@go-to-k/cdkd 0.280.45 → 0.280.46

package/dist/{deploy-engine-Dnfehcah.js → deploy-engine-E_JV4UqE.js}

@@ -12915,7 +12915,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DwyF44v8.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DGHuyUA8.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13653,14 +13653,41 @@ const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
 ];
 /**
 * Cap for the backing function's log tail when it is surfaced in an EPHEMERAL
-* warning (the `FunctionError` arm). Deliberately far larger than
-* `truncateReason`'s 200-char default — a crashed handler's real cause is often
-* several lines above the last one (a Python traceback) — but not unbounded:
-* this lands in CI logs and terminal scrollback. Lambda caps the tail at 4 KB
-* regardless, so this only trims the extreme case.
+* warning — the `FunctionError` arm and the unexplained-FAILED arm. Deliberately
+* far larger than `truncateReason`'s 200-char default — a crashed handler's real
+* cause is often several lines above the last one (a Python traceback) — but not
+* unbounded: this lands in CI logs and terminal scrollback. Lambda caps the tail
+* at 4 KB regardless, so this only trims the extreme case.
 */
 const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
 /**
+* Lines Lambda emits for EVERY invocation regardless of what the handler logged.
+* A tail consisting only of these carries no diagnostic value, and it is the
+* COMMON case — `LogResult` is never absent on a `LogType: 'Tail'` invoke, so a
+* bare `!== undefined` check filters nothing and would dump boilerplate on every
+* unexplained failure.
+*
+* The COLD-START platform lines (`INIT_START` / `INIT_REPORT`, the SnapStart
+* `RESTORE_*` pair, `EXTENSION`) matter as much as the per-invoke ones here, and
+* arguably more: the IAM-propagation race this whole mechanism exists for IS a
+* cold-start phenomenon, so those lines are present precisely when this arm
+* fires. Omitting them would have left the filter inert in its own main case.
+*
+* The trailing space is load-bearing: a handler's `print("REPORT: no bucket")`
+* emits `REPORT:` and must NOT be classified as boilerplate.
+*/
+const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|RESTORE_START|RESTORE_REPORT|EXTENSION) /;
+/**
+* `true` when the tail contains at least one line the HANDLER produced.
+*
+* Deliberately a positive test for handler output rather than a length check:
+* the boilerplate lines carry a RequestId and a duration, so a tail of nothing
+* but boilerplate is several hundred characters and passes any size threshold.
+*/
+function hasHandlerLogOutput(logTail) {
+	return logTail.split("\n").some((line) => line.trim().length > 0 && !CR_LOG_TAIL_BOILERPLATE.test(line.trimStart()));
+}
+/**
 * Custom Resource Provider
 *
 * Implements Lambda-backed custom resources by invoking the Lambda function
@@ -14027,7 +14054,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 			this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 			const { response: cfnResponse, logResult } = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
 			const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
-			const logAuthzMatch = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? this.findTransientAuthzLogLine(decodeInvokeLogTail(logResult)) : void 0;
+			const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
+			const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
 			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
 				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
 				await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
@@ -14037,6 +14065,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				...cfnResponse,
 				Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
 			};
+			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
 			return cfnResponse;
 		}
 	}
@@ -14245,7 +14274,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (lambdaResponse.FunctionError) {
 			const errorPayload = lambdaResponse.Payload ? Buffer.from(lambdaResponse.Payload).toString() : "Unknown";
 			const logTail = decodeInvokeLogTail(lambdaResponse.LogResult);
-			if (logTail !== void 0) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
+			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
 			throw new Error(`Lambda function error (${lambdaResponse.FunctionError}): ${errorPayload}`);
 		}
 		let hasDirectPayload = false;
@@ -19762,7 +19791,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.45";
+	return "0.280.46";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21928,4 +21957,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigArray as $, expectedOwnerParam as $t, green as A, withErrorHandling as An, getDockerCmd as At, slowCcOperationTimeoutMs as B, resolveAutoAssetStorage as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackHasActiveImportsError as Cn, ensureAssetStorage as Ct, bold as D, formatError as Dn, validateContainerRepoName as Dt, formatResourceLine as E, SynthesisError as En, validateAssetBucketName as Et, clearOnUpdateRemoval as F, Synthesizer as Ft, refStateLookupFromResource as G, resolveUseCdkBootstrapAssets as Gt, isTerminationProtectionPropagationError as H, resolveSkipPrefix as Ht, ProviderRegistry as I, synthesisStatusMessage as It, resolveExplicitPhysicalId as J, CFN_TEMPLATE_BODY_LIMIT as Jt, WAFv2WebACLProvider as K, stateBucketExistenceConfirmed as Kt, findActionableSilentDrops as L, getDefaultStateBucketName as Lt, yellow as M, runDockerStreaming as Mt, IAMRoleProvider as N, AssetManifestLoader as Nt, cyan as O, isCdkdError as On, buildDockerImage as Ot, collectInlinePolicyNamesManagedBySiblings as P, getDockerImageBySourceHash as Pt, replayWarn as Q, uploadCfnTemplate as Qt, findSilentDropProperties as R, getLegacyStateBucketName as Rt, extractDeploymentEventError as S, ResourceUpdateNotSupportedError as Sn, BOOTSTRAP_MARKER_PREFIX as St, renderStatefulReason as T, StateError as Tn, parseBootstrapMarker as Tt, IntrinsicFunctionResolver as U, resolveStateBucketWithDefault as Ut, disableInstanceApiTermination as V, resolveCaptureObservedState as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefaultAndSource as Wt, configStringRefusal as X, MIGRATE_TMP_PREFIX as Xt, assertRegionMatch as Y, CFN_TEMPLATE_URL_LIMIT as Yt, readConfigString as Z, findLargeInlineResources as Zt, createPreDeleteFinalSnapshot as _, MissingCdkCliError as _n, buildAssetRedirectMap as _t, DeploymentEventsStore as a, getAwsClients as an, withRetry as at, unsupportedFinalSnapshotError as b, ProvisioningError as bn, rewriteTemplateAssetReferences as bt, replayFailedOperations as c, AssetError as cn, DagBuilder as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DependencyError as dn, S3StateBackend as dt, AssemblyReader as en, requireConfigObject as et, computeImplicitDeleteEdges as f, DeployCancelledError as fn, rebuildClientForBucketRegion as ft, ccRoutedFinalSnapshotError as g, LockError as gn, WorkGraph as gt, buildFinalSnapshotIdentifier as h, LocalStartServiceError as hn, stringifyValue as ht, DeploymentEventsReader as i, AwsClients as in, describeTypeWithThrottleRetry as it, red as j, __exportAll as jn, runDockerForeground as jt, gray as k, normalizeAwsError as kn, formatDockerLoginError as kt, replayRollback as l, CdkdError as ln, TemplateParser as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalMigrateError as mn, AssetPublisher as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nn, applyRoleArnIfSet as nt, planFailedOps as o, resetAwsClients as on, isRetryableTransientError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalInvokeBuildError as pn, shouldRetainResource as pt, normalizeAwsTagsToCfn as q, warnDeprecatedNoPrefixCliFlag as qt, DeployEngine as r, resolveBucketRegion as rn, DiffCalculator as rt, planRollback as s, setAwsClients as sn, isThrottlingError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as tn, requireConfigString as tt, withResourceDeadline as u, ConfigError as un, LockManager as ut, isFinalSnapshotError as v, NestedStackChildDirectDestroyError as vn, createAssetRedirectResolver as vt, isStatefulRecreateTargetSync as w, StackTerminationProtectionError as wn, getBootstrapMarkerKey as wt, makeCanonicalizePropertiesFn as x, ResourceTimeoutError as xn, AssetModeResolver as xt, refusesFinalSnapshot as y, PartialFailureError as yn, loadPublishableAssetManifest as yt, CloudControlProvider as z, resolveApp as zt };
-//# sourceMappingURL=deploy-engine-Dnfehcah.js.map
+//# sourceMappingURL=deploy-engine-E_JV4UqE.js.map