@go-to-k/cdkd 0.280.14 → 0.280.16

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-D4VaoTK7.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-1eZqhWKB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DIMKyE07.js";
+import { t as ASGProvider } from "./asg-provider-4pPwAL_v.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRoleCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
@@ -9028,6 +9028,13 @@ function isSnsTopicArnList(value) {
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
 /**
+* Attempts the create path's atomicity cleanup makes when DeleteFunction is
+* refused because the function is still settling. Three attempts with the
+* linear backoff in `cleanupDeleteRetryDelayMs` covers the few seconds a
+* `Pending` -> terminal transition takes without stalling a failed deploy.
+*/
+const LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS = 3;
+/**
 * Pick the inline-code filename for a Lambda runtime.
 *
 * CloudFormation's `Code.ZipFile` auto-zips inline code into a file named
@@ -9078,8 +9085,28 @@ var LambdaFunctionProvider = class {
 		"SnapStart",
 		"LoggingConfig",
 		"RecursiveLoop",
-		"ReservedConcurrentExecutions"
+		"ReservedConcurrentExecutions",
+		"CodeSigningConfigArn",
+		"RuntimeManagementConfig",
+		"DurableConfig",
+		"TenancyConfig"
 	])]]);
+	/**
+	* Properties the provider deliberately does NOT wire (issue #391 /
+	* see `ResourceProvider.unhandledByDesign`).
+	*
+	* `CapacityProviderConfig` / `FunctionScalingConfig` are deliberately NOT
+	* here — they stay in `silentDrop` (pre-flight rejection with the
+	* `--allow-unsupported-properties` escape hatch) rather than being declared
+	* un-wirable, because they ARE wirable once Lambda managed instances are
+	* supported. They are one coupled feature: `PutFunctionScalingConfig` fails
+	* with `AccessDeniedException: The function provided by the arn does not
+	* contain a capacity provider configuration` unless the function already
+	* carries a capacity provider (live-probed us-east-1, 2026-08-11). Tracked
+	* in issue #1616.
+	*/
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Map([["PublishToLatestPublished", "CloudFormation-only version-publishing directive with no AWS SDK equivalent"]])]]);
+	cleanupDeleteRetryDelayMs = 2e3;
 	eniWaitTimeoutMs = 600 * 1e3;
 	eniWaitInitialDelayMs = 1e4;
 	eniWaitMaxDelayMs = 1e4;
@@ -9131,39 +9158,50 @@ var LambdaFunctionProvider = class {
 				ImageConfig: properties["ImageConfig"],
 				SnapStart: properties["SnapStart"],
 				LoggingConfig: properties["LoggingConfig"],
+				DurableConfig: properties["DurableConfig"],
+				TenancyConfig: properties["TenancyConfig"],
+				CodeSigningConfigArn: properties["CodeSigningConfigArn"],
 				Tags: tags
 			};
 			const response = await this.lambdaClient.send(new CreateFunctionCommand(createParams));
 			const recursiveLoop = properties["RecursiveLoop"];
-			if (recursiveLoop !== void 0) try {
-				await this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
-					FunctionName: functionName,
-					RecursiveLoop: recursiveLoop
-				}));
-			} catch (rlError) {
-				this.logger.warn(`PutFunctionRecursionConfig failed for ${logicalId}: ${rlError instanceof Error ? rlError.message : String(rlError)} — deleting partially-created function to maintain atomicity`);
-				try {
-					await this.lambdaClient.send(new DeleteFunctionCommand({ FunctionName: functionName }));
-				} catch (deleteError) {
-					this.logger.error(`Cleanup DeleteFunction failed for ${logicalId} after PutFunctionRecursionConfig failure — function may be orphaned: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
-				}
-				throw new ProvisioningError(`Failed to set RecursiveLoop on Lambda function ${logicalId} (function was deleted to maintain atomicity): ${rlError instanceof Error ? rlError.message : String(rlError)}`, resourceType, logicalId, functionName, rlError instanceof Error ? rlError : void 0);
-			}
+			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
+				FunctionName: functionName,
+				RecursiveLoop: recursiveLoop
+			})), {
+				apiName: "PutFunctionRecursionConfig",
+				propertyName: "RecursiveLoop",
+				logicalId,
+				resourceType,
+				functionName
+			});
 			const reservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
-			if (reservedConcurrentExecutions !== void 0) try {
-				await this.lambdaClient.send(new PutFunctionConcurrencyCommand({
-					FunctionName: functionName,
-					ReservedConcurrentExecutions: reservedConcurrentExecutions
-				}));
-			} catch (pcError) {
-				this.logger.warn(`PutFunctionConcurrency failed for ${logicalId}: ${pcError instanceof Error ? pcError.message : String(pcError)} — deleting partially-created function to maintain atomicity`);
-				try {
-					await this.lambdaClient.send(new DeleteFunctionCommand({ FunctionName: functionName }));
-				} catch (deleteError) {
-					this.logger.error(`Cleanup DeleteFunction failed for ${logicalId} after PutFunctionConcurrency failure — function may be orphaned: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
-				}
-				throw new ProvisioningError(`Failed to set ReservedConcurrentExecutions on Lambda function ${logicalId} (function was deleted to maintain atomicity): ${pcError instanceof Error ? pcError.message : String(pcError)}`, resourceType, logicalId, functionName, pcError instanceof Error ? pcError : void 0);
-			}
+			if (reservedConcurrentExecutions !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionConcurrencyCommand({
+				FunctionName: functionName,
+				ReservedConcurrentExecutions: reservedConcurrentExecutions
+			})), {
+				apiName: "PutFunctionConcurrency",
+				propertyName: "ReservedConcurrentExecutions",
+				logicalId,
+				resourceType,
+				functionName
+			});
+			const runtimeManagementConfig = properties["RuntimeManagementConfig"];
+			if (runtimeManagementConfig !== void 0) await this.applyPostCreateConfig(async () => {
+				await waitUntilFunctionActiveV2({
+					client: this.lambdaClient,
+					maxWaitTime: this.functionUpdateMaxWaitSeconds,
+					minDelay: 1,
+					maxDelay: 5
+				}, { FunctionName: functionName });
+				await this.putRuntimeManagementConfig(functionName, runtimeManagementConfig);
+			}, {
+				apiName: "PutRuntimeManagementConfig",
+				propertyName: "RuntimeManagementConfig",
+				logicalId,
+				resourceType,
+				functionName
+			});
 			this.logger.debug(`Successfully created Lambda function ${logicalId}: ${functionName}`);
 			return {
 				physicalId: response.FunctionName || functionName,
@@ -9178,6 +9216,63 @@ var LambdaFunctionProvider = class {
 		}
 	}
 	/**
+	* Run a post-create control-plane call under the create path's atomicity
+	* contract: on failure, DELETE the just-created function so the next deploy
+	* retry sees a fresh slate instead of an orphan that already exists.
+	*
+	* Extracted from the (previously duplicated) `RecursiveLoop` /
+	* `ReservedConcurrentExecutions` blocks when `RuntimeManagementConfig`
+	* became the third caller — the wording of all three log lines and of the
+	* thrown error is preserved verbatim, parameterized only by the API name
+	* and the CFn property name.
+	*
+	* VPC-attached Lambda caveat (unchanged): the cleanup uses a bare
+	* `DeleteFunction`, not the provider's own `delete()`, so hyperplane ENIs
+	* are NOT pre-detached / awaited. For a VPC-attached function whose call
+	* fails, the next deploy retry's downstream Subnet/SG creation can race the
+	* asynchronous ENI release until AWS finishes the detach. The "concurrent
+	* update operation" substring is preserved in the wrapped error message so
+	* the outer `withRetry` classifier still retries cleanly.
+	*/
+	async applyPostCreateConfig(send, ctx) {
+		try {
+			await send();
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`${ctx.apiName} failed for ${ctx.logicalId}: ${message} — deleting partially-created function to maintain atomicity`);
+			let cleanupFailure;
+			for (let attempt = 0; attempt < LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS; attempt++) try {
+				await this.lambdaClient.send(new DeleteFunctionCommand({ FunctionName: ctx.functionName }));
+				cleanupFailure = void 0;
+				break;
+			} catch (deleteError) {
+				const deleteMessage = deleteError instanceof Error ? deleteError.message : String(deleteError);
+				cleanupFailure = deleteMessage;
+				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
+				if (attempt < LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS - 1) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
+			}
+			if (cleanupFailure !== void 0) this.logger.error(`Cleanup DeleteFunction failed for ${ctx.logicalId} after ${ctx.apiName} failure — function may be orphaned: ${cleanupFailure}`);
+			throw new ProvisioningError(`Failed to set ${ctx.propertyName} on Lambda function ${ctx.logicalId} (function was deleted to maintain atomicity): ${message}`, ctx.resourceType, ctx.logicalId, ctx.functionName, error instanceof Error ? error : void 0);
+		}
+	}
+	/**
+	* Send the CFn `RuntimeManagementConfig` block to `PutRuntimeManagementConfig`.
+	*
+	* CFn spells the block `{ UpdateRuntimeOn, RuntimeVersionArn }` and the SDK
+	* request carries the same two members flat on the request (plus the
+	* function name), so this is a straight lift rather than a re-shape.
+	* `UpdateRuntimeOn` is required by the API; a template that omits it is
+	* refused by AWS with its own validation error, which is the behavior we
+	* want to surface rather than paper over with a cdkd-invented default.
+	*/
+	async putRuntimeManagementConfig(functionName, config) {
+		await this.lambdaClient.send(new PutRuntimeManagementConfigCommand({
+			FunctionName: functionName,
+			UpdateRuntimeOn: config["UpdateRuntimeOn"],
+			RuntimeVersionArn: config["RuntimeVersionArn"]
+		}));
+	}
+	/**
 	* Update a Lambda function
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -9200,7 +9295,8 @@ var LambdaFunctionProvider = class {
 				"FileSystemConfigs",
 				"ImageConfig",
 				"SnapStart",
-				"LoggingConfig"
+				"LoggingConfig",
+				"DurableConfig"
 			];
 			let hasConfigChanges = false;
 			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) {
@@ -9226,12 +9322,19 @@ var LambdaFunctionProvider = class {
 					FileSystemConfigs: clearOnUpdateRemoval(properties["FileSystemConfigs"], previousProperties["FileSystemConfigs"], []),
 					ImageConfig: clearOnUpdateRemoval(properties["ImageConfig"], previousProperties["ImageConfig"], {}),
 					SnapStart: clearOnUpdateRemoval(properties["SnapStart"], previousProperties["SnapStart"], { ApplyOn: "None" }),
-					LoggingConfig: clearOnUpdateRemoval(properties["LoggingConfig"], previousProperties["LoggingConfig"], { LogFormat: "Text" })
+					LoggingConfig: clearOnUpdateRemoval(properties["LoggingConfig"], previousProperties["LoggingConfig"], { LogFormat: "Text" }),
+					DurableConfig: properties["DurableConfig"]
 				};
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand(configParams));
 				this.logger.debug(`Updated configuration for Lambda function ${physicalId}`);
 				await this.waitForFunctionUpdated(logicalId, resourceType, physicalId);
 			}
+			const newCodeSigningConfigArn = properties["CodeSigningConfigArn"];
+			const codeSigningChanged = newCodeSigningConfigArn !== previousProperties["CodeSigningConfigArn"];
+			if (codeSigningChanged && newCodeSigningConfigArn === void 0) {
+				await this.lambdaClient.send(new DeleteFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
+				this.logger.debug(`Detached CodeSigningConfigArn from Lambda function ${physicalId} (template removed the property)`);
+			}
 			const newCode = properties["Code"];
 			const oldCode = previousProperties["Code"];
 			const normalizeArchitectures = (v) => Array.isArray(v) && v.length > 0 ? v : ["x86_64"];
@@ -9271,6 +9374,19 @@ var LambdaFunctionProvider = class {
 				}));
 				this.logger.debug(`Updated ReservedConcurrentExecutions for Lambda function ${physicalId} to ${newReservedConcurrentExecutions}`);
 			}
+			if (codeSigningChanged && newCodeSigningConfigArn !== void 0) {
+				await this.lambdaClient.send(new PutFunctionCodeSigningConfigCommand({
+					FunctionName: physicalId,
+					CodeSigningConfigArn: newCodeSigningConfigArn
+				}));
+				this.logger.debug(`Updated CodeSigningConfigArn for Lambda function ${physicalId} to ${newCodeSigningConfigArn}`);
+			}
+			const newRuntimeManagementConfig = properties["RuntimeManagementConfig"];
+			const prevRuntimeManagementConfig = previousProperties["RuntimeManagementConfig"];
+			if (newRuntimeManagementConfig?.["UpdateRuntimeOn"] !== prevRuntimeManagementConfig?.["UpdateRuntimeOn"] || newRuntimeManagementConfig?.["RuntimeVersionArn"] !== prevRuntimeManagementConfig?.["RuntimeVersionArn"]) {
+				await this.putRuntimeManagementConfig(physicalId, newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" });
+				this.logger.debug(`Updated RuntimeManagementConfig for Lambda function ${physicalId} to ${JSON.stringify(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" })}`);
+			}
 			const getResponse = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
 			const functionArn = getResponse.Configuration?.FunctionArn;
 			await this.applyTagDiff(functionArn, previousProperties["Tags"], properties["Tags"]);
@@ -9795,6 +9911,13 @@ var LambdaFunctionProvider = class {
 				if (cfg.LoggingConfig.LogGroup !== void 0) lc["LogGroup"] = cfg.LoggingConfig.LogGroup;
 				result["LoggingConfig"] = lc;
 			}
+			if (cfg.DurableConfig !== void 0) {
+				const dc = {};
+				if (cfg.DurableConfig.ExecutionTimeout !== void 0) dc["ExecutionTimeout"] = cfg.DurableConfig.ExecutionTimeout;
+				if (cfg.DurableConfig.RetentionPeriodInDays !== void 0) dc["RetentionPeriodInDays"] = cfg.DurableConfig.RetentionPeriodInDays;
+				if (Object.keys(dc).length > 0) result["DurableConfig"] = dc;
+			}
+			if (cfg.TenancyConfig?.TenantIsolationMode !== void 0) result["TenancyConfig"] = { TenantIsolationMode: cfg.TenancyConfig.TenantIsolationMode };
 			result["Tags"] = normalizeAwsTagsToCfn(resp.Tags);
 			try {
 				const rlResp = await this.lambdaClient.send(new GetFunctionRecursionConfigCommand({ FunctionName: physicalId }));
@@ -9808,6 +9931,22 @@ var LambdaFunctionProvider = class {
 			} catch (pcErr) {
 				if (!(pcErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionConcurrency failed for ${physicalId}: ${pcErr instanceof Error ? pcErr.message : String(pcErr)}`);
 			}
+			try {
+				const rmResp = await this.lambdaClient.send(new GetRuntimeManagementConfigCommand({ FunctionName: physicalId }));
+				if (rmResp.UpdateRuntimeOn !== void 0) {
+					const rm = { UpdateRuntimeOn: rmResp.UpdateRuntimeOn };
+					if (rmResp.RuntimeVersionArn !== void 0) rm["RuntimeVersionArn"] = rmResp.RuntimeVersionArn;
+					result["RuntimeManagementConfig"] = rm;
+				}
+			} catch (rmErr) {
+				if (!(rmErr instanceof ResourceNotFoundException)) this.logger.warn(`GetRuntimeManagementConfig failed for ${physicalId} — RuntimeManagementConfig omitted from the drift snapshot (may surface as a false removal): ${rmErr instanceof Error ? rmErr.message : String(rmErr)}`);
+			}
+			try {
+				const csResp = await this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
+				if (csResp.CodeSigningConfigArn !== void 0) result["CodeSigningConfigArn"] = csResp.CodeSigningConfigArn;
+			} catch (csErr) {
+				if (!(csErr instanceof ResourceNotFoundException)) this.logger.warn(`GetFunctionCodeSigningConfig failed for ${physicalId} — CodeSigningConfigArn omitted from the drift snapshot (may surface as a false removal): ${csErr instanceof Error ? csErr.message : String(csErr)}`);
+			}
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException) return void 0;
@@ -11696,6 +11835,28 @@ function mapSSESpecification(raw) {
 	return out;
 }
 /**
+* Read one capacity member out of a per-index `ProvisionedThroughput` block,
+* returning `undefined` for anything that is not a usable number.
+*
+* Deliberately has NO default (issue #1588 review). The BillingMode-flip caller
+* suppresses the per-index update path for every index it handles, so a
+* defaulted capacity would never be corrected by a later call and would land in
+* cdkd state as if the template had declared it. Returning `undefined` routes
+* the index to the same warn-and-omit path an absent block takes, letting AWS
+* name it — the CFn-handler outcome.
+*
+* CFn is stringly typed, so a numeric string is accepted and coerced; `NaN` /
+* `Infinity` / objects / unresolved intrinsics are not.
+*/
+function readCapacityNumber(block, member) {
+	if (typeof block !== "object" || block === null || Array.isArray(block)) return void 0;
+	const raw = block[member];
+	if (raw === void 0 || raw === null || raw === "") return void 0;
+	if (typeof raw !== "number" && typeof raw !== "string") return void 0;
+	const value = Number(raw);
+	return Number.isFinite(value) ? value : void 0;
+}
+/**
 * `DescribeTable` poll budget (seconds, 1 poll/s) after an ordinary
 * `UpdateTable` — capacity, TTL, tags, table class. Calibrated on those and
 * sufficient for them.
@@ -11835,7 +11996,8 @@ var DynamoDBTableProvider = class {
 			} });
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
-			if (billingMode === "PROVISIONED" && prevBillingMode === "PAY_PER_REQUEST" && properties["OnDemandThroughput"] !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : ""} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : ""} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (billingOrThroughputChanged || tableClassChanged) {
 				const updateInput = { TableName: physicalId };
 				if (billingOrThroughputChanged) updateInput.BillingMode = billingMode;
@@ -11847,6 +12009,38 @@ var DynamoDBTableProvider = class {
 						WriteCapacityUnits: Number(pt["WriteCapacityUnits"] ?? 5)
 					};
 				}
+				const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
+				if (billingOrThroughputChanged && billingMode === "PROVISIONED" && liveBillingMode === "PAY_PER_REQUEST" && liveIndexes.length > 0) {
+					const desiredIndexes = Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : [];
+					const desiredByName = /* @__PURE__ */ new Map();
+					for (const entry of desiredIndexes) {
+						const name = entry?.["IndexName"];
+						if (typeof name === "string") desiredByName.set(name, entry);
+					}
+					const indexUpdates = [];
+					const unspecified = [];
+					for (const live of liveIndexes) {
+						const indexName = live.IndexName;
+						if (typeof indexName !== "string") continue;
+						const declared = desiredByName.get(indexName)?.["ProvisionedThroughput"];
+						const read = readCapacityNumber(declared, "ReadCapacityUnits");
+						const write = readCapacityNumber(declared, "WriteCapacityUnits");
+						if (read === void 0 || write === void 0) {
+							unspecified.push(indexName);
+							continue;
+						}
+						indexUpdates.push({ Update: {
+							IndexName: indexName,
+							ProvisionedThroughput: {
+								ReadCapacityUnits: read,
+								WriteCapacityUnits: write
+							}
+						} });
+						gsiHandledByBillingFlip.add(indexName);
+					}
+					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
+					if (unspecified.length > 0) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. If an index is listed here because this deploy REMOVES it, drop it in a separate deploy BEFORE the flip — AWS demands capacity for every index still live at flip time, so the two cannot be combined.`);
+				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
 				else await this.waitForTableActiveAfterUpdate(physicalId, TABLE_ACTIVE_WAIT_ATTEMPTS);
@@ -11923,7 +12117,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"]);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -12361,7 +12555,7 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set()) {
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -12380,7 +12574,7 @@ var DynamoDBTableProvider = class {
 		} else {
 			const before = prevByName.get(name);
 			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
-			if (gsi.ProvisionedThroughput && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) ops.push({ Update: {
+			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) ops.push({ Update: {
 				IndexName: name,
 				ProvisionedThroughput: gsi.ProvisionedThroughput
 			} });
@@ -69225,7 +69419,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.14");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.16");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;