@go-to-k/cdkd 0.284.10 → 0.284.11

package/dist/{deploy-engine-DGuaeWaV.js → deploy-engine-K5kHzsB-.js}

@@ -16053,7 +16053,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ChVCjyK2.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C9OlqHee.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -16741,6 +16741,33 @@ const CR_NO_PROPERTIES_SKIP_REASON = "no properties in state — Delete handler
 */
 const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete handler not invoked";
 /**
+* Third sibling of the two above, for the arm where cdkd HAD everything it
+* needed and the Delete request still could not be completed — a permanent
+* `lambda:InvokeFunction` denial, an exhausted readiness waiter, a response
+* that never arrived.
+*
+* That arm used to swallow the error and return `undefined`, which
+* `deleteSkipReason` reads as DELETED: `cdkd destroy` printed `✓ … deleted`,
+* dropped the state record and exited 0 over a handler that never received a
+* `Delete` — silently orphaning everything that handler manages. It is the
+* same silent-orphan class issue
+* [#1752](https://github.com/go-to-k/cdkd/issues/1752) removed from the two
+* arms above, reached through the catch rather than through a guard.
+*
+* **Fixed wording, no interpolation.** The underlying AWS message goes out on
+* the `logger.warn` beside it and NOT into the reason, because a `reason` is
+* rendered into the `Error` the deploy-side replacement sites throw, whose
+* catch classifies an already-deleted resource by SUBSTRING — an AWS message
+* carrying `does not exist` / `not found` would make a skip read as "already
+* gone" and drop the record again, one layer further out. Same rule the
+* `sns-subscription` abort follows.
+*
+* The premise is "the resource was NOT destroyed", not "no AWS call was
+* issued": the handler may have run and failed, or run and had its response
+* lost. Both leave the resource unproven, which is what a skip asserts.
+*/
+const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
+/**
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
@@ -16795,12 +16822,115 @@ function decodeInvokeLogTail(logResult) {
 	}
 }
 /**
+* Recover the backing function's own STATUS fields from an
+* `@smithy/util-waiter` failure message, or `undefined` when they are not
+* there (issue #2033).
+*
+* The message is `JSON.stringify(result)` and `result.reason` is, for both
+* Lambda readiness waiters, the ENTIRE `GetFunction` response. Only these
+* AWS-authored status fields are lifted out of it — never the whole payload,
+* which carries `Configuration.Environment.Variables` into a durable store.
+*
+* Best-effort by construction: a non-JSON message, a different waiter shape, or
+* a payload with no `Configuration` all yield `undefined`, and the caller falls
+* back to a fixed sentence.
+*/
+function extractWaiterFunctionStatus(message) {
+	let parsed;
+	try {
+		parsed = JSON.parse(message);
+	} catch {
+		return;
+	}
+	const config = (parsed?.reason)?.Configuration;
+	if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
+	const fields = config;
+	const parts = [];
+	for (const key of [
+		"State",
+		"StateReasonCode",
+		"StateReason",
+		"LastUpdateStatus",
+		"LastUpdateStatusReasonCode",
+		"LastUpdateStatusReason"
+	]) {
+		const value = fields[key];
+		if (typeof value === "string" && value !== "") parts.push(`${key}=${value}`);
+	}
+	return parts.length > 0 ? parts.join(", ") : void 0;
+}
+/**
+* Render a Lambda readiness-waiter failure for a message that is persisted
+* (issue #2033) — see `waitForBackingLambdaReady` for the whole argument.
+*
+* TIMEOUT / ABORT keep the waiter's own message: its `observedResponses` keys
+* are status lines `@smithy/util-waiter` builds itself (`403: <AWS message>`),
+* which is exactly the diagnostic a stalled waiter needs and carries no
+* response body. Every other state serialized the full `GetFunction` response,
+* so that arm reports the error NAME plus the function's own status fields.
+*/
+function describeWaiterFailure(error) {
+	const name = error instanceof Error ? error.name : "Error";
+	const message = error instanceof Error ? error.message : String(error);
+	if (name === "TimeoutError" || name === "AbortError") return message;
+	return `${name} (${extractWaiterFunctionStatus(message) ?? "no function status reported"}). The waiter's raw payload is withheld because it embeds the whole GetFunction response, environment variables included; run \`aws lambda get-function\` for the detail.`;
+}
+/**
 * IAM-authorization-propagation signals in a custom resource FAILED reason that
 * indicate the backing Lambda's freshly-attached execution-role policy has not
 * yet taken effect for its assumed-role session (so a recycle + retry will
 * succeed once IAM settles). Lowercase substrings. Intentionally narrow — these
 * are the IAM-permission-not-yet-effective phrases only, NOT generic transient
 * errors (throttling / timeouts), which must not trigger a CR re-invoke.
+*
+* **This set is deliberately NARROWER than
+* `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` (`src/deployment/retryable-errors.ts`)
+* and stays that way** (issue
+* [#2033](https://github.com/go-to-k/cdkd/issues/2033), which asked whether the
+* narrowing was still intended or a list that had stopped tracking its
+* counterpart).
+*
+* "Narrower", not "a subset" — an earlier revision of this comment said SUBSET
+* and that was FALSE of the list beside it. Three of these six entries appear
+* in no form in the shared list (`no identity-based policy allows`, both
+* `not in the state functionActive` spellings), and a fourth appears there only
+* ANCHORED: the shared list carries `Firehose is unable to assume role` /
+* `is unable to assume provided role` / `is unable to assume the role` and
+* deliberately refuses the bare `is unable to assume` this list uses, so that a
+* permanent `... is unable to assume role X because of an explicit deny` cannot
+* burn a retry budget. The bare spelling is right HERE — the text is the
+* handler's own reason about the race cdkd created — and wrong for AWS-authored
+* text about a call cdkd made, which is why
+* {@link CR_THROWN_AUTHZ_EXTRA_SIGNALS} does not re-export it.
+*
+* The narrowing is intended, because the two lists are consumed under different
+* COSTS and classify text with different AUTHORS:
+*
+*  - This set is matched against the HANDLER's own FAILED `Reason` (and, since
+*    #1674, against arbitrary handler stdout in the log tail). A match here buys
+*    a re-INVOKE, which re-runs the user's `Create` — a non-idempotent handler
+*    repeats partial work, and a Provider-framework `onEvent` can create a
+*    SECOND physical resource and orphan the first (the accepted cost stated on
+*    {@link CR_TRANSIENT_AUTHZ_LOG_SIGNALS}). So the phrases must name the race
+*    cdkd ITSELF created — the backing function's freshly-attached execution
+*    role — and nothing else. Most of the superset's entries describe a
+*    DOWNSTREAM call the handler made (`Invalid principal in policy`,
+*    `Cannot access stream`, `KMS key is invalid for CreateGrant`,
+*    `Invalid InstanceProfile`, …); a re-invoke is not the remedy for those, so
+*    each one would buy a recycle plus an identical re-failure. The three the
+*    issue named specifically — `role defined for the function`, `trust policy`,
+*    `Invalid principal in policy` — are exactly that shape when they arrive in
+*    a handler-authored reason, and the first two are ALREADY covered here in
+*    the spelling that matters (`cannot be assumed` / `is unable to assume` are
+*    what Lambda emits for an unassumable execution role).
+*  - The shared list is matched against text AWS wrote about a call CDKD made.
+*    It is used, in full, by
+*    {@link CustomResourceProvider.isTransientAuthzThrow} for a THROWN error
+*    from one of the provider's OWN SDK calls — see that method for why the
+*    wider list is correct there and costs nothing extra.
+*
+* So the answer to "should these converge" is no; what was genuinely missing was
+* the second consumer, not a wider first one.
 */
 const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"not authorized to perform",
@@ -16811,6 +16941,27 @@ const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"is unable to assume"
 ];
 /**
+* The CR-specific spellings {@link CustomResourceProvider.isTransientAuthzThrow}
+* adds ON TOP of `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` — i.e. exactly the
+* phrases the shared list does not carry in any form (issue #2033).
+*
+* Deliberately NOT `CR_TRANSIENT_AUTHZ_SIGNALS` itself, which is what the first
+* cut of the fix used. Three of that list's entries are already covered by the
+* shared list (`not authorized to perform` / `cannot be assumed`, plus the three
+* ANCHORED `unable to assume` spellings), so re-uniting the whole thing bought
+* nothing except the bare, UN-anchored `is unable to assume` — which the shared
+* list refuses on purpose so a permanent explicit-deny cannot spend a 47.75s
+* budget before failing. This list is the difference, and only the difference.
+*
+* Lower-cased substrings, matched against a lower-cased message (the shared list
+* is mixed-case and matched verbatim by `isIamPropagationError`).
+*
+* `is not in the state functionactive` from the sibling list is omitted as a
+* pure superstring of the entry below it: any message matching it matches this
+* one too.
+*/
+const CR_THROWN_AUTHZ_EXTRA_SIGNALS = ["no identity-based policy allows", "not in the state functionactive"];
+/**
 * The same IAM-authorization-propagation signals, matched against the backing
 * function's INVOCATION LOG TAIL rather than the FAILED reason (issue #1674).
 *
@@ -16871,6 +17022,37 @@ const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
 * at 4 KB regardless, so this only trims the extreme case.
 */
 const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
+/** Default for `CDKD_CR_AUTHZ_MAX_RETRIES` — see `transientAuthzMaxRetries`. */
+const CR_AUTHZ_MAX_RETRIES_DEFAULT = 2;
+/**
+* Hard ceiling for `CDKD_CR_AUTHZ_MAX_RETRIES`.
+*
+* The knob's units are RE-INVOCATIONS OF THE USER'S HANDLER, each one also
+* paying a `recycleBackingFunctionExecEnv` (an `UpdateFunctionConfiguration`
+* plus a 120s waiter). Ten of those is already far past the point where an
+* IAM-propagation race would have settled, so anything above it is a typo or a
+* misunderstanding rather than a preference — and left unclamped a `1e9`
+* passes the finite / `>= 0` gate and re-invokes until the deploy engine's
+* per-resource deadline fires an hour later.
+*/
+const CR_AUTHZ_MAX_RETRIES_CEILING = 10;
+/**
+* Bound for the `.cause` walks in this file, matching the depth
+* `isMarkedNonRetryable` / `isThrottlingError` use in
+* `src/deployment/retryable-errors.ts`. Bounded rather than unbounded so a
+* cyclic chain cannot hang the classifier.
+*/
+const CR_ERROR_CAUSE_MAX_DEPTH = 5;
+/**
+* Sleep seam for this provider's hand-rolled waits (the pre-delivery retry
+* backoff and the S3 response poll).
+*
+* Mutable module state ONLY so tests can run a 47.75s retry schedule without
+* spending 47.75s; production never reassigns it. Mirrors the
+* `deleteTableRetryDelays.sleep` seam the DynamoDB providers use, and the
+* `sleep` option `withRetry` already exposes for the same reason.
+*/
+const customResourceRetryDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 /**
 * Lines Lambda emits for EVERY invocation regardless of what the handler logged.
 * A tail consisting only of these carries no diagnostic value, and it is the
@@ -17010,6 +17192,24 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* exponential backoff for async patterns (CDK Provider framework with
 	* isCompleteHandler), so an outer retry adds nothing but the multi-
 	* key bug.
+	*
+	* **Opting out of the outer loop is a promise to retry HERE, and that
+	* promise is kept PER CALL — not per attempt.** Issue
+	* [#2033](https://github.com/go-to-k/cdkd/issues/2033) found the claim
+	* backed for exactly one error SHAPE: the internal loop keyed only on the
+	* handler's RETURNED `cfnResponse.Status === 'FAILED'`, and its body had no
+	* `try` / `catch` at any point, so a THROWN error from any AWS SDK call the
+	* provider itself makes left `create()` directly and was single-shot — while
+	* every other resource type got 26 retries over 47.75s for the identical
+	* wording. The per-call decision, in one place:
+	*
+	* | call | retried on a throw? | why |
+	* |---|---|---|
+	* | S3 `PutObject` (response-key placeholder) | YES, own `withRetry` (the standard dense propagation schedule, 47.75s) — and its exhausted throw is `markNonRetryable`d so the loop below cannot spend a SECOND budget on it | idempotent PUT of an empty object at a key cdkd just minted; touches no response-URL lifecycle, so a replay is free |
+	* | Lambda `Invoke` / SNS `Publish` | YES, but only PRE-DELIVERY, on {@link CustomResourceProvider.preDeliveryAuthzMaxRetries} — its OWN budget, the same dense 47.75s schedule every other resource type gets | a replay re-delivers the request, which is the hazard this flag exists for, so the PRE-delivery fence is what makes the budget affordable: nothing has been delivered, so a replay re-invokes NOTHING — see {@link CustomResourceProvider.isTransientAuthzThrow} |
+	* | `waitUntilFunctionActiveV2` / `waitUntilFunctionUpdatedV2` | ALREADY, by the SDK waiter — and their wrapped failure is `markNonRetryable`d, so the loop below does not replay it either | measured against `@aws-sdk/client-lambda`: the generated `checkState` catches EVERY exception and returns `RETRY`, so a mid-propagation 403 on `lambda:GetFunction` is polled out to `maxWaitTime` (600s). Wrapping them again would only stack a second budget on top — and `@smithy/util-waiter` serializes its `observedResponses` into the TIMEOUT message, whose keys read `403: User: … is not authorized to perform: lambda:GetFunction …`, so a classifier reading that message would have replayed a PERMANENT denial for 3 x 600s |
+	* | `GetFunction` (delete-path backing-Lambda probe) | NO, deliberately | it already fails OPEN — anything but a definitive `ResourceNotFoundException` falls through to the normal invoke path, whose waiters cover the same propagation window one call later. Retrying would only delay that fall-through by up to 47.75s on a genuine permission denial |
+	* | anything AFTER delivery (`pollS3Response`, the `FunctionError` throw, `cleanupResponseObject`) | NO, deliberately | the handler is running and will PUT to the URL of THIS attempt; a replay strands it at a key nobody polls, which is precisely the bug `disableOuterRetry` prevents |
 	*/
 	disableOuterRetry = true;
 	/** Max time to wait for synchronous S3 response after Lambda invocation (30 seconds) */
@@ -17023,8 +17223,13 @@ var CustomResourceProvider = class CustomResourceProvider {
 	/** Max poll interval for async polling with exponential backoff (30 seconds) */
 	MAX_POLL_INTERVAL_MS = 3e4;
 	/**
-	* How many extra times to re-invoke a custom resource whose handler returned
-	* FAILED with a *transient IAM-authorization* reason (e.g. the CDK Provider
+	* How many extra times to RE-INVOKE a custom resource whose handler returned
+	* FAILED with a *transient IAM-authorization* reason.
+	*
+	* TWO error shapes, TWO budgets, deliberately (issue #2033) — this one and
+	* {@link CustomResourceProvider.preDeliveryAuthzMaxRetries}. This budget
+	* governs the shape where the handler ALREADY RAN: it returned FAILED with a
+	* transient-authz reason (e.g. the CDK Provider
 	* framework's `lambda:GetFunction` / "not in the state functionActive" 403
 	* when the framework role's freshly-attached inline policy has not yet
 	* propagated to the assumed-role session). cdkd's fast SDK path invokes the
@@ -17036,16 +17241,67 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* `disableOuterRetry` to avoid stranding a pre-signed response URL — so we
 	* retry HERE instead, deriving a fresh response URL + RequestId per attempt
 	* and recycling the backing function's execution environment between tries).
-	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES`. `0` disables the RETRY only —
+	*
+	* **It is SMALL (2) because every retry it authorises RE-RUNS THE USER'S
+	* HANDLER**, and that is the whole reason the second shape does not share it:
+	* a pre-delivery throw invokes the handler ZERO times, so the argument that
+	* bounds this number does not apply there at all. Sharing it was measured
+	* wrong — 2 retries on the dense schedule is 250ms + 500ms of coverage, i.e.
+	* 0.75s against an IAM-propagation window this repo has measured at 7-12s, so
+	* issue #2033's own scenario still failed with the fix in place.
+	*
+	* Override via `CDKD_CR_AUTHZ_MAX_RETRIES` (clamped to
+	* {@link CR_AUTHZ_MAX_RETRIES_CEILING}). `0` disables the RE-INVOKE only —
 	* the issue-#1674 log-tail scan and the reason annotation it produces still
 	* run, because they describe the failure rather than react to it.
+	*
+	* It does NOT disable either of the two retries that cannot reach the
+	* handler: the response-placeholder `PutObject` retry in
+	* `generateResponseURL`, and the pre-delivery arm above. Neither is what this
+	* knob exists to bound — it bounds how many times a user's handler may be
+	* re-run — and a user turning off re-invokes should not thereby lose the
+	* propagation coverage every other resource type gets for free.
 	*/
 	transientAuthzMaxRetries = (() => {
 		const raw = process.env["CDKD_CR_AUTHZ_MAX_RETRIES"];
-		if (raw === void 0 || raw === "") return 2;
+		if (raw === void 0 || raw === "") return CR_AUTHZ_MAX_RETRIES_DEFAULT;
 		const n = Number(raw);
-		return Number.isFinite(n) && n >= 0 ? n : 2;
+		if (!Number.isFinite(n) || n < 0) return CR_AUTHZ_MAX_RETRIES_DEFAULT;
+		const clamped = Math.min(Math.floor(n), CR_AUTHZ_MAX_RETRIES_CEILING);
+		if (clamped !== n) this.logger.warn(`CDKD_CR_AUTHZ_MAX_RETRIES=${raw} is out of range; using ${clamped} (whole numbers, at most ${CR_AUTHZ_MAX_RETRIES_CEILING} — each retry re-invokes the custom resource handler).`);
+		return clamped;
 	})();
+	/**
+	* Budget for the PRE-DELIVERY thrown arm — a transient IAM-authorization
+	* error thrown by the `Invoke` / `Publish` itself BEFORE the request reached
+	* the handler (issue #2033). The reported shape is an `AccessDeniedException`
+	* on `lambda:InvokeFunction` while the DEPLOYING principal's own
+	* freshly-attached policy is still propagating.
+	*
+	* It is {@link IAM_PROPAGATION_MAX_RETRIES} — the same 26 retries over 47.75s
+	* that `withRetry` gives every other resource type for the identical wording,
+	* on the same dense schedule ({@link IAM_PROPAGATION_INITIAL_DELAY_MS}
+	* doubling to {@link IAM_PROPAGATION_MAX_DELAY_MS}). The measured window this
+	* has to cover is 7-12s; the FAILED-response budget's 0.75s does not.
+	*
+	* **Why it can afford that while its sibling cannot**: it fires only when
+	* `delivered === false`, so the handler has been invoked ZERO times and a
+	* replay re-runs NOTHING — no partial work repeated, no second physical
+	* resource from a Provider-framework `onEvent`, no stranded response URL. The
+	* only cost of a retry here is one `PutObject` + one presign, and the
+	* abandoned placeholder is swept before the next attempt. So the constraint
+	* that keeps `transientAuthzMaxRetries` at 2 is simply absent, and matching
+	* every other resource type is the correct answer instead.
+	*
+	* A thrown retry also skips the exec-env recycle: the denial is on CDKD's own
+	* principal, not on the backing function's role, so there is no warm
+	* container holding stale credentials to invalidate.
+	*
+	* Deliberately NOT overridable by an env var. It bounds no handler
+	* invocation, so there is nothing for a user to trade off — the same reason
+	* the placeholder `PutObject`'s `withRetry` takes no knob either.
+	*/
+	preDeliveryAuthzMaxRetries = 26;
 	constructor(config) {
 		const awsClients = getAwsClients();
 		this.lambdaClient = awsClients.lambda;
@@ -17252,7 +17508,11 @@ var CustomResourceProvider = class CustomResourceProvider {
 			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
 			else this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record so a re-run can retry it. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
+			};
 		}
 	}
 	/**
@@ -17309,31 +17569,71 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* `prepareInvocation()`) and recycling the backing function's execution
 	* environment between tries so its next cold start re-assumes the role.
 	*
+	* **The loop covers TWO error shapes** (issue #2033). The original one is the
+	* handler's RETURNED `Status: 'FAILED'`. The second is an error THROWN by one
+	* of the provider's OWN SDK calls before the request reached the handler —
+	* which used to leave `create()` directly, because the loop body had no
+	* `try` / `catch` at any point, making every such call single-shot while every
+	* other resource type got the outer `withRetry`'s 26 attempts for the identical
+	* wording. The `delivered` flag below is what keeps the second arm honest: it
+	* flips the moment `Invoke` / `Publish` RETURNS, and a throw after that point
+	* is rethrown untouched no matter how transient it reads, because the handler
+	* is running and will PUT to THIS attempt's response URL. See
+	* {@link CustomResourceProvider.disableOuterRetry} for the whole per-call
+	* table, and {@link CustomResourceProvider.isTransientAuthzThrow} for why a
+	* PRE-delivery throw is safe to replay at all.
+	*
 	* `buildRequest` is called once per attempt with the fresh invocation so the
 	* CFn request body always carries the matching ResponseURL / RequestId.
 	* Returns the final response; the caller decides what a terminal FAILED means
 	* (create/update throw, delete warns-and-continues).
 	*/
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
-		for (let attempt = 0;; attempt++) {
-			const invocation = await this.prepareInvocation();
-			const request = buildRequest(invocation);
-			this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
-			const { response: cfnResponse, logResult } = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation);
-			const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
-			const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
-			const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
-			if (cfnResponse.Status === "FAILED" && attempt < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
-				this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
-				await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
-				continue;
+		const watch = this.startInterruptWatch(logicalId);
+		try {
+			let preDeliveryRetries = 0;
+			let failedResponseRetries = 0;
+			for (let attempt = 0;; attempt++) {
+				let delivered = false;
+				let cfnResponse;
+				let logResult;
+				let invocation;
+				try {
+					invocation = await this.prepareInvocation(logicalId, watch);
+					const request = buildRequest(invocation);
+					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
+					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
+						delivered = true;
+					});
+					cfnResponse = sent.response;
+					logResult = sent.logResult;
+				} catch (error) {
+					if (delivered || preDeliveryRetries >= this.preDeliveryAuthzMaxRetries || !this.isTransientAuthzThrow(error)) throw error;
+					const delayMs = Math.min(250 * Math.pow(2, preDeliveryRetries), IAM_PROPAGATION_MAX_DELAY_MS);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(error instanceof Error ? error.message : String(error))}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
+					if (invocation !== void 0) await this.cleanupResponseObject(invocation.responseKey);
+					preDeliveryRetries += 1;
+					await this.sleepInterruptibly(delayMs, watch);
+					continue;
+				}
+				const reasonIsAuthz = cfnResponse.Status === "FAILED" && this.isTransientAuthzFailure(cfnResponse.Reason);
+				const logTail = cfnResponse.Status === "FAILED" && !reasonIsAuthz ? decodeInvokeLogTail(logResult) : void 0;
+				const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
+				if (cfnResponse.Status === "FAILED" && failedResponseRetries < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
+					failedResponseRetries += 1;
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
+					await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
+					continue;
+				}
+				if (cfnResponse.Status === "FAILED" && logAuthzMatch !== void 0) return {
+					...cfnResponse,
+					Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
+				};
+				if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
+				return cfnResponse;
 			}
-			if (cfnResponse.Status === "FAILED" && logAuthzMatch !== void 0) return {
-				...cfnResponse,
-				Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
-			};
-			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
-			return cfnResponse;
+		} finally {
+			watch.dispose();
 		}
 	}
 	/**
@@ -17355,6 +17655,63 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return CR_TRANSIENT_AUTHZ_SIGNALS.some((p) => lower.includes(p));
 	}
 	/**
+	* Classify an error THROWN by one of the provider's own SDK calls as a
+	* transient IAM-authorization race worth replaying (issue #2033).
+	*
+	* The list is cdkd's shared `IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS` — the
+	* same one every other resource type is classified with, via `withRetry` —
+	* plus {@link CR_THROWN_AUTHZ_EXTRA_SIGNALS}, the two CR-specific spellings
+	* the shared list does not carry in any form. That is deliberately WIDER than
+	* the FAILED-reason classifier, and the asymmetry is the whole point: this
+	* text was written by AWS about a call CDKD made, whereas a FAILED reason was
+	* written by the user's handler about a call IT made. See
+	* {@link CR_TRANSIENT_AUTHZ_SIGNALS} for the full argument, including why the
+	* bare `is unable to assume` spelling stays on that side of the line.
+	*
+	* **Two REFUSALS come before any pattern**, and each closes a way for a
+	* single call to be given two retry budgets:
+	*
+	*  - `isMarkedNonRetryable` — cdkd's own declaration that this raising cannot
+	*    succeed on a replay. Both of the provider's already-retried calls stamp
+	*    it: the placeholder `PutObject` after its `withRetry` is exhausted, and
+	*    `waitForBackingLambdaReady` after the SDK waiter has polled for its full
+	*    600s. The marker rather than the wording is what makes the second one
+	*    sound: `@smithy/util-waiter` serializes `observedResponses` into its
+	*    TIMEOUT message and those keys read
+	*    `403: User: … is not authorized to perform: lambda:GetFunction …`, so a
+	*    PERMANENT denial matched every pattern here and a message-shaped fence
+	*    would be one AWS wording change from failing open. It also refuses a
+	*    cdkd-authored REFUSAL whose text happens to carry an authz phrase.
+	*  - the `.cause` chain is WALKED (bounded), matching `isThrottlingError` /
+	*    `isMarkedNonRetryable`. cdkd wraps SDK errors routinely, and issue #2040
+	*    documents the drop-`cause` class in this very directory; a top-level-only
+	*    read would silently un-retry a wrapped propagation denial.
+	*
+	* **Every pattern in that union is an AUTHORIZATION or REQUEST-VALIDATION
+	* rejection, and that is what makes replaying an `Invoke` safe here.** Such a
+	* rejection is decided at the API front door, before any execution environment
+	* is engaged, so the handler provably did not run and a replay cannot
+	* re-deliver work — the hazard `disableOuterRetry` exists for. It is also why
+	* this classifier deliberately does NOT reach for the broader
+	* `isRetryableTransientError`: a throttle, an HTTP 5xx or a socket timeout can
+	* each arrive AFTER the request was accepted, so replaying one could invoke a
+	* non-idempotent handler twice. Those classes stay single-shot on this path by
+	* design, and the caller's `delivered` flag is the second, independent fence.
+	*/
+	isTransientAuthzThrow(error) {
+		if (isMarkedNonRetryable(error)) return false;
+		let current = error;
+		for (let depth = 0; depth < CR_ERROR_CAUSE_MAX_DEPTH && current != null; depth++) {
+			const message = current instanceof Error ? current.message : typeof current === "string" ? current : "";
+			if (message !== "") {
+				const lower = message.toLowerCase();
+				if (isIamPropagationError(message) || CR_THROWN_AUTHZ_EXTRA_SIGNALS.some((p) => lower.includes(p))) return true;
+			}
+			current = current.cause;
+		}
+		return false;
+	}
+	/**
 	* Find the IAM-authorization denial inside a backing function's invocation
 	* log tail, for the case the FAILED reason itself carries none (issue #1674).
 	*
@@ -17440,15 +17797,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* erased from the FAILED reason (issue #1674). Returned UNDECODED so the
 	* happy path pays nothing — only a FAILED whose reason missed decodes it.
 	* Absent on the SNS path: there is no Lambda invoke to attach a log to.
+	*
+	* `onDelivered` is invoked exactly once, the moment the `Invoke` / `Publish`
+	* RETURNS — i.e. at the point after which a replay would re-deliver the
+	* request to the handler and strand this attempt's pre-signed response URL.
+	* The caller's retry-on-throw arm is fenced on it (issue #2033). Deliberately
+	* called AFTER the send rather than before: a rejection at the API front door
+	* (the IAM-propagation class this arm exists for) means the handler never ran,
+	* and treating that as delivered would leave the reported failure single-shot.
 	*/
-	async sendRequest(serviceToken, request, responseKey, logicalId, operation) {
+	async sendRequest(serviceToken, request, responseKey, logicalId, operation, onDelivered) {
 		if (this.isSnsServiceToken(serviceToken)) {
 			this.logger.debug(`ServiceToken is SNS topic, publishing to: ${serviceToken}`);
 			await this.publishToSns(serviceToken, request);
+			onDelivered();
 			return { response: await this.pollS3Response(responseKey, logicalId, operation) };
 		}
 		await this.waitForBackingLambdaReady(serviceToken, logicalId);
 		const invokeResponse = await this.invokeLambda(serviceToken, request);
+		onDelivered();
 		return {
 			response: await this.getCustomResourceResponse(invokeResponse, responseKey, logicalId, operation),
 			...invokeResponse.LogResult === void 0 ? {} : { logResult: invokeResponse.LogResult }
@@ -17481,6 +17848,37 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* deploy engine's per-resource `--resource-timeout` (default 30 min)
 	* still bounds the outer Custom Resource provisioning attempt, so
 	* this waiter cap is layered defense, not the only timeout.
+	*
+	* **The wrapped failure is `markNonRetryable`d, and its message is NOT the
+	* waiter's** (issue #2033). Both halves are about `@smithy/util-waiter`'s
+	* `checkExceptions`, which serializes its whole result into the `Error`
+	* message:
+	*
+	*  - On TIMEOUT that includes `observedResponses`, whose keys read
+	*    `403: User: … is not authorized to perform: lambda:GetFunction on
+	*    resource: …`. The waiter's generated `checkState` catches EVERY
+	*    exception and returns `RETRY`, so reaching here means a 600s budget was
+	*    already spent — yet the message matched
+	*    {@link CustomResourceProvider.isTransientAuthzThrow} exactly, so a
+	*    PERMANENT `lambda:GetFunction` denial was replayed for 3 x 600s instead
+	*    of 10 minutes, blowing any `--resource-timeout
+	*    AWS::CloudFormation::CustomResource=15m`. The marker is a property of
+	*    the error object, so unlike a wording test it cannot be defeated by AWS
+	*    rephrasing the denial.
+	*  - On the non-TIMEOUT arm (`State: Failed`, i.e. an ENI / VPC failure) the
+	*    serialized result carries `reason` and `final`, which for this waiter
+	*    are the ENTIRE `GetFunction` response — `Configuration.Environment.
+	*    Variables` included. That message reached `ProvisioningError.message`
+	*    and `extractDeploymentEventError` persisted it to
+	*    `deployments/{runId}.jsonl`, a durable store that outlives
+	*    `cdkd destroy` and is contractually "error + metadata only, never
+	*    resource properties, because they may contain secrets"
+	*    (`docs/deployment-events.md`). So this arm interpolates the error NAME
+	*    plus a fixed sentence, and recovers only the function's own
+	*    `State` / `StateReason` / `StateReasonCode` — AWS-authored status
+	*    fields — from the serialized payload. The TIMEOUT / ABORT arms keep
+	*    their message: `observedResponses` keys are status lines built by
+	*    `createMessageFromResponse`, never a response body.
 	*/
 	async waitForBackingLambdaReady(serviceToken, logicalId) {
 		try {
@@ -17497,7 +17895,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				maxDelay: 5
 			}, { FunctionName: serviceToken });
 		} catch (error) {
-			throw new Error(`Lambda backing custom resource ${logicalId} (${serviceToken}) did not reach a ready state for Invoke: ${error instanceof Error ? error.message : String(error)}`);
+			throw markNonRetryable(new Error(`Lambda backing custom resource ${logicalId} (${serviceToken}) did not reach a ready state for Invoke: ${describeWaiterFailure(error)}`, { cause: error }));
 		}
 	}
 	/**
@@ -17593,28 +17991,38 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* Centralising this in one helper makes that invariant impossible to
 	* violate at the call sites.
 	*/
-	async prepareInvocation() {
+	async prepareInvocation(logicalId, watch) {
 		const requestId = `cdkd-${Date.now()}-${Math.random().toString(36).substring(7)}`;
 		const responseKey = this.getResponseKey(requestId);
 		return {
 			requestId,
 			responseKey,
-			responseURL: await this.generateResponseURL(responseKey)
+			responseURL: await this.generateResponseURL(responseKey, logicalId, watch)
 		};
 	}
 	/**
 	* Generate a pre-signed S3 PUT URL for Lambda to send its response
 	*/
-	async generateResponseURL(responseKey) {
+	async generateResponseURL(responseKey, logicalId, watch) {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
 		await this.ensureResponseClient();
-		await this.s3Client.send(new PutObjectCommand({
-			Bucket: this.responseBucket,
-			Key: responseKey,
-			Body: "",
-			ContentLength: 0,
-			ContentType: "application/json"
-		}));
+		const bucket = this.responseBucket;
+		try {
+			await withRetry(() => this.s3Client.send(new PutObjectCommand({
+				Bucket: bucket,
+				Key: responseKey,
+				Body: "",
+				ContentLength: 0,
+				ContentType: "application/json"
+			})), `${logicalId} (custom-resource response placeholder)`, {
+				logger: this.logger,
+				isInterrupted: watch.isInterrupted,
+				onInterrupted: watch.onInterrupted,
+				sleep: customResourceRetryDelays.sleep
+			});
+		} catch (error) {
+			throw markNonRetryable(error instanceof Error ? error : new Error(String(error)));
+		}
 		const command = new PutObjectCommand({
 			Bucket: this.responseBucket,
 			Key: responseKey
@@ -17725,7 +18133,50 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return result;
 	}
 	sleep(ms) {
-		return new Promise((resolve) => setTimeout(resolve, ms));
+		return customResourceRetryDelays.sleep(ms);
+	}
+	/**
+	* Install a SIGINT watch for one custom-resource invocation (issue #2033).
+	*
+	* `docs/provider-development.md` requires a new `withRetry` to thread
+	* `isInterrupted` / `onInterrupted`, and a hand-rolled backoff to be
+	* interruptible for the same reason: without it Ctrl-C is dead for the whole
+	* 47.75s schedule. The provider already had the shape — `pollS3Response`
+	* installs its own handler — so this is that pattern, lifted so the two new
+	* wait sites share one flag and one disposal.
+	*
+	* The caller MUST `dispose()` in a `finally`; a leaked listener would
+	* accumulate one per resource across a deploy.
+	*/
+	startInterruptWatch(logicalId) {
+		let interrupted = false;
+		const handler = () => {
+			interrupted = true;
+		};
+		process.on("SIGINT", handler);
+		return {
+			isInterrupted: () => interrupted,
+			onInterrupted: () => /* @__PURE__ */ new Error(`Custom resource ${logicalId} interrupted by user`),
+			dispose: () => {
+				process.removeListener("SIGINT", handler);
+			}
+		};
+	}
+	/**
+	* `sleep` that checks the interrupt watch at most a second apart, mirroring
+	* `withRetry`'s own once-per-second probe. Throws the watch's error when the
+	* user has hit Ctrl-C, so the retry loop unwinds instead of sitting out the
+	* remaining backoff.
+	*/
+	async sleepInterruptibly(ms, watch) {
+		let remaining = ms;
+		while (remaining > 0) {
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+			const chunk = Math.min(1e3, remaining);
+			await this.sleep(chunk);
+			remaining -= chunk;
+		}
+		if (watch.isInterrupted()) throw watch.onInterrupted();
 	}
 	/**
 	* Adopt an existing custom resource into cdkd state.
@@ -23631,7 +24082,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.10";
+	return "0.284.11";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -26100,4 +26551,4 @@ var DeployEngine = class {
 
 //#endregion
 export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-DGuaeWaV.js.map
+//# sourceMappingURL=deploy-engine-K5kHzsB-.js.map