@go-to-k/cdkd 0.283.8 → 0.283.9

package/dist/{deploy-engine-D95wmKN8.js → deploy-engine-CWt7h7Nc.js}

@@ -56,219 +56,560 @@ var __exportAll = (all, no_symbols) => {
 };
 
 //#endregion
-//#region src/utils/error-handler.ts
-/**
-* Base error class for cdkd
-*/
-var CdkdError = class CdkdError extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.code = code;
-		this.cause = cause;
-		this.name = "CdkdError";
-		Object.setPrototypeOf(this, CdkdError.prototype);
-	}
-};
+//#region src/deployment/retryable-errors.ts
 /**
-* State management errors
+* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* an AWS service rejecting a call because a just-created IAM entity (role,
+* trust policy, inline policy, instance profile, principal) has not propagated
+* to that service's authorization layer yet.
+*
+* Kept as its own array — and composed back into the full transient table
+* below — so there is exactly ONE list per pattern (no parallel classifier to
+* drift). It exists because this class has a materially different RECOVERY
+* SHAPE from the other transient errors: it resolves in single-digit seconds,
+* so `withRetry` polls it on a dense sub-second schedule instead of the
+* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
+* for long resource-state transitions, and wrong here — see
+* {@link file://../deployment/retry.ts}).
+*
+* When adding a new pattern: put it here if the fix is "wait a moment and ask
+* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
+* misfiled entry only changes the retry CADENCE, never whether the error is
+* retryable at all.
 */
-var StateError = class StateError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "STATE_ERROR", cause);
-		this.name = "StateError";
-		Object.setPrototypeOf(this, StateError.prototype);
-	}
-};
+const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"is unable to assume the role",
+	"security token included in the request is invalid. (Service:",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"Invalid principal in policy",
+	"Verify in IAM that the role has adequate trust relationships",
+	"The user with name",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"is not a valid role to allow SNS"
+];
 /**
-* Lock acquisition errors
+* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* transient failures whose recovery window is either long (SQS's 60s same-name
+* cooldown, a resource still leaving a Pending/Creating state) or genuinely
+* load-related (throttling), where hammering AWS with dense retries is harmful
+* and exponential backoff is the correct shape.
 */
-var LockError = class LockError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCK_ERROR", cause);
-		this.name = "LockError";
-		Object.setPrototypeOf(this, LockError.prototype);
-	}
-};
+const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded",
+	"is marked disabled for mutation",
+	"There is an operation running on the Cluster",
+	"Unable to complete operation due to concurrent modification"
+];
 /**
-* Synthesis errors
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*
+* Composed from the two halves above so retryability has ONE source of truth
+* while `withRetry` can still pick a per-class backoff cadence.
 */
-var SynthesisError = class SynthesisError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "SYNTHESIS_ERROR", cause);
-		this.name = "SynthesisError";
-		Object.setPrototypeOf(this, SynthesisError.prototype);
-	}
-};
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
 /**
-* Control-flow signal: the user declined a pre-provisioning confirmation
-* prompt, so the deploy must unwind WITHOUT being reported as a failure.
-*
-* Raised from `DeployEngineOptions.onCurrentStateLoaded` (the post-lock
-* gate the `--prefix-user-supplied-names` migration check runs in). The
-* engine does not catch it — it propagates out of `deploy()` through the
-* usual `finally`, which releases the lock and stops the renderer — and the
-* deploy CLI catches it and returns quietly instead of logging an error or
-* recording a FAILED run event. Nothing has been provisioned at that point.
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
 */
-var DeployCancelledError = class DeployCancelledError extends CdkdError {
-	constructor(message = "Deployment cancelled by user") {
-		super(message, "DEPLOY_CANCELLED");
-		this.name = "DeployCancelledError";
-		Object.setPrototypeOf(this, DeployCancelledError.prototype);
-	}
-};
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
 /**
-* Asset errors
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
 */
-var AssetError = class AssetError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "ASSET_ERROR", cause);
-		this.name = "AssetError";
-		Object.setPrototypeOf(this, AssetError.prototype);
-	}
-};
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
 /**
-* Local-invoke `docker build` failures.
+* Marker for an error cdkd raised as a DELIBERATE refusal rather than as a
+* relayed AWS failure (issue [#1778](https://github.com/go-to-k/cdkd/issues/1778)).
 *
-* Surfaces the stderr captured from `docker build` so the user can
-* re-run the same command directly to debug Dockerfile syntax errors
-* or missing build context. Used by `src/local/docker-image-builder.ts`
-* (PR 5) for container Lambdas; the parallel `AssetError` covers the
-* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
-* `AssetError` so `cdkd local invoke` failures don't show up under the
-* "asset" error class.
+* Every classifier below is SUBSTRING-based, which is the right shape for
+* relaying a vendor's message and the wrong one for cdkd's own prose: a
+* refusal message is assembled from values cdkd does not control — a provider
+* `reason`, a state-borne physicalId, a template logical id — and any of them
+* can happen to contain a retryable pattern. Measured: a resource named
+* `MyDependencyViolationSub` puts `DependencyViolation` in the message, so a
+* deterministic refusal was classified transient and burned the whole backoff
+* schedule before failing exactly as it would have immediately. Keeping the
+* offending values OUT of the message narrows that surface but cannot close
+* it, because a message with no identifiers at all is not diagnosable.
+*
+* A marker inverts the burden: the raiser STATES that the error is terminal,
+* so no wording can make it retryable. Deliberately a `Symbol.for` key —
+* global-registry symbols survive a duplicated module instance (dual
+* bundling), where a module-local symbol would silently stop matching — and
+* non-enumerable, so it cannot leak into a serialized error payload.
 */
-var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
-		this.name = "LocalInvokeBuildError";
-		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
-	}
-};
+const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 /**
-* Resource provisioning errors
+* Mark a cdkd-authored refusal as terminal and return it, for
+* `throw markNonRetryable(new ProvisioningError(...))`.
+*
+* Reach for it when the error means "this cannot succeed on a retry" as a
+* matter of cdkd's own logic — NOT for a relayed AWS failure, whose
+* retryability is the classifiers' business.
+*
+* The known live instance this JSDoc used to flag as uncovered —
+* `ResourceUpdateNotSupportedError` (`src/utils/error-handler.ts`), which
+* interpolates the logical id and is thrown by ~20 providers from inside the
+* retried `update()` in `deploy-engine.ts` — IS covered as of issue
+* [#1838](https://github.com/go-to-k/cdkd/issues/1838): it marks itself in its
+* CONSTRUCTOR, so every construction is terminal and no provider throw site
+* has to remember. That is the shape to prefer for a whole error CLASS that is
+* always a refusal; mark at the `throw` (as the SNS abort below does) only
+* when the class is retryable in general and this one raising of it is not.
 */
-var ProvisioningError = class ProvisioningError extends CdkdError {
-	resourceType;
-	logicalId;
-	physicalId;
-	constructor(message, resourceType, logicalId, physicalId, cause) {
-		super(message, "PROVISIONING_ERROR", cause);
-		this.resourceType = resourceType;
-		this.logicalId = logicalId;
-		this.physicalId = physicalId;
-		this.name = "ProvisioningError";
-		Object.setPrototypeOf(this, ProvisioningError.prototype);
-	}
-};
+function markNonRetryable(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
 /**
-* Resource provisioning timeout errors (per-resource wall-clock deadline).
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markNonRetryable}.
 *
-* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
-* operation exceeds the user-configured `--resource-timeout`. The deploy
-* engine catches this, wraps it in {@link ProvisioningError}, and lets the
-* existing failure path (interrupt siblings → pre-rollback save → rollback
-* unless `--no-rollback`) take over.
+* The chain walk mirrors {@link isThrottlingError}'s: cdkd wraps errors, so a
+* marked refusal can end up one or more links deep, and a marker that stopped
+* counting after a single wrap would be a fence that quietly falls open.
 *
-* The message intentionally names the resource, type, region, elapsed time
-* and operation, plus how to override the default. Long-running providers
-* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
-* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
-* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
-* specific non-self-reporting type or shorten a self-reported one.
-*/
-var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
-	logicalId;
-	resourceType;
-	region;
-	elapsedMs;
-	operation;
-	timeoutMs;
-	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
-		const elapsedLabel = formatDuration(elapsedMs);
-		const timeoutLabel = formatDuration(timeoutMs);
-		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
-slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
-underlying provider activity.`, "RESOURCE_TIMEOUT");
-		this.logicalId = logicalId;
-		this.resourceType = resourceType;
-		this.region = region;
-		this.elapsedMs = elapsedMs;
-		this.operation = operation;
-		this.timeoutMs = timeoutMs;
-		this.name = "ResourceTimeoutError";
-		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+* That reach is DIRECTIONAL, and the upward direction is a hazard worth
+* stating. Downward — a marked refusal wrapped by an outer error — is the
+* intended case and stays terminal. UPWARD is the inverse: wrapping a marked
+* refusal as the `cause` of a genuinely RETRYABLE outer error
+* (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
+* too, because this walk finds the marker on the cause. Unconstructible today
+* (`ProvisioningError` is built with no `cause` at the one marking site), and
+* the failure is fail-fast rather than silent, but a future wrapper that
+* carries a marked cause into a transient error would stop retrying something
+* that should retry. Strip or re-raise the cause there rather than nesting it.
+*/
+function isMarkedNonRetryable(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[NON_RETRYABLE_MARKER] === true) return true;
+		}
+		current = current.cause;
 	}
-};
+	return false;
+}
 /**
-* Format a duration in milliseconds as a short human-readable label
-* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
-* error message stays compact.
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
+*
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed.
 */
-function formatDuration(ms) {
-	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
-	const totalMinutes = Math.round(ms / 6e4);
-	if (totalMinutes < 60) return `${totalMinutes}m`;
-	const hours = Math.floor(totalMinutes / 60);
-	const minutes = totalMinutes % 60;
-	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
 }
 /**
-* A DELIBERATE refusal to resolve an intrinsic function, as opposed to a
-* "the referenced thing does not exist" miss (issue
-* [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
+* Determine whether an AWS error should be retried.
 *
-* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
-* resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
-* the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
-* long-standing, deliberate behavior for a genuinely unknown variable — but a
-* bare `catch` around it also swallowed every REFUSAL the resolver raises on
-* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
-* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
-* that hard-fails when the reference sits in a resource property silently
-* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
-* IDENTICAL reference was written inside an `Fn::Sub`.
+* Checks (in order):
+*   0. {@link isMarkedNonRetryable} — a cdkd-authored refusal is terminal by
+*      declaration, ahead of every message / name heuristic below. FIRST on
+*      purpose: the marker states the error cannot succeed on a retry, so
+*      nothing a later check reads out of the message can overturn it.
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*/
+function isRetryableTransientError(error, message) {
+	if (isMarkedNonRetryable(error)) return false;
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
+* True when the message is a just-created-IAM-entity propagation rejection
+* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
 *
-* Throwing this class rather than a bare `Error` is what lets that catch
-* re-raise a refusal (carrying its own message and remedy) while leaving the
-* not-found path on warn-and-keep. Nothing else branches on it.
+* This does NOT decide retryability — every pattern it matches is already in
+* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
+* `withRetry` polls this class densely (sub-second initial delay, low cap)
+* because IAM propagation resolves in single-digit seconds, whereas the
+* generic exponential schedule is tuned for throttling and long resource-state
+* transitions.
+*
+* Deliberately message-only (no error-object inspection): the propagation
+* signal is always carried in the vendor's message text, and cdkd wraps the
+* original error in a `ProvisioningError` that preserves it.
 */
-var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+function isIamPropagationError(message) {
+	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
+* Match the "already exists" name-collision signature raised when a create
+* targets a physical name still held by another resource (or by the same
+* name's not-yet-released tombstone after an async delete).
+*
+* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
+* collision is only worth retrying at the specific re-create sites that just
+* deleted the old holder (the deploy engine's --replace delete-first fallback
+* and the rollback executor's reverse-replacement) — everywhere else it is a
+* genuine conflict that must fail fast. Shared by those sites' collision
+* detection + retry filters so a signature extension lands in one place.
+*
+* The optional `s` is load-bearing, not defensive spelling (issue #1625):
+* Lambda's `CreateFunction` raises `ResourceConflictException: Function
+* already exist: <name>` — SINGULAR — so the `already exists` form missed it
+* entirely and NO Lambda function could take the collision path. The
+* consequence was not a cosmetic message: a property-driven replacement of a
+* Lambda (dropping `DurableConfig`, changing `TenancyConfig`) create-firsts
+* into its own still-live name, the raw `ResourceConflictException` escaped
+* instead of the actionable `NAMED_REPLACEMENT_COLLISION` error, and
+* `cdkd deploy --replace`'s delete-first fallback never fired — so the
+* replacement was unperformable by any flag. Verified against real AWS
+* (us-east-1, 2026-08-12) by creating one function name twice.
+*
+* Two fences keep the widened arm from crediting a NON-collision, which
+* matters because the sites that consult it react DESTRUCTIVELY (the
+* `--replace` delete-first fallback deletes the old resource):
+*  - `\b` after `exists?` rejects a participle ("already existed as a draft");
+*  - the lookbehind rejects a NEGATED or MODAL phrase — "the bucket does NOT
+*    already exist", "the destination bucket MUST already exist" — which the
+*    bare pattern matched. The modal form is the one that bites: a create
+*    rejected for a missing PREREQUISITE would be reported to the user as a
+*    name collision pointing at `--replace`, and following that advice
+*    deletes the live old resource before the re-create fails again for the
+*    same reason, leaving it absent from AWS with state still recording it.
+* The error-CODE arm stays exact (`AlreadyExists`): the singular
+* `AlreadyExist` is not an AWS code spelling, and loosening it would match
+* inside unrelated identifiers.
+*
+* Classification stays MESSAGE-based rather than moving to the exception
+* NAME, and that is load-bearing here rather than inherited: Lambda raises
+* `ResourceConflictException` for a function in a PENDING state too (see
+* `lambda-function-provider.ts`), so keying on the name would classify a
+* transient state conflict as a collision and delete a live function under
+* `--replace`.
+*/
+function isNameCollisionError(message) {
+	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
+}
+/**
+* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
+* a queue with the SAME name inside ~60s fails with
+* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
+* after deleting a queue before you can create another with the same name").
+*
+* The generic transient table above already carries 'wait 60 seconds' for
+* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
+* sites (the deploy engine's --replace delete-first fallback and the rollback
+* executor's reverse-replacement) override the retry filter with
+* {@link isNameCollisionError}, which this signature does NOT match — so a
+* replacement revert used to fail fast mid-flight with the resource absent
+* from both AWS and state (issue #1206). Those sites now OR this matcher into
+* their retry filter, with a schedule long enough to cover the 60s window.
+*
+* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
+* create-first site must NOT be treated as a collision (deleting the new
+* resource would not release the cooldown on the old name).
+*/
+function isNameCooldownError(message) {
+	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
+}
+/**
+* Retry filter for the delete-then-re-create sites: the old name holder was
+* just deleted, so both the late name release ("already exists" from an async
+* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
+* schedule that covers the full cooldown window (maxRetries 8, delays
+* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
+*/
+function isRecreateRetryableError(message) {
+	return isNameCollisionError(message) || isNameCooldownError(message);
+}
+
+//#endregion
+//#region src/utils/error-handler.ts
+/**
+* Base error class for cdkd
+*/
+var CdkdError = class CdkdError extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "CdkdError";
+		Object.setPrototypeOf(this, CdkdError.prototype);
+	}
+};
+/**
+* State management errors
+*/
+var StateError = class StateError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
-		this.name = "IntrinsicResolutionRefusalError";
-		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+		super(message, "STATE_ERROR", cause);
+		this.name = "StateError";
+		Object.setPrototypeOf(this, StateError.prototype);
 	}
 };
 /**
-* Dependency resolution errors
+* Lock acquisition errors
 */
-var DependencyError = class DependencyError extends CdkdError {
+var LockError = class LockError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "DEPENDENCY_ERROR", cause);
-		this.name = "DependencyError";
-		Object.setPrototypeOf(this, DependencyError.prototype);
+		super(message, "LOCK_ERROR", cause);
+		this.name = "LockError";
+		Object.setPrototypeOf(this, LockError.prototype);
 	}
 };
 /**
-* Configuration errors
+* Synthesis errors
 */
-var ConfigError = class ConfigError extends CdkdError {
+var SynthesisError = class SynthesisError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "CONFIG_ERROR", cause);
-		this.name = "ConfigError";
-		Object.setPrototypeOf(this, ConfigError.prototype);
+		super(message, "SYNTHESIS_ERROR", cause);
+		this.name = "SynthesisError";
+		Object.setPrototypeOf(this, SynthesisError.prototype);
 	}
 };
 /**
-* Signals a partial-failure outcome that should map to exit code 2 (not 1).
+* Control-flow signal: the user declined a pre-provisioning confirmation
+* prompt, so the deploy must unwind WITHOUT being reported as a failure.
 *
-* Used by `cdkd destroy` and `cdkd state destroy` when one or more
-* per-resource deletes failed but the overall command finished its work
-* (state.json is preserved, the rest of the stack was deleted, and the
-* user can re-run to clean up the remaining resources).
+* Raised from `DeployEngineOptions.onCurrentStateLoaded` (the post-lock
+* gate the `--prefix-user-supplied-names` migration check runs in). The
+* engine does not catch it — it propagates out of `deploy()` through the
+* usual `finally`, which releases the lock and stops the renderer — and the
+* deploy CLI catches it and returns quietly instead of logging an error or
+* recording a FAILED run event. Nothing has been provisioned at that point.
+*/
+var DeployCancelledError = class DeployCancelledError extends CdkdError {
+	constructor(message = "Deployment cancelled by user") {
+		super(message, "DEPLOY_CANCELLED");
+		this.name = "DeployCancelledError";
+		Object.setPrototypeOf(this, DeployCancelledError.prototype);
+	}
+};
+/**
+* Asset errors
+*/
+var AssetError = class AssetError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "ASSET_ERROR", cause);
+		this.name = "AssetError";
+		Object.setPrototypeOf(this, AssetError.prototype);
+	}
+};
+/**
+* Local-invoke `docker build` failures.
+*
+* Surfaces the stderr captured from `docker build` so the user can
+* re-run the same command directly to debug Dockerfile syntax errors
+* or missing build context. Used by `src/local/docker-image-builder.ts`
+* (PR 5) for container Lambdas; the parallel `AssetError` covers the
+* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
+* `AssetError` so `cdkd local invoke` failures don't show up under the
+* "asset" error class.
+*/
+var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+		this.name = "LocalInvokeBuildError";
+		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
+	}
+};
+/**
+* Resource provisioning errors
+*/
+var ProvisioningError = class ProvisioningError extends CdkdError {
+	resourceType;
+	logicalId;
+	physicalId;
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, "PROVISIONING_ERROR", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.physicalId = physicalId;
+		this.name = "ProvisioningError";
+		Object.setPrototypeOf(this, ProvisioningError.prototype);
+	}
+};
+/**
+* Resource provisioning timeout errors (per-resource wall-clock deadline).
+*
+* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
+* operation exceeds the user-configured `--resource-timeout`. The deploy
+* engine catches this, wraps it in {@link ProvisioningError}, and lets the
+* existing failure path (interrupt siblings → pre-rollback save → rollback
+* unless `--no-rollback`) take over.
+*
+* The message intentionally names the resource, type, region, elapsed time
+* and operation, plus how to override the default. Long-running providers
+* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
+* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
+* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
+* specific non-self-reporting type or shorten a self-reported one.
+*/
+var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
+	logicalId;
+	resourceType;
+	region;
+	elapsedMs;
+	operation;
+	timeoutMs;
+	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+		const elapsedLabel = formatDuration(elapsedMs);
+		const timeoutLabel = formatDuration(timeoutMs);
+		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
+slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
+underlying provider activity.`, "RESOURCE_TIMEOUT");
+		this.logicalId = logicalId;
+		this.resourceType = resourceType;
+		this.region = region;
+		this.elapsedMs = elapsedMs;
+		this.operation = operation;
+		this.timeoutMs = timeoutMs;
+		this.name = "ResourceTimeoutError";
+		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+	}
+};
+/**
+* Format a duration in milliseconds as a short human-readable label
+* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
+* error message stays compact.
+*/
+function formatDuration(ms) {
+	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+	const totalMinutes = Math.round(ms / 6e4);
+	if (totalMinutes < 60) return `${totalMinutes}m`;
+	const hours = Math.floor(totalMinutes / 60);
+	const minutes = totalMinutes % 60;
+	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
+/**
+* A DELIBERATE refusal to resolve an intrinsic function, as opposed to a
+* "the referenced thing does not exist" miss (issue
+* [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
+*
+* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
+* resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
+* the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
+* long-standing, deliberate behavior for a genuinely unknown variable — but a
+* bare `catch` around it also swallowed every REFUSAL the resolver raises on
+* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
+* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
+* that hard-fails when the reference sits in a resource property silently
+* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
+* IDENTICAL reference was written inside an `Fn::Sub`.
+*
+* Throwing this class rather than a bare `Error` is what lets that catch
+* re-raise a refusal (carrying its own message and remedy) while leaving the
+* not-found path on warn-and-keep. Nothing else branches on it.
+*/
+var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
+		this.name = "IntrinsicResolutionRefusalError";
+		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+	}
+};
+/**
+* Dependency resolution errors
+*/
+var DependencyError = class DependencyError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "DEPENDENCY_ERROR", cause);
+		this.name = "DependencyError";
+		Object.setPrototypeOf(this, DependencyError.prototype);
+	}
+};
+/**
+* Configuration errors
+*/
+var ConfigError = class ConfigError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "CONFIG_ERROR", cause);
+		this.name = "ConfigError";
+		Object.setPrototypeOf(this, ConfigError.prototype);
+	}
+};
+/**
+* Signals a partial-failure outcome that should map to exit code 2 (not 1).
+*
+* Used by `cdkd destroy` and `cdkd state destroy` when one or more
+* per-resource deletes failed but the overall command finished its work
+* (state.json is preserved, the rest of the stack was deleted, and the
+* user can re-run to clean up the remaining resources).
 *
 * Exit code conventions:
 *   - 0: command completed successfully, no resources left in error state.
@@ -310,6 +651,27 @@ var PartialFailureError = class PartialFailureError extends CdkdError {
 * success rather than fatal — the rest of the drifted resources still
 * had their `update` invoked, and the user has a clear next step printed
 * for the unsupported one.
+*
+* **Marked non-retryable in the constructor** (issue
+* [#1838](https://github.com/go-to-k/cdkd/issues/1838)). This is a
+* deterministic, cdkd-authored refusal — the deploy engine matches it BY
+* CLASS to choose the `--replace` DELETE+CREATE fallback, and `cdkd drift
+* --revert` reports it as its own per-resource outcome — so it can never
+* succeed on a retry, whatever its message happens to say. That last clause
+* is the whole point: the message interpolates the resource's LOGICAL ID,
+* and the retry classifiers match by SUBSTRING, so a perfectly ordinary
+* composite CDK id like `MyDependencyViolationSub` made
+* `isRetryableTransientError` return true (`DependencyViolation` is the only
+* whitespace-free entry in `RETRYABLE_ERROR_MESSAGE_PATTERNS`) and burned the
+* full generic schedule — 8 retries, ~47s of pure sleep — on a path that was
+* never going to succeed, before the fallback the error exists to trigger was
+* even reached.
+*
+* Marking in the CONSTRUCTOR rather than at each `throw` is deliberate: ~20
+* providers raise this from inside the `update()` call `deploy-engine.ts`
+* wraps in `withRetry` (plus `drift.ts`'s `--revert` update), and a per-site
+* marker is one forgotten call away from re-opening the hole for exactly one
+* provider.
 */
 var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError extends CdkdError {
 	exitCode = 2;
@@ -330,6 +692,7 @@ var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError exte
 		this.suggestion = suggestion;
 		this.name = "ResourceUpdateNotSupportedError";
 		Object.setPrototypeOf(this, ResourceUpdateNotSupportedError.prototype);
+		markNonRetryable(this);
 	}
 };
 /**
@@ -8115,346 +8478,6 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
-* an AWS service rejecting a call because a just-created IAM entity (role,
-* trust policy, inline policy, instance profile, principal) has not propagated
-* to that service's authorization layer yet.
-*
-* Kept as its own array — and composed back into the full transient table
-* below — so there is exactly ONE list per pattern (no parallel classifier to
-* drift). It exists because this class has a materially different RECOVERY
-* SHAPE from the other transient errors: it resolves in single-digit seconds,
-* so `withRetry` polls it on a dense sub-second schedule instead of the
-* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
-* for long resource-state transitions, and wrong here — see
-* {@link file://../deployment/retry.ts}).
-*
-* When adding a new pattern: put it here if the fix is "wait a moment and ask
-* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
-* misfiled entry only changes the retry CADENCE, never whether the error is
-* retryable at all.
-*/
-const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"is unable to assume the role",
-	"security token included in the request is invalid. (Service:",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"Invalid principal in policy",
-	"Verify in IAM that the role has adequate trust relationships",
-	"The user with name",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"is not a valid role to allow SNS"
-];
-/**
-* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
-* transient failures whose recovery window is either long (SQS's 60s same-name
-* cooldown, a resource still leaving a Pending/Creating state) or genuinely
-* load-related (throttling), where hammering AWS with dense retries is harmful
-* and exponential backoff is the correct shape.
-*/
-const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded",
-	"is marked disabled for mutation",
-	"There is an operation running on the Cluster",
-	"Unable to complete operation due to concurrent modification"
-];
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*
-* Composed from the two halves above so retryability has ONE source of truth
-* while `withRetry` can still pick a per-class backoff cadence.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Marker for an error cdkd raised as a DELIBERATE refusal rather than as a
-* relayed AWS failure (issue [#1778](https://github.com/go-to-k/cdkd/issues/1778)).
-*
-* Every classifier below is SUBSTRING-based, which is the right shape for
-* relaying a vendor's message and the wrong one for cdkd's own prose: a
-* refusal message is assembled from values cdkd does not control — a provider
-* `reason`, a state-borne physicalId, a template logical id — and any of them
-* can happen to contain a retryable pattern. Measured: a resource named
-* `MyDependencyViolationSub` puts `DependencyViolation` in the message, so a
-* deterministic refusal was classified transient and burned the whole backoff
-* schedule before failing exactly as it would have immediately. Keeping the
-* offending values OUT of the message narrows that surface but cannot close
-* it, because a message with no identifiers at all is not diagnosable.
-*
-* A marker inverts the burden: the raiser STATES that the error is terminal,
-* so no wording can make it retryable. Deliberately a `Symbol.for` key —
-* global-registry symbols survive a duplicated module instance (dual
-* bundling), where a module-local symbol would silently stop matching — and
-* non-enumerable, so it cannot leak into a serialized error payload.
-*/
-const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
-/**
-* Mark a cdkd-authored refusal as terminal and return it, for
-* `throw markNonRetryable(new ProvisioningError(...))`.
-*
-* Reach for it when the error means "this cannot succeed on a retry" as a
-* matter of cdkd's own logic — NOT for a relayed AWS failure, whose
-* retryability is the classifiers' business.
-*
-* KNOWN LIVE INSTANCE NOT YET COVERED: `ResourceUpdateNotSupportedError`
-* (`src/utils/error-handler.ts`) interpolates the logical id and is thrown by
-* ~20 providers from inside the retried `update()` in `deploy-engine.ts`, so a
-* stack with a resource named e.g. `MyDependencyViolationSub` burns the full
-* ~47s backoff schedule before the `--replace` fallback is even reached. That
-* is a LIVE occurrence of the class this marker exists for, unlike the
-* latent-today SNS abort that motivated it. Marking it belongs in that error's
-* constructor, in a file this change does not own; tracked separately.
-*/
-function markNonRetryable(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-/**
-* True when the error, or anything in its bounded `.cause` chain, was marked
-* by {@link markNonRetryable}.
-*
-* The chain walk mirrors {@link isThrottlingError}'s: cdkd wraps errors, so a
-* marked refusal can end up one or more links deep, and a marker that stopped
-* counting after a single wrap would be a fence that quietly falls open.
-*
-* That reach is DIRECTIONAL, and the upward direction is a hazard worth
-* stating. Downward — a marked refusal wrapped by an outer error — is the
-* intended case and stays terminal. UPWARD is the inverse: wrapping a marked
-* refusal as the `cause` of a genuinely RETRYABLE outer error
-* (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
-* too, because this walk finds the marker on the cause. Unconstructible today
-* (`ProvisioningError` is built with no `cause` at the one marking site), and
-* the failure is fail-fast rather than silent, but a future wrapper that
-* carries a marked cause into a transient error would stop retrying something
-* that should retry. Strip or re-raise the cause there rather than nesting it.
-*/
-function isMarkedNonRetryable(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		if (typeof current === "object" || typeof current === "function") {
-			if (current[NON_RETRYABLE_MARKER] === true) return true;
-		}
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   0. {@link isMarkedNonRetryable} — a cdkd-authored refusal is terminal by
-*      declaration, ahead of every message / name heuristic below. FIRST on
-*      purpose: the marker states the error cannot succeed on a retry, so
-*      nothing a later check reads out of the message can overturn it.
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isMarkedNonRetryable(error)) return false;
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-/**
-* True when the message is a just-created-IAM-entity propagation rejection
-* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
-*
-* This does NOT decide retryability — every pattern it matches is already in
-* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
-* `withRetry` polls this class densely (sub-second initial delay, low cap)
-* because IAM propagation resolves in single-digit seconds, whereas the
-* generic exponential schedule is tuned for throttling and long resource-state
-* transitions.
-*
-* Deliberately message-only (no error-object inspection): the propagation
-* signal is always carried in the vendor's message text, and cdkd wraps the
-* original error in a `ProvisioningError` that preserves it.
-*/
-function isIamPropagationError(message) {
-	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-/**
-* Match the "already exists" name-collision signature raised when a create
-* targets a physical name still held by another resource (or by the same
-* name's not-yet-released tombstone after an async delete).
-*
-* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
-* collision is only worth retrying at the specific re-create sites that just
-* deleted the old holder (the deploy engine's --replace delete-first fallback
-* and the rollback executor's reverse-replacement) — everywhere else it is a
-* genuine conflict that must fail fast. Shared by those sites' collision
-* detection + retry filters so a signature extension lands in one place.
-*
-* The optional `s` is load-bearing, not defensive spelling (issue #1625):
-* Lambda's `CreateFunction` raises `ResourceConflictException: Function
-* already exist: <name>` — SINGULAR — so the `already exists` form missed it
-* entirely and NO Lambda function could take the collision path. The
-* consequence was not a cosmetic message: a property-driven replacement of a
-* Lambda (dropping `DurableConfig`, changing `TenancyConfig`) create-firsts
-* into its own still-live name, the raw `ResourceConflictException` escaped
-* instead of the actionable `NAMED_REPLACEMENT_COLLISION` error, and
-* `cdkd deploy --replace`'s delete-first fallback never fired — so the
-* replacement was unperformable by any flag. Verified against real AWS
-* (us-east-1, 2026-08-12) by creating one function name twice.
-*
-* Two fences keep the widened arm from crediting a NON-collision, which
-* matters because the sites that consult it react DESTRUCTIVELY (the
-* `--replace` delete-first fallback deletes the old resource):
-*  - `\b` after `exists?` rejects a participle ("already existed as a draft");
-*  - the lookbehind rejects a NEGATED or MODAL phrase — "the bucket does NOT
-*    already exist", "the destination bucket MUST already exist" — which the
-*    bare pattern matched. The modal form is the one that bites: a create
-*    rejected for a missing PREREQUISITE would be reported to the user as a
-*    name collision pointing at `--replace`, and following that advice
-*    deletes the live old resource before the re-create fails again for the
-*    same reason, leaving it absent from AWS with state still recording it.
-* The error-CODE arm stays exact (`AlreadyExists`): the singular
-* `AlreadyExist` is not an AWS code spelling, and loosening it would match
-* inside unrelated identifiers.
-*
-* Classification stays MESSAGE-based rather than moving to the exception
-* NAME, and that is load-bearing here rather than inherited: Lambda raises
-* `ResourceConflictException` for a function in a PENDING state too (see
-* `lambda-function-provider.ts`), so keying on the name would classify a
-* transient state conflict as a collision and delete a live function under
-* `--replace`.
-*/
-function isNameCollisionError(message) {
-	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
-}
-/**
-* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
-* a queue with the SAME name inside ~60s fails with
-* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
-* after deleting a queue before you can create another with the same name").
-*
-* The generic transient table above already carries 'wait 60 seconds' for
-* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
-* sites (the deploy engine's --replace delete-first fallback and the rollback
-* executor's reverse-replacement) override the retry filter with
-* {@link isNameCollisionError}, which this signature does NOT match — so a
-* replacement revert used to fail fast mid-flight with the resource absent
-* from both AWS and state (issue #1206). Those sites now OR this matcher into
-* their retry filter, with a schedule long enough to cover the 60s window.
-*
-* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
-* create-first site must NOT be treated as a collision (deleting the new
-* resource would not release the cooldown on the old name).
-*/
-function isNameCooldownError(message) {
-	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
-}
-/**
-* Retry filter for the delete-then-re-create sites: the old name holder was
-* just deleted, so both the late name release ("already exists" from an async
-* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
-* schedule that covers the full cooldown window (maxRetries 8, delays
-* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
-*/
-function isRecreateRetryableError(message) {
-	return isNameCollisionError(message) || isNameCooldownError(message);
-}
-
 //#endregion
 //#region src/deployment/retry.ts
 /**
@@ -13971,7 +13994,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Tu4sDbhu.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D5ZBSgh2.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -21025,7 +21048,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.8";
+	return "0.283.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23241,5 +23264,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, resolveAutoAssetStorage as $t, cyan as A, LocalMigrateError as An, createAssetRedirectResolver as At, findSilentDropProperties as B, StackTerminationProtectionError as Bn, buildDenyExternalAccessPolicy as Bt, makeCanonicalizePropertiesFn as C, setAwsClients as Cn, S3StateBackend as Ct, renderStatefulReason as D, DependencyError as Dn, stringifyValue as Dt, isStatefulRecreateTargetSync as E, ConfigError as En, AssetPublisher as Et, IAMRoleProvider as F, PartialFailureError as Fn, ensureAssetStorage as Ft, IntrinsicFunctionResolver as G, normalizeAwsError as Gn, runDockerStreaming as Gt, slowCcOperationTimeoutMs as H, SynthesisError as Hn, formatDockerLoginError as Ht, collectInlinePolicyNamesManagedBySiblings as I, ProvisioningError as In, getBootstrapMarkerKey as It, refStateLookupFromResource as J, Synthesizer as Jt, cfnRefValueFromPhysicalId as K, withErrorHandling as Kn, AssetManifestLoader as Kt, clearOnUpdateRemoval as L, ResourceTimeoutError as Ln, parseBootstrapMarker as Lt, green as M, LockError as Mn, rewriteTemplateAssetReferences as Mt, red as N, MissingCdkCliError as Nn, AssetModeResolver as Nt, formatResourceLine as O, DeployCancelledError as On, WorkGraph as Ot, yellow as P, NestedStackChildDirectDestroyError as Pn, BOOTSTRAP_MARKER_PREFIX as Pt, assertRegionMatch as Q, resolveApp as Qt, ProviderRegistry as R, ResourceUpdateNotSupportedError as Rn, validateAssetBucketName as Rt, unsupportedFinalSnapshotError as S, resetAwsClients as Sn, LockManager as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, CdkdError as Tn, shouldRetainResource as Tt, disableInstanceApiTermination as U, formatError as Un, getDockerCmd as Ut, CloudControlProvider as V, StateError as Vn, buildDockerImage as Vt, isTerminationProtectionPropagationError as W, isCdkdError as Wn, runDockerForeground as Wt, normalizeAwsTagsToCfn as X, getDefaultStateBucketName as Xt, WAFv2WebACLProvider as Y, synthesisStatusMessage as Yt, resolveExplicitPhysicalId as Z, getLegacyStateBucketName as Zt, buildFinalSnapshotIdentifier as _, processStackMessages as _n, isRetryableTransientError as _t, DeploymentEventsStore as a, stateBucketExistenceConfirmed as an, requireConfigObject as at, isFinalSnapshotError as b, AwsClients as bn, DagBuilder as bt, replayFailedOperations as c, CFN_TEMPLATE_URL_LIMIT as cn, s3BucketDomainName as ct, deleteSkipReason as d, uploadCfnTemplate as dn, s3BucketWebsiteUrl as dt, resolveCaptureObservedState as en, configBooleanRefusal as et, withResourceDeadline as f, expectedOwnerParam as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, AssemblyReader as gn, isMarkedNonRetryable as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, derivePartitionAndUrlSuffix as hn, withRetry as ht, DeploymentEventsReader as i, resolveUseCdkBootstrapAssets as in, requireConfigArray as it, gray as j, LocalStartServiceError as jn, loadPublishableAssetManifest as jt, bold as k, LocalInvokeBuildError as kn, buildAssetRedirectMap as kt, replayRollback as l, MIGRATE_TMP_PREFIX as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, canonicalizeRegion as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefault as nn, readConfigString as nt, planFailedOps as o, warnDeprecatedNoPrefixCliFlag as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, PARTITION_TABLE as pn, DiffCalculator as pt, getAccountInfo as q, __exportAll as qn, getDockerImageBySourceHash as qt, DeployEngine as r, resolveStateBucketWithDefaultAndSource as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_BODY_LIMIT as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveSkipPrefix as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, findLargeInlineResources as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, clearBucketRegionCache as vn, isThrottlingError as vt, extractDeploymentEventError as w, AssetError as wn, rebuildClientForBucketRegion as wt, refusesFinalSnapshot as x, getAwsClients as xn, TemplateParser as xt, createPreDeleteFinalSnapshot as y, resolveBucketRegion as yn, markNonRetryable as yt, findActionableSilentDrops as z, StackHasActiveImportsError as zn, validateContainerRepoName as zt };
-//# sourceMappingURL=deploy-engine-D95wmKN8.js.map
+export { coerceCfnBoolean as $, resolveStateBucketWithDefaultAndSource as $t, cyan as A, NestedStackChildDirectDestroyError as An, BOOTSTRAP_MARKER_PREFIX as At, findSilentDropProperties as B, isCdkdError as Bn, runDockerForeground as Bt, makeCanonicalizePropertiesFn as C, DependencyError as Cn, stringifyValue as Ct, renderStatefulReason as D, LocalStartServiceError as Dn, loadPublishableAssetManifest as Dt, isStatefulRecreateTargetSync as E, LocalMigrateError as En, createAssetRedirectResolver as Et, IAMRoleProvider as F, StackHasActiveImportsError as Fn, validateContainerRepoName as Ft, IntrinsicFunctionResolver as G, isThrottlingError as Gn, synthesisStatusMessage as Gt, slowCcOperationTimeoutMs as H, withErrorHandling as Hn, AssetManifestLoader as Ht, collectInlinePolicyNamesManagedBySiblings as I, StackTerminationProtectionError as In, buildDenyExternalAccessPolicy as It, refStateLookupFromResource as J, resolveApp as Jt, cfnRefValueFromPhysicalId as K, markNonRetryable as Kn, getDefaultStateBucketName as Kt, clearOnUpdateRemoval as L, StateError as Ln, buildDockerImage as Lt, green as M, ProvisioningError as Mn, getBootstrapMarkerKey as Mt, red as N, ResourceTimeoutError as Nn, parseBootstrapMarker as Nt, formatResourceLine as O, LockError as On, rewriteTemplateAssetReferences as Ot, yellow as P, ResourceUpdateNotSupportedError as Pn, validateAssetBucketName as Pt, assertRegionMatch as Q, resolveStateBucketWithDefault as Qt, ProviderRegistry as R, SynthesisError as Rn, formatDockerLoginError as Rt, unsupportedFinalSnapshotError as S, ConfigError as Sn, AssetPublisher as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, LocalInvokeBuildError as Tn, buildAssetRedirectMap as Tt, disableInstanceApiTermination as U, isMarkedNonRetryable as Un, getDockerImageBySourceHash as Ut, CloudControlProvider as V, normalizeAwsError as Vn, runDockerStreaming as Vt, isTerminationProtectionPropagationError as W, isRetryableTransientError as Wn, Synthesizer as Wt, normalizeAwsTagsToCfn as X, resolveCaptureObservedState as Xt, WAFv2WebACLProvider as Y, resolveAutoAssetStorage as Yt, resolveExplicitPhysicalId as Z, resolveSkipPrefix as Zt, buildFinalSnapshotIdentifier as _, getAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, MIGRATE_TMP_PREFIX as an, requireConfigObject as at, isFinalSnapshotError as b, AssetError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, expectedOwnerParam as cn, s3BucketDomainName as ct, deleteSkipReason as d, derivePartitionAndUrlSuffix as dn, s3BucketWebsiteUrl as dt, resolveUseCdkBootstrapAssets as en, configBooleanRefusal as et, withResourceDeadline as f, AssemblyReader as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, AwsClients as gn, DagBuilder as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, resolveBucketRegion as hn, withRetry as ht, DeploymentEventsReader as i, CFN_TEMPLATE_URL_LIMIT as in, requireConfigArray as it, gray as j, PartialFailureError as jn, ensureAssetStorage as jt, bold as k, MissingCdkCliError as kn, AssetModeResolver as kt, replayRollback as l, PARTITION_TABLE as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, clearBucketRegionCache as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nn, readConfigString as nt, planFailedOps as o, findLargeInlineResources as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, processStackMessages as pn, DiffCalculator as pt, getAccountInfo as q, __exportAll as qn, getLegacyStateBucketName as qt, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rn, replayWarn as rt, planRollback as s, uploadCfnTemplate as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, stateBucketExistenceConfirmed as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, canonicalizeRegion as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, resetAwsClients as vn, LockManager as vt, extractDeploymentEventError as w, DeployCancelledError as wn, WorkGraph as wt, refusesFinalSnapshot as x, CdkdError as xn, shouldRetainResource as xt, createPreDeleteFinalSnapshot as y, setAwsClients as yn, S3StateBackend as yt, findActionableSilentDrops as z, formatError as zn, getDockerCmd as zt };
+//# sourceMappingURL=deploy-engine-CWt7h7Nc.js.map