@go-to-k/cdkd 0.280.38 → 0.280.39

package/dist/{deploy-engine-B3a5MhON.js → deploy-engine-BXVYshtP.js}

@@ -12872,7 +12872,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CVra7Nuk.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DPYPr-Op.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13522,6 +13522,25 @@ function parseLambdaPayload(payloadBytes) {
 	return parsed;
 }
 /**
+* Decode the base64 `LogResult` a `LogType: 'Tail'` invoke returns into the
+* backing function's log tail (issue #1674).
+*
+* Best-effort by design: this only ever feeds diagnostics and the retry
+* classifier, so nothing here may fail a deploy that is otherwise fine. Node's
+* base64 decoder is LENIENT — it drops invalid characters rather than throwing —
+* so a malformed value decodes to garbage, which simply matches no signal; the
+* `catch` is belt-and-braces for that contract changing, not a live path.
+*/
+function decodeInvokeLogTail(logResult) {
+	if (!logResult) return void 0;
+	try {
+		const decoded = Buffer.from(logResult, "base64").toString("utf8");
+		return decoded.length > 0 ? decoded : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * IAM-authorization-propagation signals in a custom resource FAILED reason that
 * indicate the backing Lambda's freshly-attached execution-role policy has not
 * yet taken effect for its assumed-role session (so a recycle + retry will
@@ -13538,6 +13557,67 @@ const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"is unable to assume"
 ];
 /**
+* The same IAM-authorization-propagation signals, matched against the backing
+* function's INVOCATION LOG TAIL rather than the FAILED reason (issue #1674).
+*
+* Why a second set is needed at all: the reason string is written by the
+* handler, and a handler that wraps an SDK / CLI failure in its own message —
+* normal handler hygiene — erases every authz phrase before cdkd ever sees it.
+* CDK's `BucketDeployment` is the widely-used instance: `aws_command()` lets
+* `subprocess.check_call` raise, and `str(CalledProcessError)` is only
+* `Command '[...]' returned non-zero exit status 1.`, so the 403 on the asset
+* object reaches cdkd with no authz wording at all and the retry above never
+* fires — on a resource GUARANTEED to race, since CDK generates the handler
+* role, its inline policy and the custom resource in the same stack.
+*
+* The 403 does survive in the function's own log, which a `LogType: 'Tail'`
+* invoke returns inline (no CloudWatch Logs dependency, no extra API call, no
+* additional IAM permission — see `invokeLambda`). So this set adds the
+* CLI / SDK-level spellings of the SAME denial that the handler swallowed:
+* botocore's `An error occurred (403) when calling the HeadObject operation`
+* and the `AccessDenied` / `AccessDeniedException` error codes.
+*
+* Deliberately still NARROW, for the reason `isTransientAuthzFailure`
+* documents: a bare `403` / `forbidden` would match a handler legitimately
+* logging an unrelated downstream denial, and generic transient errors
+* (throttling / timeouts) must not trigger a CR re-invoke at all.
+*
+* ACCEPTED COST, stated because a log surface is noisier than a
+* handler-authored reason: a handler that merely LOGS a genuine, permanent
+* `AccessDenied` — one it caught, or one no propagation will fix — now buys
+* `transientAuthzMaxRetries` extra invokes plus a
+* `recycleBackingFunctionExecEnv` each. Bounded (2 by default; set
+* `CDKD_CR_AUTHZ_MAX_RETRIES=0` to disable the RETRY — the log-tail scan and the
+* reason annotation below still run, since they only describe the failure), and
+* the original failure still surfaces afterwards, so the failure is DELAYED,
+* never masked.
+*
+* The cost is NOT purely wasted time, and saying only "delayed, never masked"
+* would undersell it: a re-invoke re-runs the handler's `Create`, so a handler
+* that is not idempotent and had already done partial work repeats that work —
+* and under the CDK Provider framework the re-invoked `onEvent` can create a
+* SECOND physical resource, orphaning the first. That exposure is not new (the
+* pre-existing reason-string match has always been able to retry), but the log
+* signal widens what reaches it. The trade is still deliberate: the alternative
+* is the pre-#1674 behavior, where the propagation race this whole mechanism
+* exists for fails the deploy on its first attempt, every time.
+*/
+const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
+	...CR_TRANSIENT_AUTHZ_SIGNALS,
+	"an error occurred (403)",
+	"accessdenied",
+	"access denied"
+];
+/**
+* Cap for the backing function's log tail when it is surfaced in an EPHEMERAL
+* warning (the `FunctionError` arm). Deliberately far larger than
+* `truncateReason`'s 200-char default — a crashed handler's real cause is often
+* several lines above the last one (a Python traceback) — but not unbounded:
+* this lands in CI logs and terminal scrollback. Lambda caps the tail at 4 KB
+* regardless, so this only trims the extreme case.
+*/
+const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
+/**
 * Custom Resource Provider
 *
 * Implements Lambda-backed custom resources by invoking the Lambda function
@@ -13634,7 +13714,9 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* `disableOuterRetry` to avoid stranding a pre-signed response URL — so we
 	* retry HERE instead, deriving a fresh response URL + RequestId per attempt
 	* and recycling the backing function's execution environment between tries).
-	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES` (0 disables).
+	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES`. `0` disables the RETRY only —
+	* the issue-#1674 log-tail scan and the reason annotation it produces still
+	* run, because they describe the failure rather than react to it.
 	*/
 	transientAuthzMaxRetries = (() => {
 		const raw = process.env["CDKD_CR_AUTHZ_MAX_RETRIES"];
@@ -13900,12 +13982,18 @@ var CustomResourceProvider = class CustomResourceProvider {
 			const invocation = await this.prepareInvocation();
 			const request = buildRequest(invocation);
 			this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
-			const cfnResponse = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
-			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && this.isTransientAuthzFailure(cfnResponse.Reason)) {
-				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
+			const { response: cfnResponse, logResult } = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
+			const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
+			const logAuthzMatch = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? this.findTransientAuthzLogLine(decodeInvokeLogTail(logResult)) : void 0;
+			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
+				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
 				await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
 				continue;
 			}
+			if (cfnResponse.Status === "FAILED" && logAuthzMatch !== void 0) return {
+				...cfnResponse,
+				Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
+			};
 			return cfnResponse;
 		}
 	}
@@ -13927,6 +14015,45 @@ var CustomResourceProvider = class CustomResourceProvider {
 		const lower = reason.toLowerCase();
 		return CR_TRANSIENT_AUTHZ_SIGNALS.some((p) => lower.includes(p));
 	}
+	/**
+	* Find the IAM-authorization denial inside a backing function's invocation
+	* log tail, for the case the FAILED reason itself carries none (issue #1674).
+	*
+	* Returns the FIRST matching log LINE rather than a boolean, so the caller can
+	* put the denial the handler swallowed into its message — today the user has
+	* to open CloudWatch to discover that `returned non-zero exit status 1` was a
+	* 403 on the asset object. The line is returned verbatim (the caller
+	* truncates); only the MATCH is case-insensitive.
+	*
+	* Absent for an SNS-backed custom resource — no Lambda invoke, so no tail.
+	*
+	* **Known bound.** The tail always belongs to the DISPATCH invoke. For a
+	* handler that does its work inline and PUTs the cfn-response itself (CDK's
+	* `BucketDeployment` — the case this exists for), that IS where the failure
+	* happened. For the CDK Provider framework's genuinely async pattern it is
+	* NOT: the failure happens later, in a Step-Functions-driven handler, so a
+	* stray denial logged by the `onEvent` wrapper can buy a bounded extra retry
+	* with a message pointing at the wrong execution. That path is otherwise
+	* covered by the reason string, which the framework populates from the
+	* underlying error, so the cost is redundancy rather than a wrong answer.
+	*
+	* Suppressing the tail for the async pattern is NOT the fix, and the reason
+	* is worth recording: `isAsyncPattern` in `getCustomResourceResponse` means
+	* only "the invoke returned no direct payload", which is equally true of
+	* `BucketDeployment` — its Python handler returns `None`. Gating on it would
+	* switch off exactly the case this feature exists for.
+	*/
+	findTransientAuthzLogLine(logTail) {
+		if (!logTail) return void 0;
+		for (const line of logTail.split("\n")) {
+			const lower = line.toLowerCase();
+			const signal = CR_TRANSIENT_AUTHZ_LOG_SIGNALS.find((p) => lower.includes(p));
+			if (signal !== void 0) return {
+				line: line.trim(),
+				signal
+			};
+		}
+	}
 	/** Truncate a CR FAILED reason for log readability. */
 	truncateReason(reason, max = 200) {
 		const r = reason ?? "Unknown reason";
@@ -13968,16 +14095,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* Send custom resource request via the appropriate service (Lambda or SNS)
 	* For Lambda: invokes synchronously and returns the response
 	* For SNS: publishes to topic and polls S3 for response
+	*
+	* Also returns the backing function's raw invocation `LogResult` when there
+	* is one, so the caller can recover an authorization denial the handler
+	* erased from the FAILED reason (issue #1674). Returned UNDECODED so the
+	* happy path pays nothing — only a FAILED whose reason missed decodes it.
+	* Absent on the SNS path: there is no Lambda invoke to attach a log to.
 	*/
 	async sendRequest(serviceToken, request, responseKey, logicalId, operation) {
 		if (this.isSnsServiceToken(serviceToken)) {
 			this.logger.debug(`ServiceToken is SNS topic, publishing to: ${serviceToken}`);
 			await this.publishToSns(serviceToken, request);
-			return await this.pollS3Response(responseKey, logicalId, operation);
+			return { response: await this.pollS3Response(responseKey, logicalId, operation) };
 		}
 		await this.waitForBackingLambdaReady(serviceToken, logicalId);
-		const response = await this.invokeLambda(serviceToken, request);
-		return await this.getCustomResourceResponse(response, responseKey, logicalId, operation);
+		const invokeResponse = await this.invokeLambda(serviceToken, request);
+		return {
+			response: await this.getCustomResourceResponse(invokeResponse, responseKey, logicalId, operation),
+			...invokeResponse.LogResult === void 0 ? {} : { logResult: invokeResponse.LogResult }
+		};
 	}
 	/**
 	* Block until the backing Lambda function for a Custom Resource is in a
@@ -14036,11 +14172,21 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	/**
 	* Invoke Lambda function synchronously
+	*
+	* `LogType: 'Tail'` makes Lambda return the last 4 KB of THIS invocation's
+	* log, base64-encoded, in `LogResult` (issue #1674). It is only valid with
+	* `RequestResponse`, which is what this path always uses. This is deliberately
+	* preferred over reading the function's CloudWatch log group after the fact:
+	* it needs no CloudWatch Logs client, no `logs:GetLogEvents` on cdkd's own
+	* credentials, and no extra API call — the tail rides the invoke response
+	* cdkd already waits for, and is scoped to the exact invocation that failed
+	* rather than to whatever happens to be latest in the log stream.
 	*/
 	async invokeLambda(serviceToken, request) {
 		return await this.lambdaClient.send(new InvokeCommand({
 			FunctionName: serviceToken,
 			InvocationType: "RequestResponse",
+			LogType: "Tail",
 			Payload: Buffer.from(JSON.stringify(request))
 		}));
 	}
@@ -14055,6 +14201,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 	async getCustomResourceResponse(lambdaResponse, responseKey, logicalId, operation) {
 		if (lambdaResponse.FunctionError) {
 			const errorPayload = lambdaResponse.Payload ? Buffer.from(lambdaResponse.Payload).toString() : "Unknown";
+			const logTail = decodeInvokeLogTail(lambdaResponse.LogResult);
+			if (logTail !== void 0) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
 			throw new Error(`Lambda function error (${lambdaResponse.FunctionError}): ${errorPayload}`);
 		}
 		let hasDirectPayload = false;
@@ -19541,7 +19689,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.38";
+	return "0.280.39";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21707,4 +21855,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigObject as $, AssemblyReader as $t, green as A, __exportAll as An, runDockerForeground as At, disableInstanceApiTermination as B, resolveCaptureObservedState as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackTerminationProtectionError as Cn, getBootstrapMarkerKey as Ct, bold as D, isCdkdError as Dn, buildDockerImage as Dt, formatResourceLine as E, formatError as En, validateContainerRepoName as Et, clearOnUpdateRemoval as F, synthesisStatusMessage as Ft, WAFv2WebACLProvider as G, stateBucketExistenceConfirmed as Gt, IntrinsicFunctionResolver as H, resolveStateBucketWithDefault as Ht, ProviderRegistry as I, getDefaultStateBucketName as It, assertRegionMatch as J, CFN_TEMPLATE_URL_LIMIT as Jt, normalizeAwsTagsToCfn as K, warnDeprecatedNoPrefixCliFlag as Kt, findActionableSilentDrops as L, getLegacyStateBucketName as Lt, yellow as M, AssetManifestLoader as Mt, IAMRoleProvider as N, getDockerImageBySourceHash as Nt, cyan as O, normalizeAwsError as On, formatDockerLoginError as Ot, collectInlinePolicyNamesManagedBySiblings as P, Synthesizer as Pt, requireConfigArray as Q, expectedOwnerParam as Qt, CloudControlProvider as R, resolveApp as Rt, extractDeploymentEventError as S, StackHasActiveImportsError as Sn, ensureAssetStorage as St, renderStatefulReason as T, SynthesisError as Tn, validateAssetBucketName as Tt, cfnRefValueFromPhysicalId as U, resolveStateBucketWithDefaultAndSource as Ut, isTerminationProtectionPropagationError as V, resolveSkipPrefix as Vt, refStateLookupFromResource as W, resolveUseCdkBootstrapAssets as Wt, readConfigString as X, findLargeInlineResources as Xt, configStringRefusal as Y, MIGRATE_TMP_PREFIX as Yt, replayWarn as Z, uploadCfnTemplate as Zt, createPreDeleteFinalSnapshot as _, NestedStackChildDirectDestroyError as _n, createAssetRedirectResolver as _t, DeploymentEventsStore as a, resetAwsClients as an, isRetryableTransientError as at, unsupportedFinalSnapshotError as b, ResourceTimeoutError as bn, AssetModeResolver as bt, replayFailedOperations as c, CdkdError as cn, TemplateParser as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DeployCancelledError as dn, rebuildClientForBucketRegion as dt, processStackMessages as en, requireConfigString as et, computeImplicitDeleteEdges as f, LocalInvokeBuildError as fn, shouldRetainResource as ft, ccRoutedFinalSnapshotError as g, MissingCdkCliError as gn, buildAssetRedirectMap as gt, buildFinalSnapshotIdentifier as h, LockError as hn, WorkGraph as ht, DeploymentEventsReader as i, getAwsClients as in, withRetry as it, red as j, runDockerStreaming as jt, gray as k, withErrorHandling as kn, getDockerCmd as kt, replayRollback as l, ConfigError as ln, LockManager as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalStartServiceError as mn, stringifyValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveBucketRegion as nn, DiffCalculator as nt, planFailedOps as o, setAwsClients as on, isThrottlingError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalMigrateError as pn, AssetPublisher as pt, resolveExplicitPhysicalId as q, CFN_TEMPLATE_BODY_LIMIT as qt, DeployEngine as r, AwsClients as rn, describeTypeWithThrottleRetry as rt, planRollback as s, AssetError as sn, DagBuilder as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, clearBucketRegionCache as tn, applyRoleArnIfSet as tt, withResourceDeadline as u, DependencyError as un, S3StateBackend as ut, isFinalSnapshotError as v, PartialFailureError as vn, loadPublishableAssetManifest as vt, isStatefulRecreateTargetSync as w, StateError as wn, parseBootstrapMarker as wt, makeCanonicalizePropertiesFn as x, ResourceUpdateNotSupportedError as xn, BOOTSTRAP_MARKER_PREFIX as xt, refusesFinalSnapshot as y, ProvisioningError as yn, rewriteTemplateAssetReferences as yt, slowCcOperationTimeoutMs as z, resolveAutoAssetStorage as zt };
-//# sourceMappingURL=deploy-engine-B3a5MhON.js.map
+//# sourceMappingURL=deploy-engine-BXVYshtP.js.map