@go-to-k/cdkd 0.280.44 → 0.280.46

package/dist/{deploy-engine-nEjymkij.js → deploy-engine-E_JV4UqE.js}

@@ -12915,7 +12915,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BBKdxCVP.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DGHuyUA8.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13653,14 +13653,41 @@ const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
 ];
 /**
 * Cap for the backing function's log tail when it is surfaced in an EPHEMERAL
-* warning (the `FunctionError` arm). Deliberately far larger than
-* `truncateReason`'s 200-char default — a crashed handler's real cause is often
-* several lines above the last one (a Python traceback) — but not unbounded:
-* this lands in CI logs and terminal scrollback. Lambda caps the tail at 4 KB
-* regardless, so this only trims the extreme case.
+* warning — the `FunctionError` arm and the unexplained-FAILED arm. Deliberately
+* far larger than `truncateReason`'s 200-char default — a crashed handler's real
+* cause is often several lines above the last one (a Python traceback) — but not
+* unbounded: this lands in CI logs and terminal scrollback. Lambda caps the tail
+* at 4 KB regardless, so this only trims the extreme case.
 */
 const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
 /**
+* Lines Lambda emits for EVERY invocation regardless of what the handler logged.
+* A tail consisting only of these carries no diagnostic value, and it is the
+* COMMON case — `LogResult` is never absent on a `LogType: 'Tail'` invoke, so a
+* bare `!== undefined` check filters nothing and would dump boilerplate on every
+* unexplained failure.
+*
+* The COLD-START platform lines (`INIT_START` / `INIT_REPORT`, the SnapStart
+* `RESTORE_*` pair, `EXTENSION`) matter as much as the per-invoke ones here, and
+* arguably more: the IAM-propagation race this whole mechanism exists for IS a
+* cold-start phenomenon, so those lines are present precisely when this arm
+* fires. Omitting them would have left the filter inert in its own main case.
+*
+* The trailing space is load-bearing: a handler's `print("REPORT: no bucket")`
+* emits `REPORT:` and must NOT be classified as boilerplate.
+*/
+const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|RESTORE_START|RESTORE_REPORT|EXTENSION) /;
+/**
+* `true` when the tail contains at least one line the HANDLER produced.
+*
+* Deliberately a positive test for handler output rather than a length check:
+* the boilerplate lines carry a RequestId and a duration, so a tail of nothing
+* but boilerplate is several hundred characters and passes any size threshold.
+*/
+function hasHandlerLogOutput(logTail) {
+	return logTail.split("\n").some((line) => line.trim().length > 0 && !CR_LOG_TAIL_BOILERPLATE.test(line.trimStart()));
+}
+/**
 * Custom Resource Provider
 *
 * Implements Lambda-backed custom resources by invoking the Lambda function
@@ -14027,7 +14054,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 			this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 			const { response: cfnResponse, logResult } = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
 			const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
-			const logAuthzMatch = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? this.findTransientAuthzLogLine(decodeInvokeLogTail(logResult)) : void 0;
+			const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
+			const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
 			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
 				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
 				await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
@@ -14037,6 +14065,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				...cfnResponse,
 				Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
 			};
+			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
 			return cfnResponse;
 		}
 	}
@@ -14245,7 +14274,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (lambdaResponse.FunctionError) {
 			const errorPayload = lambdaResponse.Payload ? Buffer.from(lambdaResponse.Payload).toString() : "Unknown";
 			const logTail = decodeInvokeLogTail(lambdaResponse.LogResult);
-			if (logTail !== void 0) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
+			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
 			throw new Error(`Lambda function error (${lambdaResponse.FunctionError}): ${errorPayload}`);
 		}
 		let hasDirectPayload = false;
@@ -19236,6 +19265,35 @@ function recordAfterRollbackUpdate(restored, result) {
 		properties: { ...result.effectiveProperties }
 	} : restored;
 }
+/**
+* The `properties` override to merge into the state record rebuilt after the
+* reverse-replacement replay-CREATE (issue #1682) — the create-side twin of
+* {@link recordAfterRollbackUpdate}.
+*
+* The bag handed to `create()` on both arms of that path IS `prev.properties`,
+* so — exactly as on the UPDATE side — a returned `effectiveProperties` is its
+* complete replacement and no per-key delta is needed. Without this the arm
+* rebuilt the record from `prev.properties` unconditionally, so a provider that
+* deliberately SUBSTITUTED a malformed block on a replay (the `replayWarn`
+* downgrade of issue #1544) announced the substitution into a void and the
+* phantom drift it exists to close survived the rollback.
+*
+* Falls back to the restored record's own `properties` when the provider
+* reported nothing — the pre-#1682 behavior — rather than blanking the record.
+* An empty object is a legitimate COMPLETE answer (a provider that sent
+* nothing), so the gate is an explicit PRESENCE test rather than truthiness —
+* matching the `??` the contract in `.claude/rules/providers.md` prescribes,
+* and saying so at the one place a future reader would otherwise have to
+* re-derive that `{}` must not fall back.
+*
+* Applied on the name-idempotent ADOPT path too (`adoptedLiveNewResource`).
+* That arm's warning says state records "the pre-replacement properties", and
+* it still does: a substitution repairs an unusable field of that same
+* pre-replacement bag, it does not swap in the new generation's values.
+*/
+function recordedPropertiesAfterReplayCreate(restored, result) {
+	return result.effectiveProperties === void 0 ? restored.properties : { ...result.effectiveProperties };
+}
 async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
@@ -19421,7 +19479,8 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				stateResources[op.logicalId] = {
 					...prevRecord,
 					physicalId: createResult.physicalId,
-					attributes: createResult.attributes ?? {}
+					attributes: createResult.attributes ?? {},
+					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
 				};
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
@@ -19732,7 +19791,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.44";
+	return "0.280.46";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21898,4 +21957,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigArray as $, expectedOwnerParam as $t, green as A, withErrorHandling as An, getDockerCmd as At, slowCcOperationTimeoutMs as B, resolveAutoAssetStorage as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackHasActiveImportsError as Cn, ensureAssetStorage as Ct, bold as D, formatError as Dn, validateContainerRepoName as Dt, formatResourceLine as E, SynthesisError as En, validateAssetBucketName as Et, clearOnUpdateRemoval as F, Synthesizer as Ft, refStateLookupFromResource as G, resolveUseCdkBootstrapAssets as Gt, isTerminationProtectionPropagationError as H, resolveSkipPrefix as Ht, ProviderRegistry as I, synthesisStatusMessage as It, resolveExplicitPhysicalId as J, CFN_TEMPLATE_BODY_LIMIT as Jt, WAFv2WebACLProvider as K, stateBucketExistenceConfirmed as Kt, findActionableSilentDrops as L, getDefaultStateBucketName as Lt, yellow as M, runDockerStreaming as Mt, IAMRoleProvider as N, AssetManifestLoader as Nt, cyan as O, isCdkdError as On, buildDockerImage as Ot, collectInlinePolicyNamesManagedBySiblings as P, getDockerImageBySourceHash as Pt, replayWarn as Q, uploadCfnTemplate as Qt, findSilentDropProperties as R, getLegacyStateBucketName as Rt, extractDeploymentEventError as S, ResourceUpdateNotSupportedError as Sn, BOOTSTRAP_MARKER_PREFIX as St, renderStatefulReason as T, StateError as Tn, parseBootstrapMarker as Tt, IntrinsicFunctionResolver as U, resolveStateBucketWithDefault as Ut, disableInstanceApiTermination as V, resolveCaptureObservedState as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefaultAndSource as Wt, configStringRefusal as X, MIGRATE_TMP_PREFIX as Xt, assertRegionMatch as Y, CFN_TEMPLATE_URL_LIMIT as Yt, readConfigString as Z, findLargeInlineResources as Zt, createPreDeleteFinalSnapshot as _, MissingCdkCliError as _n, buildAssetRedirectMap as _t, DeploymentEventsStore as a, getAwsClients as an, withRetry as at, unsupportedFinalSnapshotError as b, ProvisioningError as bn, rewriteTemplateAssetReferences as bt, replayFailedOperations as c, AssetError as cn, DagBuilder as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DependencyError as dn, S3StateBackend as dt, AssemblyReader as en, requireConfigObject as et, computeImplicitDeleteEdges as f, DeployCancelledError as fn, rebuildClientForBucketRegion as ft, ccRoutedFinalSnapshotError as g, LockError as gn, WorkGraph as gt, buildFinalSnapshotIdentifier as h, LocalStartServiceError as hn, stringifyValue as ht, DeploymentEventsReader as i, AwsClients as in, describeTypeWithThrottleRetry as it, red as j, __exportAll as jn, runDockerForeground as jt, gray as k, normalizeAwsError as kn, formatDockerLoginError as kt, replayRollback as l, CdkdError as ln, TemplateParser as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalMigrateError as mn, AssetPublisher as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nn, applyRoleArnIfSet as nt, planFailedOps as o, resetAwsClients as on, isRetryableTransientError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalInvokeBuildError as pn, shouldRetainResource as pt, normalizeAwsTagsToCfn as q, warnDeprecatedNoPrefixCliFlag as qt, DeployEngine as r, resolveBucketRegion as rn, DiffCalculator as rt, planRollback as s, setAwsClients as sn, isThrottlingError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as tn, requireConfigString as tt, withResourceDeadline as u, ConfigError as un, LockManager as ut, isFinalSnapshotError as v, NestedStackChildDirectDestroyError as vn, createAssetRedirectResolver as vt, isStatefulRecreateTargetSync as w, StackTerminationProtectionError as wn, getBootstrapMarkerKey as wt, makeCanonicalizePropertiesFn as x, ResourceTimeoutError as xn, AssetModeResolver as xt, refusesFinalSnapshot as y, PartialFailureError as yn, loadPublishableAssetManifest as yt, CloudControlProvider as z, resolveApp as zt };
-//# sourceMappingURL=deploy-engine-nEjymkij.js.map
+//# sourceMappingURL=deploy-engine-E_JV4UqE.js.map