@go-to-k/cdkd 0.290.10 → 0.290.11

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BwiXzVQd.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BSEiTsV7.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DUCNL9hK.js");
+	const { buildProgram } = await import("./program-FAA3rPmS.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-B6t-R3eP.js → deploy-engine-C52t7w66.js}

@@ -1,6 +1,6 @@
-import { S as displaySafe, b as UNRENDERABLE, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as displayIdent } from "./logger-H8n5Qjhq.js";
+import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BwiXzVQd.js";
+import { t as getCdkdVersion } from "./version-BSEiTsV7.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -70,7 +70,7 @@ var __exportAll = (all, no_symbols) => {
 * Kept as its own array — and composed back into the full transient table
 * below — so there is exactly ONE list per pattern (no parallel classifier to
 * drift). It exists because this class has a materially different RECOVERY
-* SHAPE from the other transient errors: it resolves in single-digit seconds,
+* SHAPE from the other transient errors: it usually resolves within seconds,
 * so `withRetry` polls it on a dense sub-second schedule instead of the
 * generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
 * for long resource-state transitions, and wrong here — see
@@ -101,6 +101,7 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"Invalid value for the parameter Policy",
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
+	"The operator role is invalid or doesn't have sufficient permissions",
 	"permissions required to assume the role",
 	"does not have a trust relationship allowing",
 	"authorized to assume the provided role",
@@ -742,7 +743,7 @@ function retryClassificationText(error) {
 * This does NOT decide retryability — every pattern it matches is already in
 * {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
 * `withRetry` polls this class densely (sub-second initial delay, low cap)
-* because IAM propagation resolves in single-digit seconds, whereas the
+* because IAM propagation usually resolves within seconds, whereas the
 * generic exponential schedule is tuned for throttling and long resource-state
 * transitions.
 *
@@ -17063,7 +17064,7 @@ var ReplacementRulesRegistry = class {
 * cdkd creates an `AWS::IAM::InstanceProfile` and issues `RunInstances` ~2.8s
 * later; CloudFormation and Terraform are slow enough between resources that
 * IAM has propagated by the time they call, cdkd outruns it. The measured
-* failure recovers in single-digit seconds, so the first re-probe should be
+* failure usually recovers within seconds, so the first re-probe should be
 * sub-second rather than the generic 1s.
 */
 const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
@@ -17171,7 +17172,7 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * IAM-propagation failures (see `isIamPropagationError`) instead use the dense
 * schedule 0.25s -> 0.5s -> 1s -> 2s -> 2s ... over
 * {@link IAM_PROPAGATION_MAX_RETRIES} retries (cumulative 47.75s), because that
-* class resolves in single-digit seconds and the generic schedule's coarse
+* class usually resolves within seconds and the generic schedule's coarse
 * 4s/8s steps overshoot it. The dense schedule applies ONLY when the caller
 * left the schedule at its defaults — a caller that passed its own
 * `maxRetries` / `initialDelayMs` / `maxDelayMs` / `isRetryable` picked that
@@ -29296,7 +29297,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BNyUZrYL.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B5zWVTp2.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31471,7 +31472,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* | call | retried on a throw? | why |
 	* |---|---|---|
 	* | S3 `PutObject` (response-key placeholder) | YES, own `withRetry` (the standard dense propagation schedule, 47.75s) — and its exhausted throw is `markNonRetryable`d so the loop below cannot spend a SECOND budget on it | idempotent PUT of an empty object at a key cdkd just minted; touches no response-URL lifecycle, so a replay is free |
-	* | Lambda `Invoke` / SNS `Publish` | YES, but only PRE-DELIVERY, on {@link CustomResourceProvider.preDeliveryAuthzMaxRetries} — its OWN budget, the same dense 47.75s schedule every other resource type gets | a replay re-delivers the request, which is the hazard this flag exists for, so the PRE-delivery fence is what makes the budget affordable: nothing has been delivered, so a replay re-invokes NOTHING — see {@link CustomResourceProvider.isTransientAuthzThrow} |
+	* | Lambda `Invoke` / SNS `Publish` | YES, but only PRE-DELIVERY, on {@link CustomResourceProvider.preDeliveryAuthzMaxRetries} — its OWN budget, the same dense 47.75s schedule every other resource type gets | a replay re-delivers the request, which is the hazard this flag exists for, so the PRE-delivery fence is what makes the budget affordable: nothing has been delivered, so a replay re-invokes NOTHING. That rests on {@link CustomResourceProvider.isTransientAuthzThrow} admitting FRONT-DOOR rejections only — `delivered === false` alone does not establish it, since the flag flips when the call RETURNS — so read that method's doc before adding a pattern to the shared list it reads |
 	* | `waitUntilFunctionActiveV2` / `waitUntilFunctionUpdatedV2` | ALREADY, by the SDK waiter — and their wrapped failure is `markNonRetryable`d, so the loop below does not replay it either | measured against `@aws-sdk/client-lambda`: the generated `checkState` catches EVERY exception and returns `RETRY`, so a mid-propagation 403 on `lambda:GetFunction` is polled out to `maxWaitTime` (600s). Wrapping them again would only stack a second budget on top — and `@smithy/util-waiter` serializes its `observedResponses` into the TIMEOUT message, whose keys read `403: User: … is not authorized to perform: lambda:GetFunction …`, so a classifier reading that message would have replayed a PERMANENT denial for 3 x 600s |
 	* | `GetFunction` (delete-path backing-Lambda probe) | NO, deliberately | it already fails OPEN — anything but a definitive `ResourceNotFoundException` falls through to the normal invoke path, whose waiters cover the same propagation window one call later. Retrying would only delay that fall-through by up to 47.75s on a genuine permission denial |
 	* | anything AFTER delivery (`pollS3Response`, the `FunctionError` throw, `cleanupResponseObject`) | NO, deliberately | the handler is running and will PUT to the URL of THIS attempt; a replay strands it at a key nobody polls, which is precisely the bug `disableOuterRetry` prevents |
@@ -31509,8 +31510,11 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*
 	* **It is SMALL (2) because every retry it authorises RE-RUNS THE USER'S
 	* HANDLER**, and that is the whole reason the second shape does not share it:
-	* a pre-delivery throw invokes the handler ZERO times, so the argument that
-	* bounds this number does not apply there at all. Sharing it was measured
+	* a pre-delivery throw it replays invokes the handler ZERO times, so the
+	* argument that bounds this number does not apply there at all. That "zero"
+	* is carried by {@link CustomResourceProvider.isTransientAuthzThrow}
+	* admitting FRONT-DOOR rejections only, not by the `delivered === false`
+	* gate reading it off — see that method's doc. Sharing it was measured
 	* wrong — 2 retries on the dense schedule is 250ms + 500ms of coverage, i.e.
 	* 0.75s against an IAM-propagation window this repo has measured at 7-12s, so
 	* issue #2033's own scenario still failed with the fix in place.
@@ -31549,10 +31553,16 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* doubling to {@link IAM_PROPAGATION_MAX_DELAY_MS}). The measured window this
 	* has to cover is 7-12s; the FAILED-response budget's 0.75s does not.
 	*
-	* **Why it can afford that while its sibling cannot**: it fires only when
-	* `delivered === false`, so the handler has been invoked ZERO times and a
-	* replay re-runs NOTHING — no partial work repeated, no second physical
-	* resource from a Provider-framework `onEvent`, no stranded response URL. The
+	* **Why it can afford that while its sibling cannot**: the handler has been
+	* invoked ZERO times, so a replay re-runs NOTHING — no partial work repeated,
+	* no second physical resource from a Provider-framework `onEvent`, no
+	* stranded response URL. That guarantee comes from
+	* {@link CustomResourceProvider.isTransientAuthzThrow} admitting FRONT-DOOR
+	* rejections only, NOT from the `delivered === false` gate on its own: that
+	* flag flips when `Invoke` / `Publish` returns, so a throw between acceptance
+	* and resolution reaches the catch with it still false. It is the second
+	* fence, for a delivery that COMPLETED — read that method's doc before adding
+	* a pattern the shared list carries. The
 	* only cost of a retry here is one `PutObject` + one presign, and the
 	* abandoned placeholder is swept before the next attempt. So the constraint
 	* that keeps `transientAuthzMaxRetries` at 2 is simply absent, and matching
@@ -32006,16 +32016,29 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*    documents the drop-`cause` class in this very directory; a top-level-only
 	*    read would silently un-retry a wrapped propagation denial.
 	*
-	* **Every pattern in that union is an AUTHORIZATION or REQUEST-VALIDATION
-	* rejection, and that is what makes replaying an `Invoke` safe here.** Such a
-	* rejection is decided at the API front door, before any execution environment
-	* is engaged, so the handler provably did not run and a replay cannot
-	* re-deliver work — the hazard `disableOuterRetry` exists for. It is also why
-	* this classifier deliberately does NOT reach for the broader
+	* **Nearly every pattern in that union is an AUTHORIZATION or
+	* REQUEST-VALIDATION rejection, and that is what makes replaying an `Invoke`
+	* safe here.** Such a rejection is decided at the API front door, before any
+	* execution environment is engaged, so the handler provably did not run and a
+	* replay cannot re-deliver work — the hazard `disableOuterRetry` exists for.
+	*
+	* The union is shared, so it can acquire a member that is NOT front-door, and
+	* one already has: the Lambda CapacityProvider operator-role rejection added
+	* for issue #3174 is emitted by a Cloud Control RESOURCE HANDLER, i.e. after
+	* its own request was accepted. It is inert here only because no CR `Invoke`
+	* failure carries that text. Do NOT discharge the next such entry against
+	* `delivered`: `onDelivered()` runs after `invokeLambda` RESOLVES, so a throw
+	* between acceptance and resolution — the exact window a post-acceptance
+	* rejection arrives in — reaches this classifier with the flag still false.
+	* Front-door-ness is therefore a property each entry owes, not one the shared
+	* list confers; check a new entry against this paragraph before adding it.
+	*
+	* It is also why this classifier deliberately does NOT reach for the broader
 	* `isRetryableTransientError`: a throttle, an HTTP 5xx or a socket timeout can
 	* each arrive AFTER the request was accepted, so replaying one could invoke a
 	* non-idempotent handler twice. Those classes stay single-shot on this path by
-	* design, and the caller's `delivered` flag is the second, independent fence.
+	* design, and the caller's `delivered` flag is the second, independent fence
+	* for a delivery that COMPLETED — the case it can observe.
 	*/
 	isTransientAuthzThrow(error) {
 		if (isMarkedNonRetryable(error)) return false;
@@ -41201,7 +41224,7 @@ var DeployEngine = class DeployEngine {
 						this.logger.info(message);
 					}
 					const updateProvider = updateDecision.provider;
-					const updateProps = updateDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+					const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId)) : resolvedProps;
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
 					let captureProvider = updateProvider;
@@ -41663,7 +41686,11 @@ var DeployEngine = class DeployEngine {
 	* back to `applyDefaultNameForFallback` (which mints stack-prefixed
 	* names matching what the SDK provider would have done) otherwise.
 	*
-	* No-ops for types with no registered SDK provider (Tier 2 / CC-native).
+	* A type with no registered SDK provider (Tier 2 / CC-native) takes the
+	* `applyDefaultNameForFallback` arm too, which fills a name only when the
+	* type has a `FALLBACK_NAME_RULES` entry (`AWS::Lambda::CapacityProvider`,
+	* issue #3174) and returns the bag unchanged otherwise. An UPDATE drops the
+	* generated name again (`withoutGeneratedFallbackName`).
 	*/
 	preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) {
 		const sdkProvider = this.providerRegistry.getRegisteredTypes().includes(resourceType) ? this.providerRegistry.getProvider(resourceType) : void 0;
@@ -41999,4 +42026,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, ensureAssetStorage as $n, setAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, retryClassificationText as Ai, buildForceUnlockCommand as An, resolveSkipPrefix as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, orphansAfterRollback as Bn, uploadCfnTemplate as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, withErrorHandling as Ci, recordMaskOnlyValue as Cn, Synthesizer as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isTransientServerError as Di, LockManager as Dn, resolveApp as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isThrottlingError as Ei, scrubResourceRecord as En, getLegacyStateBucketName as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, warnDeprecatedNoPrefixCliFlag as Fr, resolveExplicitPhysicalId as Ft, gray as G, WorkGraph as Gn, derivePartitionAndUrlSuffix as Gr, requireConfigObject as Gt, formatResourceLine as H, shouldRetainResource as Hn, expectedOwnerParam as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, CFN_TEMPLATE_BODY_LIMIT as Ir, assertRegionMatch as It, yellow as J, loadPublishableAssetManifest as Jn, clearBucketRegionCache as Jr, producerRegionsFromState as Jt, green as K, buildAssetRedirectMap as Kn, AssemblyReader as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, CFN_TEMPLATE_URL_LIMIT as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, forceQuitRecoveryClause as Mn, resolveStateBucketWithDefaultAndSource as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, formatLockExpiry as Nn, resolveUseCdkBootstrapAssets as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, markNonRetryable as Oi, S3StateBackend as On, resolveAutoAssetStorage as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, stateBucketExistenceConfirmed as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, assertAssetBucketRegion as Qn, resetAwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, importableOutputKeys as Rn, MIGRATE_TMP_PREFIX as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, normalizeAwsError as Si, maskSecretsInText as Sn, getDockerImageBySourceHash as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, isRetryableTransientError as Ti, redactSecretsForState as Tn, getDefaultStateBucketName as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, AssetPublisher as Un, PARTITION_TABLE as Ur, replayWarn as Ut, toFiniteNumber as V, orphansCarriedFrom as Vn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vr, configStringRefusal as Vt, cyan as W, stringifyValue as Wn, canonicalizeRegion as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, AssetModeResolver as Xn, AwsClients as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, rewriteTemplateAssetReferences as Yn, resolveBucketRegion as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, BOOTSTRAP_MARKER_PREFIX as Zn, getAwsClients as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, StackTerminationProtectionError as _i, errorCauseChain as _n, runDockerForeground as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, DeployCancelledError as ai, findSilentDropProperties as an, validateContainerRepoName as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, formatError as bi, markSameGenerationBag as bn, stripControlChars as br, deleteSkipReason as bt, replayFailedOperations as c, LocalInvokeBuildError as ci, DagBuilder as cn, buildDockerImage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, NestedStackChildDirectDestroyError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerFailure as dr, beginCommandInterruptScope as dt, AssetError as ei, s3BucketWebsiteUrl as en, getBootstrapMarkerKey as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, PartialFailureError as fi, STATE_SOURCED_READBACK_RULES as fn, dockerSpawnEnvWithSensitive as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, StackHasActiveImportsError as gi, dynamicReferenceTokens as gn, redactDockerArgvValues as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ResourceUpdateNotSupportedError as hi, createSecretMasker as hn, partitionSensitiveEnv as hr, startInterruptWatch as ht, DeploymentEventsReader as i, DependencyError as ii, findActionableSilentDrops as in, validateAssetBucketName as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, __exportAll as ji, buildLockContentionMessage as jn, resolveStateBucketWithDefault as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, markRedactedCause as ki, rebuildClientForBucketRegion as kn, resolveCaptureObservedState as kr, isUnboundTemplateParameter as kt, replayRollback as l, LocalStartServiceError as li, TemplateParser as ln, describeDockerCapturedOutput as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, ResourceTimeoutError as mi, carriesSecretMask as mn, getDockerCmd as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConfigError as ni, DiffCalculator as nn, parseBootstrapMarker as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DynamicReferenceRegionAmbiguousError as oi, describeTypeWithThrottleRetry as on, buildDenyExternalAccessPolicy as or, ProviderRegistry as ot, maskingRetryLogger as p, ProvisioningError as pi, TEMPLATE_SOURCED_RULES as pn, formatDockerLoginError as pr, interruptWatchListenerCount as pt, red as q, createAssetRedirectResolver as qn, processStackMessages as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CrossAccountSecretRefusalError as ri, INTRINSIC_KEYS as rn, readBootstrapMarkerBody as rr, IAMRoleProvider as rt, planRollback as s, IntrinsicResolutionRefusalError as si, withRetry as sn, describeAwsFailure as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CdkdError as ti, applyRoleArnIfSet as tn, isCrossRegionRedirect as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LockError as ui, STATE_SOURCED_BASELINE_RULES as un, describeDockerExecFailure as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StateError as vi, identityKeyFor as vn, runDockerStreaming as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, isMarkedNonRetryable as wi, recoverMaskedOutput as wn, synthesisStatusMessage as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, isCdkdError as xi, maskSecretsInError as xn, AssetManifestLoader as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, SynthesisError as yi, isSingleDynamicReferenceToken as yn, escapeRegExp$1 as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputs as zn, findLargeInlineResources as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-B6t-R3eP.js.map
+//# sourceMappingURL=deploy-engine-C52t7w66.js.map