee ("no warning, so
+	* the rollout was fine") it cannot support. The INFO line instead hands
+	* over the exact command that CAN answer the question.
+	*/
+	async settleService(logicalId, serviceRef, cluster) {
+		if (process.env["CDKD_FULL_WAIT"] === "true") {
+			this.logger.debug(`Waiting for ECS service ${logicalId} to reach steady state...`);
+			await waitUntilServicesStable({
+				client: this.getClient(),
+				maxWaitTime: 600,
+				minDelay: 5,
+				maxDelay: 10
+			}, {
+				cluster,
+				services: [serviceRef]
+			});
+			this.logger.debug(`ECS service ${logicalId} reached steady state`);
+			return;
+		}
+		const clusterArg = cluster ? ` --cluster ${cluster}` : "";
+		this.logger.info(`ECS service ${logicalId} accepted (not waiting for steady state; pass --full-wait to wait). To wait manually: aws ecs wait services-stable${clusterArg} --services ${serviceRef}`);
+	}
 	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating ECS service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
@@ -22110,6 +22246,7 @@ var ECSProvider = class {
 				serviceRegistries: serviceRegistriesInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, previousProperties["Tags"], properties["Tags"]);
+			await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"]);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -23127,7 +23264,14 @@ var ECSProvider = class {
 *
 * WHY: ELBv2 Create* APIs are synchronous - the CC API adds unnecessary polling
 * overhead for operations that complete immediately. This SDK provider eliminates
-* that polling and returns instantly.
+* that polling.
+*
+* "The API is synchronous" is NOT the same claim as "the resource is ready",
+* and an earlier version of this comment conflated the two. TargetGroup and
+* Listener genuinely are ready on return; a LoadBalancer comes back with
+* `State.Code: provisioning` and is not servable for another 90-180s. So
+* createLoadBalancer waits for `active` (skippable with --no-wait) while the
+* other two do not.
 */
 var ELBv2Provider = class {
 	elbv2Client;
@@ -23188,6 +23332,15 @@ var ELBv2Provider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update ELBv2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -23222,6 +23375,16 @@ var ELBv2Provider = class {
 			const lbArn = lb.LoadBalancerArn;
 			this.logger.debug(`Successfully created LoadBalancer ${logicalId}: ${lbArn}`);
 			try {
+				if (process.env["CDKD_NO_WAIT"] !== "true") {
+					this.logger.debug(`Waiting for LoadBalancer ${logicalId} to reach active state...`);
+					await waitUntilLoadBalancerAvailable({
+						client: this.getClient(),
+						maxWaitTime: 600,
+						minDelay: 5,
+						maxDelay: 10
+					}, { LoadBalancerArns: [lbArn] });
+					this.logger.debug(`LoadBalancer ${logicalId} is active`);
+				} else this.logger.debug(`LoadBalancer ${logicalId} created (skipping active-state wait per --no-wait)`);
 				const lbAttributes = properties["LoadBalancerAttributes"];
 				if (lbAttributes && lbAttributes.length > 0) {
 					await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
@@ -33342,6 +33505,15 @@ var KinesisStreamConsumerProvider = class {
 	* "use cdkd deploy --replace" suggestion.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const newConsumerName = properties["ConsumerName"];
 		const oldConsumerName = previousProperties["ConsumerName"];
 		const newStreamArn = properties["StreamARN"];
@@ -37223,6 +37395,15 @@ var FirehoseProvider = class {
 	* can `cdkd deploy --replace`.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Firehose delivery stream ${logicalId}: ${physicalId}`);
 		const destKey = this.findDestinationKey(properties);
 		const prevDestKey = this.findDestinationKey(previousProperties);
@@ -40240,6 +40421,15 @@ var S3TablesProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (resourceType === "AWS::S3Tables::Table") await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"]);
 		else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"]);
 		else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
@@ -41987,6 +42177,7 @@ var ACMCertificateProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
@@ -42524,11 +42715,13 @@ async function deployCommand(stacks, options) {
 	}
 	warnIfDeprecatedRegion(options);
 	validateResourceTimeouts(options);
+	validateWaitFlags(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region
 	});
 	if (!options.wait) process.env["CDKD_NO_WAIT"] = "true";
+	if (options.fullWait) process.env["CDKD_FULL_WAIT"] = "true";
 	warnDeprecatedNoPrefixCliFlag();
 	const skipPrefix = resolveSkipPrefix({ prefixUserSuppliedNames: options.prefixUserSuppliedNames });
 	if (skipPrefix) logger.debug("Skipping stack-name prefix on user-supplied physical names (default since v0.94.0)");
@@ -62167,7 +62360,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.18");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;