@fjall/components-infrastructure 39.0.5 → 39.0.6

package/dist/lib/resources/aws/compute/ecsRolloutBarrier.js

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ECS_ROLLOUT_BARRIER_RESOURCE_TYPE } from "@fjall/util/aws";
+import { ArnFormat, Aws, CustomResource, Duration, Fn, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { LogLevel } from "aws-cdk-lib/aws-stepfunctions";
+import { Construct } from "constructs";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
+import { CustomResourceProvider } from "../utilities/customResourceProvider.js";
+import { LambdaFunction } from "./lambda.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const LAMBDA_SOURCE_FILE = "ecsRolloutBarrierLambda.source.cjs";
+/** How often the provider asks `isComplete` whether the rollout has finished. */
+const QUERY_INTERVAL = Duration.seconds(15);
+/**
+ * The provider's ceiling, CloudFormation's own for a custom resource. Limit
+ * (2026-10-01): a rollout longer than an hour fails the barrier; the engine's
+ * own deploy budget is 30 minutes.
+ */
+const TOTAL_TIMEOUT = Duration.hours(1);
+/** One handler call: a DescribeServices, then at most a few listing pages. */
+const HANDLER_TIMEOUT_SECONDS = 60;
+const PROVIDER_ID = "FjallEcsRolloutBarrierProvider";
+const WAITER_LOG_GROUP_ID = "WaiterLogGroup";
+/** Hex characters of the construct path's digest the waiter group's name carries. */
+const WAITER_NAME_PATH_DIGEST_LENGTH = 24;
+/**
+ * `/aws/vendedlogs/states/<stack name>-<stack id>-<path digest>`, the name
+ * main's `vendedLogsLogGroup` gives the same group, so a 40.0.0 upgrade keeps
+ * it in place. CloudWatch Logs authorises Step Functions' delivery to every
+ * group under `/aws/vendedlogs/` through one statement of the account's
+ * resource policy, where a group outside it adds its own ARN to that shared
+ * policy. The stack's id differs for every stack ever created under its
+ * name, and the digest of the construct path makes the name unique within
+ * the stack.
+ */
+function waiterLogGroupName(scope) {
+    const stackId = Fn.select(2, Fn.split("/", Aws.STACK_ID));
+    const pathDigest = createHash("sha256")
+        .update(`${scope.node.path}/${WAITER_LOG_GROUP_ID}`)
+        .digest("hex")
+        .slice(0, WAITER_NAME_PATH_DIGEST_LENGTH);
+    return `/aws/vendedlogs/states/${Aws.STACK_NAME}-${stackId}-${pathDigest}`;
+}
+/**
+ * The stack's one rollout-barrier provider: the `onEvent` and `isComplete`
+ * handlers, from one inline source, and the provider framework that asks
+ * `isComplete` every 15 s for at most an hour. Each barrier grants the
+ * `isComplete` role the reads of its own service only; the role also reads
+ * its own stack's status, to complete at once on a rollback.
+ *
+ * The framework's waiter state machine logs at FATAL, without execution
+ * data, to a group named under `/aws/vendedlogs/states/`
+ * (`waiterLogGroupName`). Being named, the group is destroyed with its stack
+ * whatever the stage: a group a rollback retained would collide with the one
+ * the next upgrade creates under the same name.
+ */
+export class EcsRolloutBarrierProvider extends Construct {
+    /** The stack's provider, made on first use. */
+    static of(scope) {
+        const stack = Stack.of(scope);
+        const existing = stack.node.tryFindChild(PROVIDER_ID);
+        if (existing instanceof EcsRolloutBarrierProvider)
+            return existing;
+        if (existing !== undefined) {
+            throw new Error(`${stack.node.path}/${PROVIDER_ID} is taken by a construct that is not the rollout-barrier provider`);
+        }
+        return new EcsRolloutBarrierProvider(stack, PROVIDER_ID);
+    }
+    serviceToken;
+    isCompleteHandler;
+    granted = new Set();
+    constructor(scope, id) {
+        super(scope, id);
+        // One source serves both handlers, each by its own export.
+        const code = Code.fromInline(readFileSync(path.resolve(__dirname, LAMBDA_SOURCE_FILE), "utf-8"));
+        const handlerProps = (handler, description) => ({
+            runtime: Runtime.NODEJS_24_X,
+            handler,
+            stackOutputs: "none",
+            code,
+            lambdaDescription: description,
+            roleDescription: `Execution role for the Fjall ECS rollout barrier (${handler})`,
+            timeout: HANDLER_TIMEOUT_SECONDS,
+            memorySize: 256,
+            inlinePolicy: []
+        });
+        const onEvent = new LambdaFunction(this, "OnEvent", handlerProps("index.onEvent", "Fjall ECS rollout barrier: records when the wait began"));
+        this.isCompleteHandler = new LambdaFunction(this, "IsComplete", handlerProps("index.isComplete", "Fjall ECS rollout barrier: reads whether the service's deployment finished"));
+        const provider = new CustomResourceProvider(this, "Provider", {
+            onEventHandler: onEvent,
+            isCompleteHandler: this.isCompleteHandler,
+            queryInterval: QUERY_INTERVAL,
+            totalTimeout: TOTAL_TIMEOUT,
+            logGroup: new LogGroup(this, "ProviderLogGroup", {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            }),
+            disableWaiterStateMachineLogging: false,
+            waiterStateMachineLogOptions: {
+                destination: new LogGroup(this, WAITER_LOG_GROUP_ID, {
+                    logGroupName: waiterLogGroupName(this),
+                    retention: DEFAULT_FRAMEWORK_LOG_RETENTION,
+                    removalPolicy: RemovalPolicy.DESTROY
+                }),
+                level: LogLevel.FATAL,
+                includeExecutionData: false
+            }
+        });
+        this.serviceToken = provider.serviceToken;
+        this.isCompleteHandler.addToRolePolicy(new PolicyStatement({
+            actions: ["cloudformation:DescribeStacks"],
+            resources: [Aws.STACK_ID]
+        }));
+        markDeployTimeWriter(this);
+    }
+    /**
+     * The reads `isComplete` makes of one service, scoped to it: its
+     * description, its deployments and their revisions (AWS service reference,
+     * ecs.json, 2026-10-01). Granted once a service.
+     *
+     * The ARNs are built from the literal cluster and service names, never from
+     * the service's attributes: the grant lands on the one role every barrier in
+     * the stack shares, so a reference to a service would make each barrier
+     * wait for every owner, and an owner that itself awaits another owner would
+     * close a cycle.
+     */
+    grantRolloutReads(clusterName, serviceName) {
+        if (Token.isUnresolved(clusterName) || Token.isUnresolved(serviceName)) {
+            throw new Error(`${this.node.path}: a rollout barrier's grant needs the literal cluster and service names`);
+        }
+        const key = `${clusterName}/${serviceName}`;
+        if (this.granted.has(key))
+            return;
+        this.granted.add(key);
+        const stack = Stack.of(this);
+        const arnOf = (resource, resourceName) => stack.formatArn({
+            service: "ecs",
+            resource,
+            resourceName,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME
+        });
+        this.isCompleteHandler.addToRolePolicy(new PolicyStatement({
+            actions: [
+                "ecs:DescribeServices",
+                "ecs:ListServiceDeployments",
+                "ecs:DescribeServiceDeployments",
+                "ecs:DescribeServiceRevisions"
+            ],
+            resources: [
+                arnOf("service", key),
+                arnOf("service-deployment", `${key}/*`),
+                arnOf("service-revision", `${key}/*`)
+            ]
+        }));
+    }
+}
+/**
+ * A custom resource that completes only once ECS reports the service's
+ * deployment of its task definition finished, and fails once ECS rolled it
+ * back (FJL-901). Its dependants therefore wait for the rollout, PRE_SCALE_UP
+ * migrate hook included, whatever CloudFormation's own stabilisation of the
+ * service reports. Delete only acknowledges.
+ */
+export class EcsRolloutBarrier extends Construct {
+    resource;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const provider = EcsRolloutBarrierProvider.of(this);
+        provider.grantRolloutReads(props.clusterName, props.serviceName);
+        this.resource = new CustomResource(this, "Resource", {
+            serviceToken: provider.serviceToken,
+            resourceType: ECS_ROLLOUT_BARRIER_RESOURCE_TYPE,
+            properties: {
+                Cluster: props.clusterName,
+                Service: props.service.serviceArn,
+                TaskDefinition: props.taskDefinitionArn
+            }
+        });
+        this.resource.node.addDependency(props.service);
+    }
+}

package/dist/lib/resources/aws/compute/ecsRolloutBarrierLambda.source.cjs

@@ -0,0 +1,475 @@
+/**
+ * ECS rollout barrier (FJL-901). Inlined into the onEvent and isComplete
+ * functions of a custom-resource provider by ecsRolloutBarrier.ts.
+ *
+ * CloudFormation starts a resource's dependants when the resource logs
+ * "Eventual consistency check initiated", and since 2026-10-01 an updating
+ * ECS service logs it long before its deployment, PRE_SCALE_UP migrate hook
+ * included, has finished. A custom resource logs no such check: its
+ * dependants wait for its response. So this one waits, reading ECS, until the
+ * service's deployment of the task definition its properties name has
+ * finished, and fails once ECS has rolled that deployment back, which fails
+ * the stack's update.
+ *
+ * The verdict reads the service's live state first, so the same code is right
+ * on the forward path and when the service needed no new deployment. On a
+ * stack rollback (CloudFormation re-sends the previous task definition) the
+ * barrier completes at once: it has nothing to order there. When ECS lists no
+ * deployment of the task definition, the live state decides alone: a service
+ * at rest on that revision, or on a later one of its family (a restart's or a
+ * code-only deploy's copy), finished that rollout before the barrier began.
+ *
+ * Only a definitive verdict fails: the provider framework submits FAILED for
+ * any error isComplete throws, so a read that failed for a transient reason
+ * (a throttle, a 5xx, a network fault, this invocation's own deadline) waits
+ * for the next poll instead, and says so in the log. So does an access denial
+ * in the wait's first two minutes, while IAM propagates the barrier's grant.
+ *
+ * CommonJS because Code.fromInline lands the source as `index.js`, which
+ * Lambda treats as CommonJS by default.
+ */
+const {
+  ECSClient,
+  DescribeServicesCommand,
+  ListServiceDeploymentsCommand,
+  DescribeServiceDeploymentsCommand,
+  DescribeServiceRevisionsCommand
+} = require("@aws-sdk/client-ecs");
+const {
+  CloudFormationClient,
+  DescribeStacksCommand
+} = require("@aws-sdk/client-cloudformation");
+
+/**
+ * How long the barrier waits for a deployment of its task definition to be
+ * listed, or for the service to come to rest on it.
+ */
+const NO_DEPLOYMENT_GRACE_MS = 10 * 60 * 1000;
+
+/** How far back the barrier lists the service's deployments. */
+const LISTING_WINDOW_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * One isComplete invocation's reads, well inside the function's 60 s timeout,
+ * which the framework would otherwise read as a failure.
+ */
+const INVOCATION_BUDGET_MS = 40 * 1000;
+
+/**
+ * Every service-deployment status ECS reports (ServiceDeploymentStatus,
+ * @aws-sdk/client-ecs 3.1101.0), by what it means for the barrier. A status
+ * outside all three waits, and the verdict log names it: an unknown status
+ * never completes the barrier.
+ */
+const SUCCEEDED = new Set(["SUCCESSFUL"]);
+const FAILED = new Set(["ROLLBACK_SUCCESSFUL", "ROLLBACK_FAILED", "STOPPED"]);
+const WAITING = new Set([
+  "PENDING",
+  "IN_PROGRESS",
+  "STOP_REQUESTED",
+  "ROLLBACK_REQUESTED",
+  "ROLLBACK_IN_PROGRESS"
+]);
+
+/** The stack status under which CloudFormation rolls a failed update back. */
+const ROLLING_BACK = "UPDATE_ROLLBACK_IN_PROGRESS";
+
+/** The most deployments or revisions one Describe call takes. */
+const DESCRIBE_BATCH = 20;
+
+/**
+ * Failures that say nothing about the rollout: the read is retried at the
+ * next poll. Any other failure (access denied, a service that no longer
+ * exists, a malformed request) is definitive and fails the barrier.
+ */
+const TRANSIENT_ERROR_NAMES = new Set([
+  "AbortError",
+  "Throttling",
+  "ThrottlingException",
+  "TooManyRequestsException",
+  "RequestLimitExceeded",
+  "ServerException",
+  "ServiceUnavailableException",
+  "InternalFailure",
+  "InternalServerError",
+  "RequestTimeout",
+  "RequestTimeoutException",
+  "TimeoutError"
+]);
+const TRANSIENT_ERROR_CODES = new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENOTFOUND"
+]);
+
+/**
+ * How long after the wait began an access denial still reads as IAM
+ * propagating the barrier's grant, which lands on the shared role in the same
+ * stack operation. After it, a denial is definitive.
+ */
+const ACCESS_PROPAGATION_GRACE_MS = 2 * 60 * 1000;
+const ACCESS_DENIED_NAMES = new Set(["AccessDeniedException", "AccessDenied"]);
+
+function isAccessDenied(err) {
+  return (
+    err !== null && typeof err === "object" && ACCESS_DENIED_NAMES.has(err.name)
+  );
+}
+
+function isTransient(err) {
+  if (err === null || typeof err !== "object") return false;
+  if (TRANSIENT_ERROR_NAMES.has(err.name)) return true;
+  if (TRANSIENT_ERROR_CODES.has(err.code)) return true;
+  const status = err.$metadata && err.$metadata.httpStatusCode;
+  return typeof status === "number" && status >= 500;
+}
+
+let defaultClient;
+function getDefaultClient() {
+  if (!defaultClient) defaultClient = new ECSClient({});
+  return defaultClient;
+}
+
+let defaultStackClient;
+function getDefaultStackClient() {
+  if (!defaultStackClient) defaultStackClient = new CloudFormationClient({});
+  return defaultStackClient;
+}
+
+/**
+ * Whether CloudFormation is rolling the barrier's stack back. On a rollback
+ * the barrier has nothing to order: its dependants return to the code that
+ * ran before, whatever the order, and a barrier that waited could only fail
+ * the rollback, whichever order CloudFormation rolls resources back in.
+ */
+async function stackRollingBack(stackClient, stackId, abortSignal) {
+  const answer = await stackClient.send(
+    new DescribeStacksCommand({ StackName: stackId }),
+    { abortSignal }
+  );
+  const stack = (answer.Stacks || [])[0];
+  if (stack === undefined) {
+    throw new Error(`CloudFormation answered with no stack ${stackId}`);
+  }
+  return stack.StackStatus === ROLLING_BACK;
+}
+
+function propertiesOf(event) {
+  const properties = (event && event.ResourceProperties) || {};
+  const { Cluster, Service, TaskDefinition } = properties;
+  if (
+    typeof Cluster !== "string" ||
+    Cluster === "" ||
+    typeof Service !== "string" ||
+    Service === "" ||
+    typeof TaskDefinition !== "string" ||
+    TaskDefinition === ""
+  ) {
+    throw new Error(
+      "The rollout barrier needs its Cluster, Service and TaskDefinition properties"
+    );
+  }
+  return { cluster: Cluster, service: Service, taskDefinition: TaskDefinition };
+}
+
+function physicalIdOf(event, properties) {
+  return (
+    (event && event.PhysicalResourceId) ||
+    `rollout-barrier:${properties.cluster}:${properties.service}`
+  );
+}
+
+async function onEvent(event) {
+  if (event.RequestType === "Delete") {
+    return { PhysicalResourceId: event.PhysicalResourceId };
+  }
+  const properties = propertiesOf(event);
+  return {
+    PhysicalResourceId: physicalIdOf(event, properties),
+    Data: { WaitStartedAt: String(Date.now()) }
+  };
+}
+
+/** The service's deployments, as DescribeServices answers them now. */
+async function liveDeployments(client, properties, abortSignal) {
+  const answer = await client.send(
+    new DescribeServicesCommand({
+      cluster: properties.cluster,
+      services: [properties.service]
+    }),
+    { abortSignal }
+  );
+  const service = (answer.services || [])[0];
+  if (service === undefined) {
+    throw new Error(
+      `ECS answered with no service ${properties.service} in ${properties.cluster}`
+    );
+  }
+  return service.deployments || [];
+}
+
+function primaryOf(deployments) {
+  return deployments.find((deployment) => deployment.status === "PRIMARY");
+}
+
+/**
+ * Whether the PRIMARY deployment runs `taskDefinition`, has completed, and
+ * runs every task it wants.
+ */
+function liveRolloutComplete(deployments, properties) {
+  const primary = primaryOf(deployments);
+  return (
+    primary !== undefined &&
+    primary.taskDefinition === properties.taskDefinition &&
+    primary.rolloutState === "COMPLETED" &&
+    primary.runningCount === primary.desiredCount
+  );
+}
+
+/** A task-definition ARN's family and revision, or undefined when it has neither. */
+function familyRevisionOf(taskDefinitionArn) {
+  const match = /:task-definition\/([^:/]+):(\d+)$/.exec(
+    typeof taskDefinitionArn === "string" ? taskDefinitionArn : ""
+  );
+  return match === null
+    ? undefined
+    : { family: match[1], revision: Number(match[2]) };
+}
+
+/**
+ * Whether the service is at rest on `taskDefinition` or on a later revision
+ * of its family: its PRIMARY deployment has completed, and no other
+ * deployment is still active. Revisions only grow, so a later one was
+ * registered after it, which a restart's or a code-only deploy's copy is;
+ * while ECS still shows an earlier revision, the service is not at rest on
+ * this one, whatever it shows next. Task counts are not read: the rollout
+ * finished, and a shortfall since is capacity, not order.
+ */
+function atRestOnOrAfter(deployments, taskDefinition) {
+  const primary = primaryOf(deployments);
+  if (primary === undefined || primary.rolloutState !== "COMPLETED") {
+    return false;
+  }
+  if (deployments.some((deployment) => deployment.status === "ACTIVE")) {
+    return false;
+  }
+  const wanted = familyRevisionOf(taskDefinition);
+  const live = familyRevisionOf(primary.taskDefinition);
+  return (
+    wanted !== undefined &&
+    live !== undefined &&
+    live.family === wanted.family &&
+    live.revision >= wanted.revision
+  );
+}
+
+async function inBatches(items, read) {
+  const out = [];
+  for (let at = 0; at < items.length; at += DESCRIBE_BATCH) {
+    out.push(...(await read(items.slice(at, at + DESCRIBE_BATCH))));
+  }
+  return out;
+}
+
+/**
+ * The newest service deployment whose target revision runs `taskDefinition`,
+ * or undefined when none is listed yet.
+ */
+async function newestDeploymentOf(client, properties, now, abortSignal) {
+  const arns = [];
+  let nextToken;
+  do {
+    const page = await client.send(
+      new ListServiceDeploymentsCommand({
+        cluster: properties.cluster,
+        service: properties.service,
+        createdAt: { after: new Date(now - LISTING_WINDOW_MS) },
+        ...(nextToken !== undefined ? { nextToken } : {})
+      }),
+      { abortSignal }
+    );
+    for (const summary of page.serviceDeployments || []) {
+      if (summary.serviceDeploymentArn) arns.push(summary.serviceDeploymentArn);
+    }
+    nextToken = page.nextToken;
+  } while (nextToken);
+  if (arns.length === 0) return undefined;
+
+  const deployments = await inBatches(arns, async (batch) => {
+    const answer = await client.send(
+      new DescribeServiceDeploymentsCommand({ serviceDeploymentArns: batch }),
+      { abortSignal }
+    );
+    return answer.serviceDeployments || [];
+  });
+  const revisionArns = [
+    ...new Set(
+      deployments
+        .map(
+          (deployment) =>
+            deployment.targetServiceRevision &&
+            deployment.targetServiceRevision.arn
+        )
+        .filter((arn) => typeof arn === "string")
+    )
+  ];
+  const revisions = await inBatches(revisionArns, async (batch) => {
+    const answer = await client.send(
+      new DescribeServiceRevisionsCommand({ serviceRevisionArns: batch }),
+      { abortSignal }
+    );
+    return answer.serviceRevisions || [];
+  });
+  const taskDefinitionOf = new Map(
+    revisions.map((revision) => [
+      revision.serviceRevisionArn,
+      revision.taskDefinition
+    ])
+  );
+  const matching = deployments.filter(
+    (deployment) =>
+      deployment.targetServiceRevision &&
+      taskDefinitionOf.get(deployment.targetServiceRevision.arn) ===
+        properties.taskDefinition
+  );
+  matching.sort(
+    (a, b) =>
+      (b.createdAt ? new Date(b.createdAt).getTime() : 0) -
+      (a.createdAt ? new Date(a.createdAt).getTime() : 0)
+  );
+  return matching[0];
+}
+
+/**
+ * `complete`, `waiting`, or `failed` with the reason, for the service's
+ * deployment of the task definition the barrier names.
+ */
+async function rolloutVerdict(
+  clients,
+  properties,
+  stackId,
+  waitStartedAt,
+  now,
+  abortSignal
+) {
+  const live = await liveDeployments(clients.ecs, properties, abortSignal);
+  if (liveRolloutComplete(live, properties)) {
+    return { kind: "complete" };
+  }
+  if (await stackRollingBack(clients.stack, stackId, abortSignal)) {
+    return { kind: "complete", rollingBack: true };
+  }
+  const deployment = await newestDeploymentOf(
+    clients.ecs,
+    properties,
+    now,
+    abortSignal
+  );
+  if (deployment === undefined) {
+    if (atRestOnOrAfter(live, properties.taskDefinition)) {
+      return { kind: "complete", atRest: true };
+    }
+    return now - waitStartedAt >= NO_DEPLOYMENT_GRACE_MS
+      ? {
+          kind: "failed",
+          reason:
+            `ECS lists no deployment of ${properties.taskDefinition} on ${properties.service} ` +
+            `from the last ${LISTING_WINDOW_MS / 3600000} hours, and the service did not come to rest ` +
+            `on it or a later revision of its family within ${NO_DEPLOYMENT_GRACE_MS / 60000} minutes`
+        }
+      : { kind: "waiting" };
+  }
+  if (SUCCEEDED.has(deployment.status)) return { kind: "complete" };
+  if (FAILED.has(deployment.status)) {
+    return {
+      kind: "failed",
+      reason:
+        `ECS ended the deployment of ${properties.taskDefinition} on ${properties.service} ` +
+        `${deployment.status}` +
+        (deployment.statusReason ? `: ${deployment.statusReason}` : "") +
+        ` (${deployment.serviceDeploymentArn})`
+    };
+  }
+  return WAITING.has(deployment.status)
+    ? { kind: "waiting" }
+    : { kind: "waiting", unknownStatus: String(deployment.status) };
+}
+
+async function isComplete(event, deps) {
+  if (event.RequestType === "Delete") return { IsComplete: true };
+  const properties = propertiesOf(event);
+  const stackId = event.StackId;
+  if (typeof stackId !== "string" || stackId === "") {
+    throw new Error("The rollout barrier's request names no stack");
+  }
+  const clients = {
+    ecs: (deps && deps.client) || getDefaultClient(),
+    stack: (deps && deps.stackClient) || getDefaultStackClient()
+  };
+  const now = (deps && deps.now) || Date.now();
+  const abortSignal =
+    (deps && deps.abortSignal) || AbortSignal.timeout(INVOCATION_BUDGET_MS);
+  const recorded = Number(event.Data && event.Data.WaitStartedAt);
+  const waitStartedAt =
+    Number.isFinite(recorded) && recorded > 0 ? recorded : now;
+  let verdict;
+  try {
+    verdict = await rolloutVerdict(
+      clients,
+      properties,
+      stackId,
+      waitStartedAt,
+      now,
+      abortSignal
+    );
+  } catch (err) {
+    const propagating =
+      isAccessDenied(err) && now - waitStartedAt < ACCESS_PROPAGATION_GRACE_MS;
+    if (!isTransient(err) && !propagating) throw err;
+    verdict = { kind: "waiting", transient: err.name || err.code || "unknown" };
+  }
+  console.log(
+    JSON.stringify({
+      msg: "rollout-barrier-verdict",
+      service: properties.service,
+      taskDefinition: properties.taskDefinition,
+      verdict: verdict.kind,
+      ...(verdict.rollingBack ? { stackRollingBack: true } : {}),
+      ...(verdict.atRest ? { atRest: true } : {}),
+      ...(verdict.unknownStatus !== undefined
+        ? { unknownStatus: verdict.unknownStatus }
+        : {}),
+      ...(verdict.transient !== undefined
+        ? { readFailed: verdict.transient }
+        : {})
+    })
+  );
+  if (verdict.kind === "failed") throw new Error(verdict.reason);
+  return { IsComplete: verdict.kind === "complete" };
+}
+
+exports.onEvent = onEvent;
+exports.isComplete = isComplete;
+
+exports._internals = {
+  propertiesOf,
+  isTransient,
+  isAccessDenied,
+  liveDeployments,
+  liveRolloutComplete,
+  atRestOnOrAfter,
+  familyRevisionOf,
+  stackRollingBack,
+  newestDeploymentOf,
+  rolloutVerdict,
+  SUCCEEDED,
+  FAILED,
+  WAITING,
+  NO_DEPLOYMENT_GRACE_MS,
+  ACCESS_PROPAGATION_GRACE_MS,
+  LISTING_WINDOW_MS,
+  INVOCATION_BUDGET_MS
+};