@go-to-k/cdkd 0.221.9 → 0.221.11

package/dist/{deploy-engine-alFrHerE.js → deploy-engine-C4sRo95X.js}

@@ -6609,6 +6609,13 @@ var IntrinsicFunctionResolver = class {
 	* SECRET_ID can be a simple name or an ARN (arn:aws:secretsmanager:REGION:ACCOUNT:secret:NAME)
 	* which contains colons, so we cannot simply split on ':'.
 	* Instead, we find ':SecretString:' or ':SecretBinary:' as the delimiter.
+	*
+	* The whole-secret form omits everything after the type segment and carries no trailing
+	* colon: "secretsmanager:SECRET_ID:SecretString" (returns the full secret string). We detect
+	* it with an end-anchored check so that, for the whole-secret form, a SECRET_ID that merely
+	* contains ":SecretString" mid-name is not split incorrectly. (The end-anchored fallback only
+	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
+	* forms are unaffected.)
 	*/
 	async resolveSecretsManagerReference(inner) {
 		const afterService = inner.substring(15);
@@ -6616,10 +6623,20 @@ var IntrinsicFunctionResolver = class {
 		let jsonKey = "";
 		let versionStage = "";
 		let versionId = "";
-		const secretStringIdx = afterService.indexOf(":SecretString:");
-		const secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let secretStringIdx = afterService.indexOf(":SecretString:");
+		let secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let delimiterLenAtBinary = 14;
+		let delimiterLenAtString = 14;
+		if (secretStringIdx < 0 && afterService.endsWith(":SecretString")) {
+			secretStringIdx = afterService.length - 13;
+			delimiterLenAtString = 13;
+		}
+		if (secretBinaryIdx < 0 && afterService.endsWith(":SecretBinary")) {
+			secretBinaryIdx = afterService.length - 13;
+			delimiterLenAtBinary = 13;
+		}
 		const delimiterIdx = secretStringIdx >= 0 && secretBinaryIdx >= 0 ? Math.min(secretStringIdx, secretBinaryIdx) : secretStringIdx >= 0 ? secretStringIdx : secretBinaryIdx;
-		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? 14 : 14;
+		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? delimiterLenAtBinary : delimiterLenAtString;
 		if (delimiterIdx >= 0) {
 			secretId = afterService.substring(0, delimiterIdx);
 			const remainingParts = afterService.substring(delimiterIdx + delimiterLen).split(":");
@@ -11607,7 +11624,8 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Could not deliver test message",
 	"wait 60 seconds",
 	"concurrent update operation",
-	"because it is in use"
+	"because it is in use",
+	"Rate exceeded"
 ];
 /**
 * HTTP status codes that always indicate a transient failure worth retrying.
@@ -11615,18 +11633,62 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 */
 const RETRYABLE_HTTP_STATUS_CODES = new Set([429, 503]);
 /**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for an AWS SDK v3
+* throttling error `name`. cdkd wraps the original AWS error in a
+* `ProvisioningError`, so the throttling signal is typically one cause-link
+* deep; the bounded walk also tolerates SDK errors that nest a `$response`/
+* cause without exploding on a cyclic chain.
+*/
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Determine whether an AWS error should be retried.
 *
 * Checks (in order):
 *   1. HTTP status code on the error itself (`$metadata.httpStatusCode`)
 *   2. HTTP status code on a wrapped cause (`cause.$metadata.httpStatusCode`)
-*   3. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*   3. Throttling error `name` on the error or any wrapped cause (most AWS
+*      throttles are HTTP 400, not 429 — see {@link THROTTLING_ERROR_NAMES})
+*   4. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
 function isRetryableTransientError(error, message) {
 	const statusCode = error.$metadata?.httpStatusCode;
 	if (statusCode !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(statusCode)) return true;
 	const causeStatus = error.cause?.$metadata?.httpStatusCode;
 	if (causeStatus !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(causeStatus)) return true;
+	if (isThrottlingError(error)) return true;
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 
@@ -13078,4 +13140,4 @@ var DeployEngine = class {
 
 //#endregion
 export { AssemblyReader as $, shouldRetainResource as A, getDefaultStateBucketName as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveStateBucketWithDefault as G, resolveApp as H, getDockerCmd as I, CFN_TEMPLATE_BODY_LIMIT as J, resolveStateBucketWithDefaultAndSource as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, uploadCfnTemplate as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, resolveCaptureObservedState as U, getLegacyStateBucketName as V, resolveSkipPrefix as W, MIGRATE_TMP_PREFIX as X, CFN_TEMPLATE_URL_LIMIT as Y, findLargeInlineResources as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, clearBucketRegionCache as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, gray as p, warnDeprecatedNoPrefixCliFlag as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveBucketRegion as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, Synthesizer as z };
-//# sourceMappingURL=deploy-engine-alFrHerE.js.map
+//# sourceMappingURL=deploy-engine-C4sRo95X.js.map