@go-to-k/cdkd 0.268.0 → 0.268.1

package/dist/{deploy-engine-B5cRuFij.js → deploy-engine-A2CeJkZr.js}

@@ -7648,12 +7648,26 @@ var ReplacementRulesRegistry = class {
 //#endregion
 //#region src/deployment/retryable-errors.ts
 /**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* an AWS service rejecting a call because a just-created IAM entity (role,
+* trust policy, inline policy, instance profile, principal) has not propagated
+* to that service's authorization layer yet.
+*
+* Kept as its own array — and composed back into the full transient table
+* below — so there is exactly ONE list per pattern (no parallel classifier to
+* drift). It exists because this class has a materially different RECOVERY
+* SHAPE from the other transient errors: it resolves in single-digit seconds,
+* so `withRetry` polls it on a dense sub-second schedule instead of the
+* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
+* for long resource-state transitions, and wrong here — see
+* {@link file://../deployment/retry.ts}).
+*
+* When adding a new pattern: put it here if the fix is "wait a moment and ask
+* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
+* misfiled entry only changes the retry CADENCE, never whether the error is
+* retryable at all.
+*/
+const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"cannot be assumed",
 	"Firehose is unable to assume role",
 	"is unable to assume provided role",
@@ -7664,12 +7678,6 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Role validation failed",
 	"does not have required permissions",
 	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
 	"Invalid principal in policy",
 	"Policy Error: PrincipalNotFound",
 	"Invalid value for the parameter Policy",
@@ -7677,15 +7685,30 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Caught ServiceAccessDeniedException",
 	"permissions required to assume the role",
 	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
 	"Cannot access stream",
 	"Please ensure the role can perform",
 	"KMS key is invalid for CreateGrant",
 	"Policy contains a statement with one or more invalid principals",
 	"Invalid IAM Instance Profile",
 	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
+	"Failed to authorize instance profile"
+];
+/**
+* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* transient failures whose recovery window is either long (SQS's 60s same-name
+* cooldown, a resource still leaving a Pending/Creating state) or genuinely
+* load-related (throttling), where hammering AWS with dense retries is harmful
+* and exponential backoff is the correct shape.
+*/
+const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"conflicting conditional operation",
+	"scheduled for deletion",
 	"Could not deliver test message",
 	"wait 60 seconds",
 	"concurrent update operation",
@@ -7693,6 +7716,16 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Rate exceeded"
 ];
 /**
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*
+* Composed from the two halves above so retryability has ONE source of truth
+* while `withRetry` can still pick a per-class backoff cadence.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
+/**
 * HTTP status codes that always indicate a transient failure worth retrying.
 * 429 = Too Many Requests (throttle), 503 = Service Unavailable.
 */
@@ -7762,6 +7795,24 @@ function isRetryableTransientError(error, message) {
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
+* True when the message is a just-created-IAM-entity propagation rejection
+* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
+*
+* This does NOT decide retryability — every pattern it matches is already in
+* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
+* `withRetry` polls this class densely (sub-second initial delay, low cap)
+* because IAM propagation resolves in single-digit seconds, whereas the
+* generic exponential schedule is tuned for throttling and long resource-state
+* transitions.
+*
+* Deliberately message-only (no error-object inspection): the propagation
+* signal is always carried in the vendor's message text, and cdkd wraps the
+* original error in a `ProvisioningError` that preserves it.
+*/
+function isIamPropagationError(message) {
+	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
 * Match the "already exists" name-collision signature raised when a create
 * targets a physical name still held by another resource (or by the same
 * name's not-yet-released tombstone after an async delete).
@@ -7820,6 +7871,48 @@ function isRecreateRetryableError(message) {
 * in isolation. The retryable-error classifier itself lives in
 * `./retryable-errors.ts`.
 */
+/**
+* Initial backoff for the IAM-propagation error class (issue: EC2 instance
+* launches burning ~10s of backoff waiting on a fresh instance profile).
+*
+* cdkd creates an `AWS::IAM::InstanceProfile` and issues `RunInstances` ~2.8s
+* later; CloudFormation and Terraform are slow enough between resources that
+* IAM has propagated by the time they call, cdkd outruns it. The measured
+* failure recovers in single-digit seconds, so the first re-probe should be
+* sub-second rather than the generic 1s.
+*/
+const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
+/**
+* Cap for the IAM-propagation backoff. Once the ramp reaches this value the
+* schedule stays FLAT — the whole point is a tight, predictable probe grid
+* across the window in which propagation completes, so the worst-case
+* overshoot is ~2s instead of the generic schedule's up-to-8s.
+*
+* Not lower than 2s on purpose: the retried call is usually a mutating,
+* tightly-rate-limited API (`RunInstances` refills ~2 req/s per account), and
+* the retry runs per-resource in parallel — three instances polling at 1s
+* would sit at 3 req/s and trade an IAM stall for a throttle stall. (If a
+* throttle DOES happen, its error classifies as non-propagation and the
+* generic exponential schedule takes over for that attempt, which is exactly
+* the desired self-correction.)
+*/
+const IAM_PROPAGATION_MAX_DELAY_MS = 2e3;
+/**
+* Retry budget for the IAM-propagation class.
+*
+* A denser schedule must NOT shrink the window in which propagation can still
+* be caught — that would trade latency for flakiness. The generic default
+* (1s/2s/4s/8s then capped, 8 retries) sleeps 47s in total, so the dense
+* schedule is given enough retries to cover at least as long:
+*
+*   0.25 + 0.5 + 1 + 2 x 23 = 47.75s over 26 retries
+*
+* Probe grid (seconds after the first failure): 0.25, 0.75, 1.75, 3.75, then
+* every 2s out to 47.75 — versus the generic 1, 3, 7, 15, 23, 31, 39, 47.
+* From 3.75s onwards the dense grid is strictly ahead, and it never lags the
+* generic one by more than 0.75s in the early band.
+*/
+const IAM_PROPAGATION_MAX_RETRIES = 26;
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
 * Run `operation`, retrying transient failures with exponential backoff
@@ -7828,6 +7921,20 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
 *   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
 *
+* IAM-propagation failures (see `isIamPropagationError`) instead use the dense
+* schedule 0.25s -> 0.5s -> 1s -> 2s -> 2s ... over
+* {@link IAM_PROPAGATION_MAX_RETRIES} retries (cumulative 47.75s), because that
+* class resolves in single-digit seconds and the generic schedule's coarse
+* 4s/8s steps overshoot it. The dense schedule applies ONLY when the caller
+* left the schedule at its defaults — a caller that passed its own
+* `maxRetries` / `initialDelayMs` / `maxDelayMs` / `isRetryable` picked that
+* schedule deliberately (e.g. the DELETE path's 3 x 5s, or the delete-then-
+* re-create sites' ~64s budget covering SQS's 60s name cooldown) and gets it
+* verbatim.
+*
+* The class is re-evaluated per attempt, so a propagation retry that runs into
+* a throttle backs OFF exponentially for that attempt instead of hammering.
+*
 * Non-retryable errors are rethrown immediately. The transient-error
 * classifier is `isRetryableTransientError` from ./retryable-errors.ts.
 */
@@ -7836,15 +7943,20 @@ async function withRetry(operation, logicalId, opts = {}) {
 	const initialDelayMs = opts.initialDelayMs ?? 1e3;
 	const maxDelayMs = opts.maxDelayMs ?? 8e3;
 	const sleep = opts.sleep ?? defaultSleep;
+	const defaultSchedule = opts.maxRetries === void 0 && opts.initialDelayMs === void 0 && opts.maxDelayMs === void 0 && opts.isRetryable === void 0;
+	const attemptCeiling = defaultSchedule ? Math.max(maxRetries, 26) : maxRetries;
 	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		const retryable = opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message);
+		const propagation = defaultSchedule && isIamPropagationError(message);
+		const attemptLimit = propagation ? 26 : maxRetries;
+		if (!retryable || attempt >= attemptLimit) throw error;
+		const delay = propagation ? Math.min(250 * Math.pow(2, attempt), IAM_PROPAGATION_MAX_DELAY_MS) : Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
 			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
 			await sleep(Math.min(1e3, delay - waited));
@@ -11793,7 +11905,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ZylgRJOY.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-_vnp1pfL.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17505,7 +17617,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.268.0";
+	return "0.268.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19511,4 +19623,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as $, MissingCdkCliError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LockError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalMigrateError as Xt, rebuildClientForBucketRegion as Y, LocalInvokeBuildError as Yt, AssetPublisher as Z, LocalStartServiceError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, StackHasActiveImportsError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, SynthesisError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, normalizeAwsError as dn, buildDockerImage as dt, NestedStackChildDirectDestroyError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, withErrorHandling as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceUpdateNotSupportedError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, formatError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ProvisioningError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackTerminationProtectionError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, __exportAll as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ResourceTimeoutError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StateError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, PartialFailureError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, isCdkdError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-B5cRuFij.js.map
+//# sourceMappingURL=deploy-engine-A2CeJkZr.js.map