@go-to-k/cdkd 0.268.0 → 0.268.2

package/dist/{deploy-engine-B5cRuFij.js → deploy-engine-BEjF-h_6.js}

@@ -102,6 +102,24 @@ var SynthesisError = class SynthesisError extends CdkdError {
 	}
 };
 /**
+* Control-flow signal: the user declined a pre-provisioning confirmation
+* prompt, so the deploy must unwind WITHOUT being reported as a failure.
+*
+* Raised from `DeployEngineOptions.onCurrentStateLoaded` (the post-lock
+* gate the `--prefix-user-supplied-names` migration check runs in). The
+* engine does not catch it — it propagates out of `deploy()` through the
+* usual `finally`, which releases the lock and stops the renderer — and the
+* deploy CLI catches it and returns quietly instead of logging an error or
+* recording a FAILED run event. Nothing has been provisioned at that point.
+*/
+var DeployCancelledError = class DeployCancelledError extends CdkdError {
+	constructor(message = "Deployment cancelled by user") {
+		super(message, "DEPLOY_CANCELLED");
+		this.name = "DeployCancelledError";
+		Object.setPrototypeOf(this, DeployCancelledError.prototype);
+	}
+};
+/**
 * Asset errors
 */
 var AssetError = class AssetError extends CdkdError {
@@ -7648,12 +7666,26 @@ var ReplacementRulesRegistry = class {
 //#endregion
 //#region src/deployment/retryable-errors.ts
 /**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* an AWS service rejecting a call because a just-created IAM entity (role,
+* trust policy, inline policy, instance profile, principal) has not propagated
+* to that service's authorization layer yet.
+*
+* Kept as its own array — and composed back into the full transient table
+* below — so there is exactly ONE list per pattern (no parallel classifier to
+* drift). It exists because this class has a materially different RECOVERY
+* SHAPE from the other transient errors: it resolves in single-digit seconds,
+* so `withRetry` polls it on a dense sub-second schedule instead of the
+* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
+* for long resource-state transitions, and wrong here — see
+* {@link file://../deployment/retry.ts}).
+*
+* When adding a new pattern: put it here if the fix is "wait a moment and ask
+* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
+* misfiled entry only changes the retry CADENCE, never whether the error is
+* retryable at all.
+*/
+const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"cannot be assumed",
 	"Firehose is unable to assume role",
 	"is unable to assume provided role",
@@ -7664,12 +7696,6 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Role validation failed",
 	"does not have required permissions",
 	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
 	"Invalid principal in policy",
 	"Policy Error: PrincipalNotFound",
 	"Invalid value for the parameter Policy",
@@ -7677,15 +7703,30 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Caught ServiceAccessDeniedException",
 	"permissions required to assume the role",
 	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
 	"Cannot access stream",
 	"Please ensure the role can perform",
 	"KMS key is invalid for CreateGrant",
 	"Policy contains a statement with one or more invalid principals",
 	"Invalid IAM Instance Profile",
 	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
+	"Failed to authorize instance profile"
+];
+/**
+* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* transient failures whose recovery window is either long (SQS's 60s same-name
+* cooldown, a resource still leaving a Pending/Creating state) or genuinely
+* load-related (throttling), where hammering AWS with dense retries is harmful
+* and exponential backoff is the correct shape.
+*/
+const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"conflicting conditional operation",
+	"scheduled for deletion",
 	"Could not deliver test message",
 	"wait 60 seconds",
 	"concurrent update operation",
@@ -7693,6 +7734,16 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Rate exceeded"
 ];
 /**
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*
+* Composed from the two halves above so retryability has ONE source of truth
+* while `withRetry` can still pick a per-class backoff cadence.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
+/**
 * HTTP status codes that always indicate a transient failure worth retrying.
 * 429 = Too Many Requests (throttle), 503 = Service Unavailable.
 */
@@ -7762,6 +7813,24 @@ function isRetryableTransientError(error, message) {
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
+* True when the message is a just-created-IAM-entity propagation rejection
+* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
+*
+* This does NOT decide retryability — every pattern it matches is already in
+* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
+* `withRetry` polls this class densely (sub-second initial delay, low cap)
+* because IAM propagation resolves in single-digit seconds, whereas the
+* generic exponential schedule is tuned for throttling and long resource-state
+* transitions.
+*
+* Deliberately message-only (no error-object inspection): the propagation
+* signal is always carried in the vendor's message text, and cdkd wraps the
+* original error in a `ProvisioningError` that preserves it.
+*/
+function isIamPropagationError(message) {
+	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
 * Match the "already exists" name-collision signature raised when a create
 * targets a physical name still held by another resource (or by the same
 * name's not-yet-released tombstone after an async delete).
@@ -7820,6 +7889,48 @@ function isRecreateRetryableError(message) {
 * in isolation. The retryable-error classifier itself lives in
 * `./retryable-errors.ts`.
 */
+/**
+* Initial backoff for the IAM-propagation error class (issue: EC2 instance
+* launches burning ~10s of backoff waiting on a fresh instance profile).
+*
+* cdkd creates an `AWS::IAM::InstanceProfile` and issues `RunInstances` ~2.8s
+* later; CloudFormation and Terraform are slow enough between resources that
+* IAM has propagated by the time they call, cdkd outruns it. The measured
+* failure recovers in single-digit seconds, so the first re-probe should be
+* sub-second rather than the generic 1s.
+*/
+const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
+/**
+* Cap for the IAM-propagation backoff. Once the ramp reaches this value the
+* schedule stays FLAT — the whole point is a tight, predictable probe grid
+* across the window in which propagation completes, so the worst-case
+* overshoot is ~2s instead of the generic schedule's up-to-8s.
+*
+* Not lower than 2s on purpose: the retried call is usually a mutating,
+* tightly-rate-limited API (`RunInstances` refills ~2 req/s per account), and
+* the retry runs per-resource in parallel — three instances polling at 1s
+* would sit at 3 req/s and trade an IAM stall for a throttle stall. (If a
+* throttle DOES happen, its error classifies as non-propagation and the
+* generic exponential schedule takes over for that attempt, which is exactly
+* the desired self-correction.)
+*/
+const IAM_PROPAGATION_MAX_DELAY_MS = 2e3;
+/**
+* Retry budget for the IAM-propagation class.
+*
+* A denser schedule must NOT shrink the window in which propagation can still
+* be caught — that would trade latency for flakiness. The generic default
+* (1s/2s/4s/8s then capped, 8 retries) sleeps 47s in total, so the dense
+* schedule is given enough retries to cover at least as long:
+*
+*   0.25 + 0.5 + 1 + 2 x 23 = 47.75s over 26 retries
+*
+* Probe grid (seconds after the first failure): 0.25, 0.75, 1.75, 3.75, then
+* every 2s out to 47.75 — versus the generic 1, 3, 7, 15, 23, 31, 39, 47.
+* From 3.75s onwards the dense grid is strictly ahead, and it never lags the
+* generic one by more than 0.75s in the early band.
+*/
+const IAM_PROPAGATION_MAX_RETRIES = 26;
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
 * Run `operation`, retrying transient failures with exponential backoff
@@ -7828,6 +7939,20 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
 *   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
 *
+* IAM-propagation failures (see `isIamPropagationError`) instead use the dense
+* schedule 0.25s -> 0.5s -> 1s -> 2s -> 2s ... over
+* {@link IAM_PROPAGATION_MAX_RETRIES} retries (cumulative 47.75s), because that
+* class resolves in single-digit seconds and the generic schedule's coarse
+* 4s/8s steps overshoot it. The dense schedule applies ONLY when the caller
+* left the schedule at its defaults — a caller that passed its own
+* `maxRetries` / `initialDelayMs` / `maxDelayMs` / `isRetryable` picked that
+* schedule deliberately (e.g. the DELETE path's 3 x 5s, or the delete-then-
+* re-create sites' ~64s budget covering SQS's 60s name cooldown) and gets it
+* verbatim.
+*
+* The class is re-evaluated per attempt, so a propagation retry that runs into
+* a throttle backs OFF exponentially for that attempt instead of hammering.
+*
 * Non-retryable errors are rethrown immediately. The transient-error
 * classifier is `isRetryableTransientError` from ./retryable-errors.ts.
 */
@@ -7836,15 +7961,20 @@ async function withRetry(operation, logicalId, opts = {}) {
 	const initialDelayMs = opts.initialDelayMs ?? 1e3;
 	const maxDelayMs = opts.maxDelayMs ?? 8e3;
 	const sleep = opts.sleep ?? defaultSleep;
+	const defaultSchedule = opts.maxRetries === void 0 && opts.initialDelayMs === void 0 && opts.maxDelayMs === void 0 && opts.isRetryable === void 0;
+	const attemptCeiling = defaultSchedule ? Math.max(maxRetries, 26) : maxRetries;
 	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		const retryable = opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message);
+		const propagation = defaultSchedule && isIamPropagationError(message);
+		const attemptLimit = propagation ? 26 : maxRetries;
+		if (!retryable || attempt >= attemptLimit) throw error;
+		const delay = propagation ? Math.min(250 * Math.pow(2, attempt), IAM_PROPAGATION_MAX_DELAY_MS) : Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
 			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
 			await sleep(Math.min(1e3, delay - waited));
@@ -7908,6 +8038,30 @@ function describeTypeWithThrottleRetry(resourceType, client) {
 		...describeTypeRetryDelays.sleep ? { sleep: describeTypeRetryDelays.sleep } : {}
 	});
 }
+/**
+* Resource types that have NO CloudFormation registry schema, so
+* `DescribeType` can only ever fail for them:
+*
+* - `Custom::<Name>` — the two-segment form the `TypeName` parameter
+*   rejects outright at validation time.
+* - `AWS::CloudFormation::CustomResource` — the generic custom-resource
+*   alias; replacement semantics are handler-driven, not schema-driven.
+* - `AWS::CDK::Metadata` — the CDK-injected construct-tree marker. It is a
+*   synth-only sentinel that cdkd never provisions (the deploy pre-flight,
+*   the diff, `synth`, `import` and `export` all filter it), yet the
+*   create-only schema PREFETCH iterated the raw template type set and so
+*   issued a guaranteed-to-fail `DescribeType` for it on EVERY deploy —
+*   burning one API call and emitting a "Grant cloudformation:DescribeType"
+*   warning that named a pseudo-resource the user cannot act on.
+*
+* Callers must short-circuit on this predicate rather than paying the round
+* trip plus the misleading warning. Kept next to
+* {@link describeTypeWithThrottleRetry} so every DescribeType-backed
+* resolver shares ONE list instead of re-deriving its own inline literal.
+*/
+function hasNoRegistrySchema(resourceType) {
+	return resourceType === "AWS::CDK::Metadata" || resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
+}
 
 //#endregion
 //#region src/provisioning/create-only-properties.ts
@@ -7971,7 +8125,7 @@ const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 * (a transient throttle must not poison the deploy's replacement detection).
 */
 function getCreateOnlyPropertyPaths(resourceType) {
-	if (isCustomResourceType(resourceType)) return Promise.resolve([]);
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve([]);
 	const cached = createOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
 	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
@@ -7984,15 +8138,6 @@ function getCreateOnlyPropertyPaths(resourceType) {
 	return entry;
 }
 /**
-* True for the two custom-resource type shapes CloudFormation accepts:
-* `AWS::CloudFormation::CustomResource` and anything under the `Custom::`
-* prefix. Neither has a registry schema, so schema-driven lookups
-* (DescribeType) must be skipped for them.
-*/
-function isCustomResourceType(resourceType) {
-	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
-}
-/**
 * Decide whether a change to top-level property `topLevelKey` requires
 * replacement per the schema's createOnly paths.
 *
@@ -11228,6 +11373,7 @@ const writeOnlyPropertiesCache = /* @__PURE__ */ new Map();
 * DescribeType (a transient throttle must not poison the deploy).
 */
 function getTopLevelWriteOnlyProperties(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(/* @__PURE__ */ new Set());
 	const cached = writeOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
 	const entry = fetchTopLevelWriteOnlyProperties(resourceType).catch((error) => {
@@ -11793,7 +11939,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ZylgRJOY.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-gaXfXSH0.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17505,7 +17651,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.268.0";
+	return "0.268.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -17609,11 +17755,33 @@ var DeploymentEventsStore = class {
 		}
 		if (this.events.length === 0) return;
 		await this.enqueueWrite(async () => {
+			const indexRead = this.readIndexRuns();
+			indexRead.catch(() => {});
 			await this.doFlush();
-			const keptRunIds = await this.updateIndex(result);
-			await this.pruneSupersededRunFiles(keptRunIds);
+			await this.writeIndexAndPrune(result, await indexRead);
 		});
 	}
+	/**
+	* Second half of {@link finalize}'s write: build + PUT the index, then
+	* delete the run streams that fell out of the retained window.
+	*
+	* The prune's LIST is issued concurrently with the index PUT — the cutoff
+	* is derived from `runs` (already known before the PUT), the LIST is
+	* read-only, and the DELETE still happens strictly AFTER the PUT resolves.
+	* So the on-S3 ordering is unchanged (a stream is only deleted once the
+	* index that dropped it is durable); only the round trip is overlapped.
+	*/
+	async writeIndexAndPrune(result, existingRuns) {
+		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
+		const keptRunIds = runs.map((r) => r.runId);
+		const willPrune = keptRunIds.length >= 20;
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
+		staleKeysRead?.catch(() => {});
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		if (!staleKeysRead) return;
+		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
+	}
 	/** Await any in-flight async flushes (used by tests). */
 	async drain() {
 		await this.writeChain;
@@ -17644,27 +17812,40 @@ var DeploymentEventsStore = class {
 		this.persistedCount = snapshotCount;
 	}
 	/**
-	* Prepend this run's summary to `deployments/index.json`, truncated to
-	* the last {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs. Read-modify-
-	* write WITHOUT optimistic locking — last-writer-wins (documented
-	* trade-off; the per-run `.jsonl` files are the source of truth).
+	* READ half of the index read-modify-write. Returns the currently indexed
+	* run summaries, or an empty list when the index is absent / corrupt /
+	* unreadable (in which case the write half rebuilds from this run alone —
+	* the .jsonl files remain readable directly via `cdkd events --run`).
 	*
-	* Returns the run ids retained in the index (newest-first), which the
-	* caller feeds to {@link pruneSupersededRunFiles} so the `.jsonl` files
-	* stay bounded to the same window as the index.
+	* Split out of the former single `updateIndex` so {@link finalize} can
+	* issue it CONCURRENTLY with the event-stream flush: the two touch
+	* different objects and the read does not depend on the flush.
 	*/
-	async updateIndex(result) {
+	async readIndexRuns() {
 		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		let existingRuns = [];
 		try {
 			const raw = await this.backend.getRawObject(key);
 			if (raw !== null) {
 				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) existingRuns = parsed.runs;
+				if (Array.isArray(parsed.runs)) return parsed.runs;
 			}
 		} catch (err) {
 			this.logger.debug(`Deployment-events index unreadable, rewriting: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		return [];
+	}
+	/**
+	* MODIFY half of the index read-modify-write (pure): prepend this run's
+	* summary to `existingRuns`, truncated to the last
+	* {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs. No optimistic locking —
+	* last-writer-wins (documented trade-off; the per-run `.jsonl` files are
+	* the source of truth).
+	*
+	* `runs` (newest-first) doubles as the retained-run window that
+	* {@link pruneSupersededRunFiles} bounds the `.jsonl` files to.
+	*/
+	buildIndexUpdate(result, existingRuns) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
 		const runs = [{
 			runId: this.runId,
 			command: this.command,
@@ -17674,15 +17855,17 @@ var DeploymentEventsStore = class {
 			result,
 			eventCount: this.persistedCount
 		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
-		const file = {
-			indexVersion: 1,
-			stackName: this.stackName,
-			region: this.region,
-			runs,
-			lastModified: Date.now()
+		return {
+			key,
+			file: {
+				indexVersion: 1,
+				stackName: this.stackName,
+				region: this.region,
+				runs,
+				lastModified: Date.now()
+			},
+			runs
 		};
-		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
-		return runs.map((r) => r.runId);
 	}
 	/**
 	* Self-bounding prune (issue #885): delete `{runId}.jsonl` streams that
@@ -17699,12 +17882,15 @@ var DeploymentEventsStore = class {
 	* runs finalized while it ran — an extreme edge that self-heals anyway,
 	* since the whole JSONL body is re-PUT on that run's next flush / finalize
 	* (S3 has no append; each flush rewrites the full stream).
+	*
+	* `dirPrefix` + `keys` are supplied by the caller so the LIST can be
+	* overlapped with the index PUT (see {@link writeIndexAndPrune}); the
+	* DELETE this method issues still runs strictly after that PUT.
 	*/
-	async pruneSupersededRunFiles(keptRunIds) {
+	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
 		if (keptRunIds.length < 20) return;
 		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
-		const stale = (await this.backend.listRawKeys(dirPrefix)).filter((k) => {
+		const stale = keys.filter((k) => {
 			const runId = runIdFromJsonlKey(k, dirPrefix);
 			return runId !== null && runId < cutoff;
 		});
@@ -18314,7 +18500,7 @@ var DeployEngine = class {
 	async doDeploy(stackName, template) {
 		const startTime = Date.now();
 		this.logger.debug(`Starting deployment for stack: ${stackName}`);
-		for (const type of new Set(Object.values(template.Resources).map((r) => r.Type))) getCreateOnlyPropertyPaths(type).catch(() => {});
+		for (const type of new Set(Object.values(template.Resources).map((r) => r.Type).filter((type) => !hasNoRegistrySchema(type)))) getCreateOnlyPropertyPaths(type).catch(() => {});
 		await this.lockManager.acquireLockWithRetry(stackName, this.stackRegion, void 0, "deploy");
 		const renderer = getLiveRenderer();
 		renderer.start();
@@ -18341,6 +18527,7 @@ var DeployEngine = class {
 			const currentEtag = currentStateData?.etag;
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
+			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
 			try {
 				const journal = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
 				if (journal && journal.segments.length > 0) {
@@ -18454,8 +18641,7 @@ var DeployEngine = class {
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
-			await this.deleteRollbackJournalBestEffort(stackName);
-			if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, newState.outputs ?? {});
+			await Promise.all([this.deleteRollbackJournalBestEffort(stackName), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, newState.outputs ?? {}) : Promise.resolve()]);
 			const durationMs = Date.now() - startTime;
 			const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 			return {
@@ -19510,5 +19696,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { WorkGraph as $, MissingCdkCliError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LockError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalMigrateError as Xt, rebuildClientForBucketRegion as Y, LocalInvokeBuildError as Yt, AssetPublisher as Z, LocalStartServiceError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, StackHasActiveImportsError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, SynthesisError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, normalizeAwsError as dn, buildDockerImage as dt, NestedStackChildDirectDestroyError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, withErrorHandling as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceUpdateNotSupportedError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, formatError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ProvisioningError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackTerminationProtectionError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, __exportAll as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ResourceTimeoutError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StateError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, PartialFailureError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, isCdkdError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-B5cRuFij.js.map
+export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
+//# sourceMappingURL=deploy-engine-BEjF-h_6.js.map