@go-to-k/cdkd 0.284.15 → 0.284.17

package/dist/{deploy-engine-BNujuzW5.js → deploy-engine-Bnu1WuRI.js}

@@ -346,16 +346,27 @@ function isThrottlingError(error) {
 *
 * ACCEPTED RISK, stated rather than discovered later: this makes a
 * NON-IDEMPOTENT create retryable on a 500 that may have succeeded
-* server-side. `EC2Provider.createInstance` issues `RunInstances` with no
-* `ClientToken` (only four providers use one at all), and
-* `IAMAccessKeyProvider` mints an unnamed key, so a replay can leave a
-* resource that is absent from state and therefore from destroy. The class is
-* PRE-EXISTING -- the SDK's own three attempts already reach it, and 503 was
-* already retryable here -- but this widens the window from ~1s to the full
-* schedule. Judged worth it because the alternative is the measured failure
-* (a deploy that dies outright on a transient 500), and because the durable
-* remedy is per-provider idempotency tokens rather than a blanket refusal to
-* retry server errors. Tracked in issue #2039.
+* server-side, so a replay can leave a resource that is absent from state and
+* therefore from destroy. The class is PRE-EXISTING -- the SDK's own three
+* attempts already reach it, and 503 was already retryable here -- but this
+* widens the window from ~1s to the full schedule. Judged worth it because the
+* alternative is the measured failure (a deploy that dies outright on a
+* transient 500), and because the durable remedy is per-provider idempotency
+* tokens rather than a blanket refusal to retry server errors.
+*
+* STATUS (issue #2039, and read this before citing the paragraph above). The
+* two worked examples this note used to carry -- `RunInstances` sent with no
+* `ClientToken`, and `IAMAccessKeyProvider` minting an unnamed key -- are both
+* FIXED, so quoting them as live hazards would now mislead. `RunInstances`,
+* `CreateNatGateway`, `CreateRouteTable`, `CreateNetworkAcl` and
+* `CreateHostedZone` carry a retry-stable token from
+* `src/provisioning/providers/idempotency-token.ts`, and `CreateAccessKey`
+* (which has no token member) reconciles the orphan its own failed attempt
+* left. The claim that "only four providers use one at all" was also wrong when
+* written: six did, and two of those regenerated the token per attempt, which
+* is worse than none. What REMAINS accepted here is the residue -- roughly 25
+* creates across 16 providers audited in issue #2039 and enumerated in issue
+* #2080 -- so this set stays as-is and the remedy stays per-provider.
 */
 const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
 	500,
@@ -16503,7 +16514,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BZwQzb8e.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BbLu5LGL.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24023,6 +24034,91 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 	});
 }
 /**
+* Both retry loops around a reverse-replacement replay-CREATE (issue
+* [#2032](https://github.com/go-to-k/cdkd/issues/2032)) — the create-side twin
+* of {@link updateWithRollbackRetry}, and the single place the two replay arms
+* get their `disableOuterRetry` guard.
+*
+* ## The nesting, and why it is required
+*
+* A caller-supplied `isRetryable` REPLACES `isRetryableTransientError`
+* outright, and ANY explicit schedule knob sets `defaultSchedule = false` in
+* `retry.ts`, which is the gate on the dense IAM-propagation path. Both
+* replay-CREATE arms pass BOTH ({@link RECREATE_RETRY_SCHEDULE} plus
+* `isNameCooldownError` / `isRecreateRetryableError`), so a propagation error
+* raised by the re-create — the old execution role was re-created moments
+* earlier in this same rollback, so `CreateFunction` answers `The role defined
+* for the function cannot be assumed by Lambda.` — was non-retryable on
+* attempt 0 and rethrown raw, leaving the resource absent from BOTH AWS and
+* state. The INNER call passes NO knobs and NO classifier, so it gets the
+* dense 26-retry / 47.75s propagation schedule while the OUTER one keeps
+* owning the name-release cadence.
+*
+* ## What the deploy engine's precedents actually are
+*
+* They are two DIFFERENT shapes, and the two rollback arms need one each —
+* this helper is deliberately the sum of both rather than a copy of either:
+*
+*  - Arm 2 (post-delete-new-first) matches the delete-then-re-create sites,
+*    `deploy-engine.ts`'s `--replace` delete-first fallback and its named
+*    replacement, which nest `this.withRetry(...)` INSIDE an outer
+*    `isRecreateRetryableError` retry. Same two loops as here.
+*  - Arm 1 (create-first) has NO such twin. Its deploy-engine analogue is the
+*    property-driven create-first at `deploy-engine.ts:3745`, which calls
+*    `this.withRetry(...)` on its OWN — one default-schedule loop, no outer
+*    custom-classifier loop at all — and whose catch then reads
+*    `isNameCollisionError` to reach the delete-first fallback. Arm 1 is that
+*    shape PLUS the outer SQS-cooldown loop issue #1206 added, so it is the
+*    SUM of both precedents.
+*
+* ## Why the guard lives here and not in `retry.ts`
+*
+* `withRetry` never receives the provider, so it cannot honour
+* `disableOuterRetry` — re-running `CustomResourceProvider.create()` /
+* `NestedStackProvider.create()` mints a fresh pre-signed S3 URL + RequestId
+* and strands the previous attempt at a key nobody polls, and re-running
+* `NestedStackProvider.create()` re-creates child stacks and child state
+* files. That check therefore has to live next to the provider, exactly as
+* `DeployEngine.withRetry` does it.
+*
+* The guard covers BOTH loops, not just the inner one. Guarding only the inner
+* loop left the outer schedule free to re-enter, which measured at 9
+* `create()` calls for a cooldown and 10 for a collision against an opt-out
+* provider — i.e. the exact hazard the flag exists for, arriving through the
+* outer loop instead. A single-shot call still lets a name collision reach the
+* CALLER's catch on attempt 0 (that catch sits outside this helper), so the
+* delete-new-first fallback is unaffected by the opt-out.
+*
+* ## The collision arm is deliberately untouched
+*
+* `isNameCollisionError`'s signature (`already exist(s)` / `AlreadyExists`) is
+* NOT in `RETRYABLE_ERROR_MESSAGE_PATTERNS`, so the inner classifier rejects it
+* on attempt 0 and it reaches the caller's catch on the FIRST outer attempt,
+* exactly as before. The SQS cooldown IS matched by the inner classifier (the
+* generic table carries `wait 60 seconds`), which is the same division of
+* labour the deploy engine's named-replacement site documents: the inner retry
+* absorbs most of the 60s window and the outer ~64s budget covers the tail.
+*/
+async function createWithRollbackRetry(provider, create, logicalId, logger, isInterrupted, secrets, outer) {
+	if (provider.disableOuterRetry) return await create();
+	const maskedLogger = maskingRetryLogger(logger, secrets);
+	return await withRetry(() => withRetry(create, logicalId, {
+		logger: maskedLogger,
+		...isInterrupted && {
+			isInterrupted,
+			onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while retrying the replay re-create")
+		}
+	}), logicalId, {
+		...RECREATE_RETRY_SCHEDULE,
+		logger: maskedLogger,
+		...isInterrupted && {
+			isInterrupted,
+			onInterrupted: () => new Error(outer.interruptedMessage)
+		},
+		isRetryable: outer.isRetryable
+	});
+}
+/**
 * The state record to store after a rollback UPDATE arm (issue #1644).
 *
 * The bag handed to `update()` on both arms IS `restored.properties`, so a
@@ -24222,14 +24318,9 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
-						...RECREATE_RETRY_SCHEDULE,
-						logger: maskingRetryLogger(logger, secrets),
-						...isInterrupted && {
-							isInterrupted,
-							onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting out the name cooldown")
-						},
-						isRetryable: isNameCooldownError
+					createResult = await createWithRollbackRetry(createProvider, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, logger, isInterrupted, secrets, {
+						isRetryable: isNameCooldownError,
+						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
 				} catch (createError) {
 					if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
@@ -24245,14 +24336,9 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
-							...RECREATE_RETRY_SCHEDULE,
-							logger: maskingRetryLogger(logger, secrets),
-							...isInterrupted && {
-								isInterrupted,
-								onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting for the old name to release")
-							},
-							isRetryable: isRecreateRetryableError
+						createResult = await createWithRollbackRetry(createProvider, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, logger, isInterrupted, secrets, {
+							isRetryable: isRecreateRetryableError,
+							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
 					} catch (recreateError) {
 						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
@@ -24601,7 +24687,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.15";
+	return "0.284.17";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27141,4 +27227,4 @@ var DeployEngine = class {
 
 //#endregion
 export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
-//# sourceMappingURL=deploy-engine-BNujuzW5.js.map
+//# sourceMappingURL=deploy-engine-Bnu1WuRI.js.map