@blaxel/core 0.3.9-preview.239 → 0.3.10-preview.241

package/dist/cjs/common/h2fetch.js

@@ -1,14 +1,46 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUnprocessedRequestError = isUnprocessedRequestError;
 exports.withUploadSlot = withUploadSlot;
 exports.createH2Fetch = createH2Fetch;
 exports.createPoolBackedH2Fetch = createPoolBackedH2Fetch;
 exports.h2RequestDirectFromPool = h2RequestDirectFromPool;
 exports.h2RequestDirect = h2RequestDirect;
+const http2_1 = __importDefault(require("http2"));
 const settings_js_1 = require("./settings.js");
 const h2ref_js_1 = require("./h2ref.js");
 const MIN_H2_SESSION_MAX_LISTENERS = 64;
 const sessionsWithListenerBudget = new WeakSet();
+// Number of transparent re-sends the gateway performs for a request the peer
+// PROVABLY never processed (see `isUnprocessedRequestError`). One is enough:
+// the re-send runs on a freshly established session, so a second failure means
+// the drain is not a one-off connection recycle and the caller should see it.
+const MAX_UNPROCESSED_RESENDS = 1;
+/**
+ * True when the peer guaranteed it never processed the request, so re-sending it
+ * cannot duplicate a side effect — even for a non-idempotent method.
+ *
+ * HTTP/2 gives two such guarantees:
+ *   - GOAWAY carries `lastStreamID`: every stream with a higher id was not and
+ *     will not be processed (RFC 9113 §6.8).
+ *   - RST_STREAM with REFUSED_STREAM means the peer took no action on it.
+ *
+ * This is strictly stronger than `isTransientResetError` in transient-retry.ts,
+ * which classifies errors that are merely *likely* safe and therefore only
+ * covers idempotent operations.
+ */
+function isUnprocessedRequestError(error) {
+    return (!!error &&
+        typeof error === "object" &&
+        error.blaxelUnprocessedRequest === true);
+}
+function markUnprocessed(error) {
+    error.blaxelUnprocessedRequest = true;
+    return error;
+}
 /**
  * Per-domain async semaphore that bounds the number of in-flight HTTP/2
  * requests against a single edge domain (one H2 session). The cap is keyed
@@ -150,13 +182,15 @@ function createH2Fetch(session) {
  *   2. get a live session from the pool,
  *   3. send the request on it,
  *   4. evict the session if the send fails after a stream was opened,
- *   5. fall back to globalThis.fetch when the pool has no usable session.
+ *   5. re-send once on a fresh session when the peer provably never processed
+ *      the request (`isUnprocessedRequestError`),
+ *   6. fall back to globalThis.fetch when the pool has no usable session.
  *
  * This is the chokepoint where reliability behavior that must protect EVERY
- * consumer belongs: the open-stream concurrency limit today, and retry,
- * timeouts, typed errors, and observability in later phases. Adding it once here
- * (instead of re-implementing it per entry point) is what stops the recurring
- * "fixed on one path, still broken on another" regressions.
+ * consumer belongs: the open-stream concurrency limit and the unprocessed-request
+ * re-send today, and timeouts, typed errors, and observability in later phases.
+ * Adding it once here (instead of re-implementing it per entry point) is what
+ * stops the recurring "fixed on one path, still broken on another" regressions.
  *
  * `send` performs the actual wire send on a live session; the caller supplies it
  * so the gateway stays agnostic to the `Request` vs `(url, init)` call shapes,
@@ -165,6 +199,25 @@ function createH2Fetch(session) {
  * stream is opened).
  */
 async function h2GatewayRequest(pool, domain, send, fallback) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await h2GatewayAttempt(pool, domain, send, fallback);
+        }
+        catch (err) {
+            // The peer drained the connection without processing this request (a
+            // gateway recycling the session, a rolling deploy, or a route moving).
+            // Nothing reached origin, so re-send once on a fresh session instead of
+            // surfacing a transport failure the caller cannot act on. Safe for every
+            // method — the unprocessed guarantee comes from the peer, not a guess
+            // about idempotency (unlike retryOnTransientReset).
+            if (attempt < MAX_UNPROCESSED_RESENDS && isUnprocessedRequestError(err)) {
+                continue;
+            }
+            throw err;
+        }
+    }
+}
+async function h2GatewayAttempt(pool, domain, send, fallback) {
     // Take the slot here, but hand its release to the send path: it is held for
     // the OPEN-STREAM lifetime and freed on the stream terminal (ENG-2678). A
     // request that never opens a stream on the shared session (the fallback goes
@@ -213,7 +266,7 @@ async function h2GatewayRequest(pool, domain, send, fallback) {
  * before any H2 frames are sent.
  */
 function createPoolBackedH2Fetch(pool, domain) {
-    return (input) => h2GatewayRequest(pool, domain, (session, options) => _h2Request(session, input, options), () => globalThis.fetch(input));
+    return (input) => h2GatewayRequest(pool, domain, (session, options) => _h2Request(session, input, options), () => fallbackFetchForRequest(input));
 }
 /**
  * Pool-backed H2 request taking raw url + init (skips Request allocation),
@@ -285,6 +338,30 @@ function h2RequestDirectInternal(session, url, init, options) {
     }
     return _h2Send(session, h2Headers, body, init?.signal ?? null, url, init, options);
 }
+// A `Request` body can only be read once, so the buffered bytes are memoized
+// per Request: the gateway's unprocessed re-send calls `_h2Request` again with
+// the same object, which would otherwise throw "body already read".
+const bufferedRequestBodies = new WeakMap();
+/**
+ * `globalThis.fetch` fallback for a Request whose body may already have been
+ * buffered by an earlier attempt: re-sending the consumed Request object itself
+ * would throw, so the memoized bytes are replayed instead.
+ */
+function fallbackFetchForRequest(input) {
+    if (!bufferedRequestBodies.has(input))
+        return globalThis.fetch(input);
+    // Re-wrap the original Request so every option it carries (redirect,
+    // credentials, mode, cache, ...) survives; only the body is substituted.
+    return globalThis.fetch(new Request(input, { body: bufferedRequestBodies.get(input) }));
+}
+async function bufferRequestBody(input) {
+    if (bufferedRequestBodies.has(input)) {
+        return bufferedRequestBodies.get(input);
+    }
+    const body = input.body ? Buffer.from(await input.arrayBuffer()) : undefined;
+    bufferedRequestBodies.set(input, body);
+    return body;
+}
 async function _h2Request(session, input, options) {
     const url = new URL(input.url);
     const method = input.method || "GET";
@@ -298,12 +375,9 @@ async function _h2Request(session, input, options) {
             continue;
         h2Headers[key] = value;
     }
-    let body;
-    if (input.body) {
-        body = Buffer.from(await input.arrayBuffer());
-        if (!h2Headers["content-length"]) {
-            h2Headers["content-length"] = body.byteLength;
-        }
+    const body = await bufferRequestBody(input);
+    if (body && !h2Headers["content-length"]) {
+        h2Headers["content-length"] = body.byteLength;
     }
     return _h2Send(session, h2Headers, body, input.signal, input.url, {
         method,
@@ -319,6 +393,8 @@ function _h2Send(session, h2Headers, body, signal, fallbackUrl, fallbackInit, op
         let streamController = null;
         let streamClosed = false;
         let req = null;
+        // `lastStreamID` from the peer's GOAWAY, once seen (null = no GOAWAY).
+        let goawayLastStreamID = null;
         let releaseSessionRef = () => { };
         // The per-domain open-stream slot (idempotent; no-op for the non-pool
         // transports). Held for the OPEN-STREAM lifetime and released alongside the
@@ -364,14 +440,41 @@ function _h2Send(session, h2Headers, body, signal, fallbackUrl, fallbackInit, op
             req?.close();
             reject(err);
         };
+        // RFC 9113 §6.8: a GOAWAY's `lastStreamID` is the highest stream the peer
+        // processed or may still process, so any stream above it was refused
+        // outright. A stream with no id never put HEADERS on the wire at all. Either
+        // way the request cannot have reached origin, which is what lets the gateway
+        // re-send it for ANY method.
+        const streamWasNeverProcessed = () => {
+            if (goawayLastStreamID === null)
+                return false;
+            const id = req?.id;
+            if (typeof id !== "number")
+                return true;
+            return id > goawayLastStreamID;
+        };
+        // REFUSED_STREAM carries the same "took no action" guarantee as a GOAWAY
+        // above lastStreamID, and Node destroys streams the GOAWAY refused with
+        // ERR_HTTP2_GOAWAY_SESSION — whichever of the stream or session listener
+        // fires first, the error reaching the caller is flagged identically.
+        const markIfNeverProcessed = (err) => {
+            const streamError = err;
+            if (streamWasNeverProcessed() ||
+                req?.rstCode === http2_1.default.constants.NGHTTP2_REFUSED_STREAM ||
+                streamError.code === "ERR_HTTP2_GOAWAY_SESSION") {
+                return markUnprocessed(err);
+            }
+            return err;
+        };
         const onSessionClose = () => {
-            rejectBeforeResponse(new Error("HTTP/2 session closed before response"));
+            rejectBeforeResponse(markIfNeverProcessed(new Error("HTTP/2 session closed before response")));
         };
-        const onSessionGoaway = () => {
-            rejectBeforeResponse(new Error("HTTP/2 session sent GOAWAY before response"));
+        const onSessionGoaway = (_errorCode, lastStreamID) => {
+            goawayLastStreamID = typeof lastStreamID === "number" ? lastStreamID : 0;
+            rejectBeforeResponse(markIfNeverProcessed(new Error("HTTP/2 session sent GOAWAY before response")));
         };
         const onSessionError = (err) => {
-            rejectBeforeResponse(err);
+            rejectBeforeResponse(markIfNeverProcessed(err));
         };
         session.once("close", onSessionClose);
         session.once("goaway", onSessionGoaway);
@@ -457,7 +560,7 @@ function _h2Send(session, h2Headers, body, signal, fallbackUrl, fallbackInit, op
             settled = true;
             cleanupBeforeResponseListeners();
             cleanupActiveRequest();
-            reject(err);
+            reject(markIfNeverProcessed(err));
         });
         if (body) {
             req.end(body);

package/dist/cjs/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.9-preview.239";
-const BUILD_COMMIT = "73d9ca5549cb452d2440ec2a738f2718cc0f065d";
+const BUILD_VERSION = "0.3.10-preview.241";
+const BUILD_COMMIT = "7955dd9acd80e9962ec37dae05615a519fe9f422";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-28";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/cjs/types/common/h2fetch.d.ts

@@ -1,5 +1,19 @@
 import http2 from "http2";
 import type { H2Pool } from "./h2pool.js";
+/**
+ * True when the peer guaranteed it never processed the request, so re-sending it
+ * cannot duplicate a side effect — even for a non-idempotent method.
+ *
+ * HTTP/2 gives two such guarantees:
+ *   - GOAWAY carries `lastStreamID`: every stream with a higher id was not and
+ *     will not be processed (RFC 9113 §6.8).
+ *   - RST_STREAM with REFUSED_STREAM means the peer took no action on it.
+ *
+ * This is strictly stronger than `isTransientResetError` in transient-retry.ts,
+ * which classifies errors that are merely *likely* safe and therefore only
+ * covers idempotent operations.
+ */
+export declare function isUnprocessedRequestError(error: unknown): boolean;
 /**
  * Run `fn` while holding an upload slot for `domain`, releasing it when `fn`
  * settles (the part PUT completes or fails). Bounds concurrent in-flight upload