@go-to-k/cdkd 0.268.2 → 0.268.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-BEjF-h_6.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine--qUEKkTR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-gaXfXSH0.js";
+import { t as ASGProvider } from "./asg-provider-iWNOeyib.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -404,6 +404,28 @@ function validateWaitFlags(opts) {
 	if (opts.wait === false && opts.fullWait === true) throw new Error("--no-wait and --full-wait cannot be combined: --no-wait skips stabilization waits, --full-wait adds them. Pick one.");
 }
 /**
+* Validate the wait-flag pair and project it onto the process env the
+* providers read. One helper instead of three separate lines in deploy.ts
+* so the validation, the two mode envs, and the availability marker cannot
+* drift apart individually (issue #1291 item 6 — the wiring had no unit
+* coverage because it lived inline in the deploy command's action).
+*
+* - `CDKD_NO_WAIT` — set when `--no-wait` was passed; providers skip
+*   convenience stabilization waits.
+* - `CDKD_FULL_WAIT` — set when `--full-wait` was passed; providers add
+*   the CloudFormation-side waits cdkd skips by default.
+* - `CDKD_WAIT_FLAGS_AVAILABLE` — set unconditionally by commands that
+*   DECLARE the wait flags (today: deploy). Providers gate flag-mentioning
+*   hints on it, so `cdkd drift --revert` reaching the same provider code
+*   never advertises a flag drift does not accept (issue #1291 item 1).
+*/
+function applyWaitFlagEnv(opts) {
+	validateWaitFlags(opts);
+	process.env["CDKD_WAIT_FLAGS_AVAILABLE"] = "true";
+	if (opts.wait === false) process.env["CDKD_NO_WAIT"] = "true";
+	if (opts.fullWait === true) process.env["CDKD_FULL_WAIT"] = "true";
+}
+/**
 * Drop the CDK-injected defensive `DependsOn` edges from VPC Lambdas (and
 * adjacent IAM Role / Policy / Lambda::Url / EventSourceMapping resources)
 * onto the private subnet's `DefaultRoute` / `RouteTableAssociation`. CDK
@@ -8446,7 +8468,9 @@ var LambdaFunctionProvider = class {
 		try {
 			await waitUntilFunctionUpdatedV2({
 				client: this.lambdaClient,
-				maxWaitTime: this.functionUpdateMaxWaitSeconds
+				maxWaitTime: this.functionUpdateMaxWaitSeconds,
+				minDelay: 1,
+				maxDelay: 5
 			}, { FunctionName: functionName });
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -15619,11 +15643,12 @@ var EC2Provider = class {
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
-				await Promise.all([
+				const firstRejection = (await Promise.allSettled([
 					this.applyTags(groupId, properties, logicalId),
 					this.authorizeInlineIngress(groupId, ingressRules),
 					this.applyInlineEgress(groupId, egressRules)
-				]);
+				])).find((r) => r.status === "rejected");
+				if (firstRejection) throw firstRejection.reason;
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
@@ -16978,6 +17003,15 @@ var EC2Provider = class {
 		}
 		if (instance.Placement?.Tenancy !== void 0) result["Tenancy"] = instance.Placement.Tenancy;
 		if (instance.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = instance.IamInstanceProfile.Arn;
+		else if (process.env["CDKD_NO_WAIT"] === "true" && instance.State?.Name === "pending") try {
+			const live = (await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+				Name: "instance-id",
+				Values: [physicalId]
+			}] }))).IamInstanceProfileAssociations?.find((a) => a.State === "associated" || a.State === "associating");
+			if (live?.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = live.IamInstanceProfile.Arn;
+		} catch (error) {
+			this.logger.warn(`Could not backfill IamInstanceProfile for ${physicalId} during the --no-wait capture (${error instanceof Error ? error.message : String(error)}); the field is omitted from the observed snapshot`);
+		}
 		const volumeIds = (instance.BlockDeviceMappings ?? []).filter((m) => m.Ebs?.VolumeId !== void 0).map((m) => m.Ebs.VolumeId);
 		let volumesById = /* @__PURE__ */ new Map();
 		if (volumeIds.length > 0) try {
@@ -20047,6 +20081,14 @@ var CloudFrontOACProvider = class {
 	* `assertRegionMatch()` confirms the client is pointed at the region the
 	* resource was created in (a region mismatch would otherwise silently
 	* "succeed" while leaving the real resource behind).
+	*
+	* A `Get` that succeeds but carries no `ETag` is a hard error here for the
+	* same reason it is in {@link update}: `IfMatch: undefined` reaches AWS as
+	* a missing required parameter, and the resulting SDK/AWS rejection says
+	* nothing about the `Get` being what came back short. On the DELETE path
+	* that opacity is worse than on update — the failure surfaces during
+	* `cdkd destroy`, where the user's next question is "is the OAC still
+	* there?", so the message has to name the actual cause.
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CloudFront Origin Access Control ${logicalId}: ${physicalId}`);
@@ -20062,6 +20104,7 @@ var CloudFrontOACProvider = class {
 				}
 				throw error;
 			}
+			if (!etag) throw new Error("GetOriginAccessControl did not return ETag");
 			await this.cloudFrontClient.send(new DeleteOriginAccessControlCommand({
 				Id: physicalId,
 				IfMatch: etag
@@ -20155,6 +20198,18 @@ var CloudFrontOACProvider = class {
 	* copy that exists to (a) fail loudly when a required field is missing
 	* rather than letting the SDK reject with an opaque serialization error,
 	* and (b) keep unknown extra keys out of the request.
+	*
+	* All four required fields are checked for a NON-EMPTY string, not merely
+	* for `typeof === 'string'`. `''` is the shape an unresolved intrinsic or a
+	* `Fn::Sub` over a missing value most often collapses into, and CloudFront
+	* rejects it just as surely as it rejects an absent field — so letting it
+	* through would defeat the whole point of (a): the user would get AWS's
+	* `InvalidArgument` instead of a message naming the field cdkd could see
+	* was blank. The three type/behavior fields are additionally CFn enums
+	* (`s3` / `mediastore` / `lambda` / `mediapackagev2`; `always` / `never` /
+	* `no-override`; `sigv4`), for which the empty string is never a member.
+	* `Description` is deliberately not in this set — it is genuinely optional
+	* and `''` is a legitimate value that clears it.
 	*/
 	toSdkConfig(value, logicalId, resourceType, physicalId) {
 		const config = value ?? {};
@@ -20162,11 +20217,12 @@ var CloudFrontOACProvider = class {
 		const originType = config["OriginAccessControlOriginType"];
 		const signingBehavior = config["SigningBehavior"];
 		const signingProtocol = config["SigningProtocol"];
+		const nonEmpty = (value) => typeof value === "string" && value.length > 0;
 		const missing = [
-			typeof name === "string" && name.length > 0 ? void 0 : "Name",
-			typeof originType === "string" ? void 0 : "OriginAccessControlOriginType",
-			typeof signingBehavior === "string" ? void 0 : "SigningBehavior",
-			typeof signingProtocol === "string" ? void 0 : "SigningProtocol"
+			nonEmpty(name) ? void 0 : "Name",
+			nonEmpty(originType) ? void 0 : "OriginAccessControlOriginType",
+			nonEmpty(signingBehavior) ? void 0 : "SigningBehavior",
+			nonEmpty(signingProtocol) ? void 0 : "SigningProtocol"
 		].filter((field) => field !== void 0);
 		if (missing.length > 0) throw new ProvisioningError(`CloudFront Origin Access Control ${logicalId}: OriginAccessControlConfig is missing required field(s): ${missing.join(", ")}`, resourceType, logicalId, physicalId);
 		const description = config["Description"];
@@ -22449,19 +22505,19 @@ var ECSProvider = class {
 			try {
 				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"]);
 			} catch (waitError) {
+				const cleanupCluster = properties["Cluster"];
+				const clusterArg = cleanupCluster ? ` --cluster ${cleanupCluster}` : "";
 				try {
 					await client.send(new DeleteServiceCommand({
 						cluster: properties["Cluster"],
 						service: service.serviceArn,
 						force: true
 					}));
-					this.logger.debug(`Cleaned up partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed`);
+					this.logger.warn(`Deleted partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed, so the next deploy's CreateService does not collide on the name. Its stopped tasks remain inspectable for about an hour: aws ecs list-tasks${clusterArg} --desired-status STOPPED`);
 				} catch (cleanupError) {
-					const cleanupCluster = properties["Cluster"];
-					const clusterArg = cleanupCluster ? ` --cluster ${cleanupCluster}` : "";
 					this.logger.warn(`Failed to clean up partially-created ECS service ${logicalId} (${service.serviceArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`);
 				}
-				throw waitError;
+				throw new Error(`ECS service ${logicalId} did not reach steady state under --full-wait: ${waitError instanceof Error ? waitError.message : String(waitError)}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): aws ecs list-tasks${clusterArg} --desired-status STOPPED, then aws ecs describe-tasks${clusterArg} --tasks <task-arn> --query 'tasks[].[stoppedReason,containers[].reason]'`, { cause: waitError });
 			}
 			return {
 				physicalId: service.serviceArn,
@@ -22510,7 +22566,8 @@ var ECSProvider = class {
 			return;
 		}
 		const clusterArg = cluster ? ` --cluster ${cluster}` : "";
-		this.logger.info(`ECS service ${logicalId} accepted (not waiting for steady state; pass --full-wait to wait). To wait manually: aws ecs wait services-stable${clusterArg} --services ${serviceRef}`);
+		const fullWaitHint = process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true" ? "; pass --full-wait to wait" : "";
+		this.logger.info(`ECS service ${logicalId} accepted (not waiting for steady state${fullWaitHint}). To wait manually: aws ecs wait services-stable${clusterArg} --services ${serviceRef}`);
 	}
 	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating ECS service ${logicalId}: ${physicalId}`);
@@ -43056,13 +43113,11 @@ async function deployCommand(stacks, options) {
 	}
 	warnIfDeprecatedRegion(options);
 	validateResourceTimeouts(options);
-	validateWaitFlags(options);
+	applyWaitFlagEnv(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	if (!options.wait) process.env["CDKD_NO_WAIT"] = "true";
-	if (options.fullWait) process.env["CDKD_FULL_WAIT"] = "true";
 	warnDeprecatedNoPrefixCliFlag();
 	const skipPrefix = resolveSkipPrefix({ prefixUserSuppliedNames: options.prefixUserSuppliedNames });
 	if (skipPrefix) logger.debug("Skipping stack-name prefix on user-supplied physical names (default since v0.94.0)");
@@ -43921,7 +43976,9 @@ async function retireCloudFormationStack(options) {
 			}
 			if (updateRan) await waitUntilStackUpdateComplete({
 				client: cfnClient,
-				maxWaitTime: 1800
+				maxWaitTime: 1800,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: cfnStackName });
 		} finally {
 			const allCleanups = [...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups];
@@ -43937,7 +43994,9 @@ async function retireCloudFormationStack(options) {
 	await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
 	await waitUntilStackDeleteComplete({
 		client: cfnClient,
-		maxWaitTime: 1800
+		maxWaitTime: 1800,
+		minDelay: 5,
+		maxDelay: 10
 	}, { StackName: cfnStackName });
 	logger.info(`✓ CloudFormation stack '${cfnStackName}' retired. AWS resources are now solely managed by cdkd.`);
 	return { outcome: modified ? "retired" : "no-template-change" };
@@ -48130,7 +48189,9 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 		try {
 			await waitUntilChangeSetCreateComplete({
 				client: cfnClient,
-				maxWaitTime: 600
+				maxWaitTime: 600,
+				minDelay: 2,
+				maxDelay: 5
 			}, {
 				StackName: stackName,
 				ChangeSetName: changeSetName
@@ -48159,7 +48220,9 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 			}));
 			await waitUntilStackImportComplete({
 				client: cfnClient,
-				maxWaitTime: 3600
+				maxWaitTime: 3600,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: stackName });
 		} catch (err) {
 			const failureSummary = await collectImportFailureSummary(cfnClient, stackName).catch(() => "");
@@ -48259,7 +48322,9 @@ async function flipStackToUpdateComplete(cfnClient, cfnStackName, parameters) {
 	}));
 	await waitUntilStackUpdateComplete({
 		client: cfnClient,
-		maxWaitTime: 1800
+		maxWaitTime: 1800,
+		minDelay: 5,
+		maxDelay: 10
 	}, { StackName: cfnStackName });
 }
 /**
@@ -48858,7 +48923,9 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 		try {
 			await waitUntilChangeSetCreateComplete({
 				client: cfnClient,
-				maxWaitTime: 600
+				maxWaitTime: 600,
+				minDelay: 2,
+				maxDelay: 5
 			}, {
 				StackName: stackName,
 				ChangeSetName: changeSetName
@@ -48887,7 +48954,9 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 			}));
 			await waitUntilStackUpdateComplete({
 				client: cfnClient,
-				maxWaitTime: 3600
+				maxWaitTime: 3600,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: stackName });
 		} catch (err) {
 			await cfnClient.send(new DeleteChangeSetCommand({
@@ -62702,7 +62771,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;