@go-to-k/cdkd 0.278.28 → 0.278.30

package/dist/{deploy-engine-Dcg1nH3d.js → deploy-engine-BLIg6xfm.js}

@@ -12407,6 +12407,33 @@ var CloudControlOperationFailedError = class CloudControlOperationFailedError ex
 function isNotFoundMessage(message) {
 	return /not\s*found|does\s*not\s*exist|no\s*such|non\s*existent|\bno\b[^.;:]{0,80}\bfound\b/i.test(message);
 }
+/**
+* When a Cloud Control operation FAILS with an authorization error whose
+* Java-SDK trailer names a service OTHER than Cloud Control itself
+* ("... (Service: SesV2, Status Code: 403, Request ID: ...)"), the rejection
+* happened inside the AWS-managed resource handler's own downstream call —
+* cdkd's credentials already authenticated to Cloud Control to start the
+* operation, so the caller's local credential setup is not the culprit. The
+* raw StatusMessage reads like a local credential problem and sends users off
+* to debug their own keys (issue #1468: the AWS::SES::EmailIdentity UPDATE
+* handler's SesV2 call 403'd reproducibly while the exact same SesV2
+* operations succeeded when invoked directly with the same credentials).
+* Returns a re-framing hint to append to the failure message, or '' when the
+* shape does not match.
+*
+* Wording constraint: the hint is appended to an error message that
+* downstream matchers test against (isNotFoundMessage above, the
+* retryable-error message table in src/deployment/retryable-errors.ts), so it
+* must not introduce a "not found" / "does not exist" / "no such" match nor
+* any retryable-pattern substring. Pinned by a unit test.
+*/
+function handlerAuthFailureHint(statusMessage) {
+	const match = /\(Service:\s*([A-Za-z0-9._-]+)[,;]\s*Status Code:\s*403[,;)]/i.exec(statusMessage);
+	if (!match) return "";
+	const service = match[1] ?? "";
+	if (/cloudcontrol/i.test(service)) return "";
+	return ` [hint: this 403 was returned by ${service} to the AWS-managed resource handler running the operation, not to cdkd directly — these credentials already passed Cloud Control's own auth to start it. If the equivalent ${service} API call succeeds with the same credentials, the resource handler itself is failing (an upstream AWS issue worth retrying later), not your local credential setup.]`;
+}
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -12557,7 +12584,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BJnh483x.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CfVwvyCi.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -12659,7 +12686,10 @@ var CloudControlProvider = class {
 			this.logger.debug(`${operation} ${logicalId}: ${progressEvent.OperationStatus} (attempt ${attempts}, next poll ${pollInterval}ms)`);
 			switch (progressEvent.OperationStatus) {
 				case "SUCCESS": return progressEvent;
-				case "FAILED": throw new CloudControlOperationFailedError(`${operation} failed for ${logicalId}: ${progressEvent.StatusMessage || "Unknown error"}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier, progressEvent.ErrorCode, operation);
+				case "FAILED": {
+					const failureMessage = progressEvent.StatusMessage || "Unknown error";
+					throw new CloudControlOperationFailedError(`${operation} failed for ${logicalId}: ${failureMessage}${handlerAuthFailureHint(failureMessage)}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier, progressEvent.ErrorCode, operation);
+				}
 				case "CANCEL_COMPLETE": throw new ProvisioningError(`${operation} cancelled for ${logicalId}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
 				case "IN_PROGRESS":
 				case "PENDING":
@@ -19051,7 +19081,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.28";
+	return "0.278.30";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21163,4 +21193,4 @@ var DeployEngine = class {
 
 //#endregion
 export { withRetry as $, getAwsClients as $t, red as A, synthesisStatusMessage as At, isTerminationProtectionPropagationError as B, stateBucketExistenceConfirmed as Bt, isStatefulRecreateTargetSync as C, normalizeAwsError as Cn, formatDockerLoginError as Ct, cyan as D, AssetManifestLoader as Dt, bold as E, runDockerStreaming as Et, ProviderRegistry as F, resolveCaptureObservedState as Ft, normalizeAwsTagsToCfn as G, findLargeInlineResources as Gt, cfnRefValueFromPhysicalId as H, CFN_TEMPLATE_BODY_LIMIT as Ht, findActionableSilentDrops as I, resolveSkipPrefix as It, readConfigString as J, AssemblyReader as Jt, resolveExplicitPhysicalId as K, uploadCfnTemplate as Kt, CloudControlProvider as L, resolveStateBucketWithDefault as Lt, IAMRoleProvider as M, getLegacyStateBucketName as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveApp as Nt, gray as O, getDockerImageBySourceHash as Ot, clearOnUpdateRemoval as P, resolveAutoAssetStorage as Pt, describeTypeWithThrottleRetry as Q, AwsClients as Qt, slowCcOperationTimeoutMs as R, resolveStateBucketWithDefaultAndSource as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, isCdkdError as Sn, buildDockerImage as St, formatResourceLine as T, __exportAll as Tn, runDockerForeground as Tt, refStateLookupFromResource as U, CFN_TEMPLATE_URL_LIMIT as Ut, IntrinsicFunctionResolver as V, warnDeprecatedNoPrefixCliFlag as Vt, WAFv2WebACLProvider as W, MIGRATE_TMP_PREFIX as Wt, applyRoleArnIfSet as X, clearBucketRegionCache as Xt, requireConfigString as Y, processStackMessages as Yt, DiffCalculator as Z, resolveBucketRegion as Zt, createPreDeleteFinalSnapshot as _, StackHasActiveImportsError as _n, ensureAssetStorage as _t, DeploymentEventsStore as a, DependencyError as an, S3StateBackend as at, unsupportedFinalSnapshotError as b, SynthesisError as bn, validateAssetBucketName as bt, replayFailedOperations as c, LocalMigrateError as cn, AssetPublisher as ct, IMPLICIT_DELETE_DEPENDENCIES as d, MissingCdkCliError as dn, buildAssetRedirectMap as dt, resetAwsClients as en, isRetryableTransientError as et, computeImplicitDeleteEdges as f, NestedStackChildDirectDestroyError as fn, createAssetRedirectResolver as ft, ccRoutedFinalSnapshotError as g, ResourceUpdateNotSupportedError as gn, BOOTSTRAP_MARKER_PREFIX as gt, buildFinalSnapshotIdentifier as h, ResourceTimeoutError as hn, AssetModeResolver as ht, DeploymentEventsReader as i, ConfigError as in, LockManager as it, yellow as j, getDefaultStateBucketName as jt, green as k, Synthesizer as kt, replayRollback as l, LocalStartServiceError as ln, stringifyValue as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ProvisioningError as mn, rewriteTemplateAssetReferences as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as nn, DagBuilder as nt, planFailedOps as o, DeployCancelledError as on, rebuildClientForBucketRegion as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, PartialFailureError as pn, loadPublishableAssetManifest as pt, assertRegionMatch as q, expectedOwnerParam as qt, DeployEngine as r, CdkdError as rn, TemplateParser as rt, planRollback as s, LocalInvokeBuildError as sn, shouldRetainResource as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as tn, isThrottlingError as tt, withResourceDeadline as u, LockError as un, WorkGraph as ut, isFinalSnapshotError as v, StackTerminationProtectionError as vn, getBootstrapMarkerKey as vt, renderStatefulReason as w, withErrorHandling as wn, getDockerCmd as wt, extractDeploymentEventError as x, formatError as xn, validateContainerRepoName as xt, refusesFinalSnapshot as y, StateError as yn, parseBootstrapMarker as yt, disableInstanceApiTermination as z, resolveUseCdkBootstrapAssets as zt };
-//# sourceMappingURL=deploy-engine-Dcg1nH3d.js.map
+//# sourceMappingURL=deploy-engine-BLIg6xfm.js.map