@go-to-k/cdkd 0.284.75 → 0.284.77

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Fr as formatError, G as IAMRoleProvider, Ht as DagBuilder, Ir as isCdkdError, J as ProviderRegistry, Lr as normalizeAwsError, Nr as StateError, Or as ProvisioningError, Pr as SynthesisError, Rn as Synthesizer, Rt as DiffCalculator, Ut as TemplateParser, cr as clearBucketRegionCache, dr as getAwsClients, fr as resetAwsClients, gr as ConfigError, hr as CdkdError, ln as AssetPublisher, lr as resolveBucketRegion, mr as AssetError, or as AssemblyReader, pr as setAwsClients, r as DeployEngine, rn as S3StateBackend, st as CloudControlProvider, tn as LockManager, ur as AwsClients, vr as DependencyError, wr as LockError } from "./deploy-engine-B6xURS3W.js";
+import { Fr as SynthesisError, G as IAMRoleProvider, Ht as DagBuilder, Ir as formatError, J as ProviderRegistry, Lr as isCdkdError, Pr as StateError, Rr as normalizeAwsError, Rt as DiffCalculator, Tr as LockError, Ut as TemplateParser, _r as ConfigError, dr as AwsClients, fr as getAwsClients, gr as CdkdError, hr as AssetError, kr as ProvisioningError, ln as AssetPublisher, lr as clearBucketRegionCache, mr as setAwsClients, pr as resetAwsClients, r as DeployEngine, rn as S3StateBackend, sr as AssemblyReader, st as CloudControlProvider, tn as LockManager, ur as resolveBucketRegion, yr as DependencyError, zn as Synthesizer } from "./deploy-engine-Ce3payPI.js";
 import { i as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-C9-E73FI.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-DQwxvn6O.js → program-SpnBYAoA.js}

@@ -1,7 +1,7 @@
-import { $ as maskerOrIdentity, $n as MIGRATE_TMP_PREFIX, $t as redactSecretsForState, A as renderStatefulReason, An as dockerSpawnEnvWithSensitive, Ar as ResourceUpdateNotSupportedError, At as classifyReplaySecretRegion, B as exportAliasCollisionScrubWarning, Bn as getDefaultStateBucketName, Br as isRetryableTransientError, Bt as describeTypeWithThrottleRetry, C as isFinalSnapshotError, Cn as isCrossRegionRedirect, Cr as LocalStartServiceError, Ct as configBooleanRefusal, D as extractDeploymentEventError, Dn as validateContainerRepoName, Dr as PartialFailureError, Dt as requireConfigArray, E as makeCanonicalizePropertiesFn, En as validateAssetBucketName, Er as NestedStackChildDirectDestroyError, Et as replayWarn, F as green, Fn as runDockerStreaming, Ft as s3BucketRegionalDomainName, G as IAMRoleProvider, Gn as resolveSkipPrefix, Gt as STATE_SOURCED_READBACK_RULES, H as secretBearingStateKeyWarning, Hn as resolveApp, Hr as markNonRetryable, Ht as DagBuilder, I as red, In as AssetManifestLoader, It as s3BucketWebsiteUrl, J as ProviderRegistry, Jn as resolveUseCdkBootstrapAssets, Jt as dynamicReferenceTokens, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefault, Kt as TEMPLATE_SOURCED_RULES, L as yellow, Ln as getDockerImageBySourceHash, Lr as normalizeAwsError, Lt as applyRoleArnIfSet, M as bold, Mn as getDockerCmd, Mr as StackTerminationProtectionError, Mt as s3BucketArn, N as cyan, Nn as partitionSensitiveEnv, Nt as s3BucketDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDenyExternalAccessPolicy, Or as ProvisioningError, Ot as requireConfigObject, P as gray, Pn as runDockerForeground, Pt as s3BucketDualStackDomainName, Q as maskDeep, Qn as CFN_TEMPLATE_URL_LIMIT, Qt as maskSecretsInText, R as collectDeclaredOutputNames, Rn as Synthesizer, Rr as withErrorHandling, Rt as DiffCalculator, S as createPreDeleteFinalSnapshot, Sn as getBootstrapMarkerKey, Sr as LocalMigrateError, St as coerceCfnBoolean, T as unsupportedFinalSnapshotError, Tn as readBootstrapMarkerBody, Tr as MissingCdkCliError, Tt as readConfigString, U as stateKeySecretExposure, Un as resolveAutoAssetStorage, Ut as TemplateParser, V as isExportAliasCollision, Vn as getLegacyStateBucketName, Vr as isThrottlingError, Vt as withRetry, W as getCurrentResourceSecrets, Wn as resolveCaptureObservedState, Wt as STATE_SOURCED_CROSS_GENERATION_RULES, X as findSilentDropProperties, Xn as warnDeprecatedNoPrefixCliFlag, Xt as isSingleDynamicReferenceToken, Y as findActionableSilentDrops, Yn as stateBucketExistenceConfirmed, Yt as errorCauseChain, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_BODY_LIMIT, Zt as maskSecretsInError, _ as computeImplicitDeleteEdges, _n as stripControlChars, _r as CrossAccountSecretRefusalError, _t as refStateLookupFromResource, a as DeploymentEventsStore, an as exportNamesCarriedFrom, ar as derivePartitionAndUrlSuffix, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as assertAssetBucketRegion, br as DynamicReferenceRegionAmbiguousError, bt as resolveExplicitPhysicalId, c as replayFailedOperations, cn as shouldRetainResource, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as WorkGraph, dr as getAwsClients, dt as IntrinsicFunctionResolver, en as scrubResourceRecord, er as findLargeInlineResources, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as buildAssetRedirectMap, fr as resetAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as escapeRegExp, gt as parameterTypeMayLoseSecretIdentity, h as maskingRetryLogger, hn as rewriteTemplateAssetReferences, hr as CdkdError, ht as isUnboundTemplateParameter, i as DeploymentEventsReader, in as rebuildClientForBucketRegion, ir as canonicalizeRegion, it as interruptWatchListenerCount, j as formatResourceLine, jn as formatDockerLoginError, jr as StackHasActiveImportsError, jt as producerRegionsFromState, k as isStatefulRecreateTargetSync, kn as buildDockerImage, kr as ResourceTimeoutError, kt as requireConfigString, l as replayRollback, ln as AssetPublisher, lr as resolveBucketRegion, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as loadPublishableAssetManifest, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as displaySafe, nr as expectedOwnerParam, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputKeys, or as AssemblyReader, ot as startInterruptWatch, p as deleteSkipReason, pn as createAssetRedirectResolver, pr as setAwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveStateBucketWithDefaultAndSource, qt as createSecretMasker, r as DeployEngine, rn as S3StateBackend, rr as PARTITION_TABLE, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputs, sr as processStackMessages, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as LockManager, tr as uploadCfnTemplate, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as stringifyValue, ur as AwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as AssetModeResolver, vt as WAFv2WebACLProvider, w as refusesFinalSnapshot, wn as parseBootstrapMarker, wt as configStringRefusal, x as ccRoutedFinalSnapshotError, xn as ensureAssetStorage, xr as LocalInvokeBuildError$1, xt as assertRegionMatch, y as PRE_DELETE_SNAPSHOT_TYPES, yn as BOOTSTRAP_MARKER_PREFIX, yr as DeployCancelledError, yt as normalizeAwsTagsToCfn, z as collectPublishedOutputNames, zn as synthesisStatusMessage, zr as isMarkedNonRetryable, zt as INTRINSIC_KEYS } from "./deploy-engine-B6xURS3W.js";
+import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_URL_LIMIT, $t as redactSecretsForState, A as renderStatefulReason, An as buildDockerImage, Ar as ResourceTimeoutError, At as classifyReplaySecretRegion, B as exportAliasCollisionScrubWarning, Bn as synthesisStatusMessage, Br as isMarkedNonRetryable, Bt as describeTypeWithThrottleRetry, C as isFinalSnapshotError, Cn as isCrossRegionRedirect, Cr as LocalMigrateError, Ct as configBooleanRefusal, D as extractDeploymentEventError, Dn as validateContainerRepoName, Dr as NestedStackChildDirectDestroyError, Dt as requireConfigArray, E as makeCanonicalizePropertiesFn, En as validateAssetBucketName, Er as MissingCdkCliError, Et as replayWarn, F as green, Fn as runDockerForeground, Ft as s3BucketRegionalDomainName, G as IAMRoleProvider, Gn as resolveCaptureObservedState, Gr as retryClassificationText, Gt as STATE_SOURCED_READBACK_RULES, H as secretBearingStateKeyWarning, Hn as getLegacyStateBucketName, Hr as isThrottlingError, Ht as DagBuilder, I as red, In as runDockerStreaming, It as s3BucketWebsiteUrl, J as ProviderRegistry, Jn as resolveStateBucketWithDefaultAndSource, Jt as dynamicReferenceTokens, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveSkipPrefix, Kt as TEMPLATE_SOURCED_RULES, L as yellow, Ln as AssetManifestLoader, Lt as applyRoleArnIfSet, M as bold, Mn as formatDockerLoginError, Mr as StackHasActiveImportsError, Mt as s3BucketArn, N as cyan, Nn as getDockerCmd, Nr as StackTerminationProtectionError, Nt as s3BucketDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDenyExternalAccessPolicy, Or as PartialFailureError, Ot as requireConfigObject, P as gray, Pn as partitionSensitiveEnv, Pt as s3BucketDualStackDomainName, Q as maskDeep, Qn as CFN_TEMPLATE_BODY_LIMIT, Qt as maskSecretsInText, R as collectDeclaredOutputNames, Rn as getDockerImageBySourceHash, Rr as normalizeAwsError, Rt as DiffCalculator, S as createPreDeleteFinalSnapshot, Sn as getBootstrapMarkerKey, Sr as LocalInvokeBuildError$1, St as coerceCfnBoolean, T as unsupportedFinalSnapshotError, Tn as readBootstrapMarkerBody, Tt as readConfigString, U as stateKeySecretExposure, Un as resolveApp, Ur as markNonRetryable, Ut as TemplateParser, V as isExportAliasCollision, Vn as getDefaultStateBucketName, Vr as isRetryableTransientError, Vt as withRetry, W as getCurrentResourceSecrets, Wn as resolveAutoAssetStorage, Wr as markRedactedCause, Wt as STATE_SOURCED_CROSS_GENERATION_RULES, X as findSilentDropProperties, Xn as stateBucketExistenceConfirmed, Xt as isSingleDynamicReferenceToken, Y as findActionableSilentDrops, Yn as resolveUseCdkBootstrapAssets, Yt as errorCauseChain, Z as createMaskedRetryLogger, Zn as warnDeprecatedNoPrefixCliFlag, Zt as maskSecretsInError, _ as computeImplicitDeleteEdges, _n as stripControlChars, _t as refStateLookupFromResource, a as DeploymentEventsStore, an as exportNamesCarriedFrom, ar as canonicalizeRegion, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as assertAssetBucketRegion, br as DeployCancelledError, bt as resolveExplicitPhysicalId, c as replayFailedOperations, cn as shouldRetainResource, cr as processStackMessages, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as WorkGraph, dr as AwsClients, dt as IntrinsicFunctionResolver, en as scrubResourceRecord, er as MIGRATE_TMP_PREFIX, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as buildAssetRedirectMap, fr as getAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as escapeRegExp, gr as CdkdError, gt as parameterTypeMayLoseSecretIdentity, h as maskingRetryLogger, hn as rewriteTemplateAssetReferences, ht as isUnboundTemplateParameter, i as DeploymentEventsReader, in as rebuildClientForBucketRegion, ir as PARTITION_TABLE, it as interruptWatchListenerCount, j as formatResourceLine, jn as dockerSpawnEnvWithSensitive, jr as ResourceUpdateNotSupportedError, jt as producerRegionsFromState, k as isStatefulRecreateTargetSync, kn as describeAwsFailure, kr as ProvisioningError, kt as requireConfigString, l as replayRollback, ln as AssetPublisher, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as loadPublishableAssetManifest, mr as setAwsClients, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as displaySafe, nr as uploadCfnTemplate, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputKeys, or as derivePartitionAndUrlSuffix, ot as startInterruptWatch, p as deleteSkipReason, pn as createAssetRedirectResolver, pr as resetAwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveStateBucketWithDefault, qt as createSecretMasker, r as DeployEngine, rn as S3StateBackend, rr as expectedOwnerParam, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputs, sr as AssemblyReader, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as LockManager, tr as findLargeInlineResources, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as stringifyValue, ur as resolveBucketRegion, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as AssetModeResolver, vr as CrossAccountSecretRefusalError, vt as WAFv2WebACLProvider, w as refusesFinalSnapshot, wn as parseBootstrapMarker, wr as LocalStartServiceError, wt as configStringRefusal, x as ccRoutedFinalSnapshotError, xn as ensureAssetStorage, xr as DynamicReferenceRegionAmbiguousError, xt as assertRegionMatch, y as PRE_DELETE_SNAPSHOT_TYPES, yn as BOOTSTRAP_MARKER_PREFIX, yt as normalizeAwsTagsToCfn, z as collectPublishedOutputNames, zn as Synthesizer, zr as withErrorHandling, zt as INTRINSIC_KEYS } from "./deploy-engine-Ce3payPI.js";
 import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-B8O0NnWg.js";
-import { t as ASGProvider } from "./asg-provider-DdsyGm69.js";
+import { t as getCdkdVersion } from "./version-rsHq2qI3.js";
+import { t as ASGProvider } from "./asg-provider-CDfupCgW.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9094,7 +9094,8 @@ var S3BucketProvider = class S3BucketProvider {
 		try {
 			const createParams = { Bucket: bucketName };
 			const region = await this.getRegion();
-			if (region !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: region };
+			const canonicalRegion = canonicalizeRegion(region);
+			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
 			if (properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true") createParams.ObjectLockEnabledForBucket = true;
 			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
@@ -9138,8 +9139,7 @@ var S3BucketProvider = class S3BucketProvider {
 				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
+			throw this.wrapOperationError("create", logicalId, resourceType, bucketName, error);
 		}
 	}
 	/**
@@ -9173,8 +9173,7 @@ var S3BucketProvider = class S3BucketProvider {
 				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update S3 bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error);
 		}
 	}
 	/**
@@ -9195,9 +9194,52 @@ var S3BucketProvider = class S3BucketProvider {
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
+			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	/**
+	* Wrap whatever `create` / `update` / `delete` caught into the
+	* `ProvisioningError` they throw, with the identity split done BEFORE the
+	* throw (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
+	*
+	* All three sites used to interpolate `error.message` straight into the
+	* thrown text. A thrown message is NOT the terminal-only surface the
+	* identity warnings elsewhere in this file are: `extractDeploymentEventError`
+	* captures it into `deployments/{runId}.jsonl`, which outlives the run and is
+	* explicitly restricted to error plus metadata. So an `AccessDenied` on
+	* `CreateBucket` / `PutBucket*` / `DeleteBucket` -- S3 words it `User:
+	* arn:aws:sts::<account>:assumed-role/<role>/<session> is not authorized to
+	* perform: ...` -- wrote the caller's account id, role name and session name
+	* into that durable store. Splitting at a log call cannot help here; the
+	* split has to happen before the `throw`.
+	*
+	* Both halves are emitted, for the reason PR
+	* [#2290](https://github.com/go-to-k/cdkd/pull/2290) learned the expensive
+	* way: AWS's text is what separates a missing IAM grant from a bucket-policy
+	* `Deny`, and that distinction is the operator's next action. The class goes
+	* in the thrown message and AWS's own wording goes to `logger.debug`.
+	*
+	* The redaction is NARROW on purpose, and these three sites are why. They are
+	* BROAD catch blocks that capture cdkd's OWN refusals as readily as an SDK
+	* failure: this file raises six cdkd-authored plain `Error`s inside them --
+	* the `BucketEncryption` / `OwnershipControls` array refusals, the
+	* EventBridge and inventory `Enabled` refusals, the destination-shape
+	* refusal, and `deleteBucketWithEmptyRetry`'s non-empty-bucket refusal, whose
+	* message IS the CloudFormation-parity remediation. `describeAwsFailure`
+	* keys on the smithy marker fields rather than on "cdkd did not author it",
+	* so every one of those passes through verbatim; the `redacted` gate then
+	* suppresses a debug line that would only repeat the throw.
+	*
+	* `cause` still carries the raw error, deliberately: the persisted event
+	* reads only the TOP-level `message` off it (plus `awsErrorCode` /
+	* `requestId` from the chain), so keeping it costs nothing in that store
+	* while retaining the retry classifiers' and `formatError`'s access to it.
+	*/
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${logicalId} (${physicalId}): ${failure.detail}`);
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	/**
 	* The `effectiveProperties` TWIN required by `.claude/rules/providers.md`
@@ -59848,8 +59890,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 							break;
 						} catch (retryError) {
 							lastDeleteError = retryError;
-							const msg = retryError instanceof Error ? retryError.message : String(retryError);
-							if (!(!isMarkedNonRetryable(retryError) && (isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests"))) || attempt >= maxAttempts) break;
+							const classify = retryClassificationText(retryError);
+							if (!(!isMarkedNonRetryable(retryError) && (isRetryableTransientError(retryError, classify) || classify.includes("Too Many Requests"))) || attempt >= maxAttempts) break;
 							const delay = 5e3 * Math.pow(2, attempt);
 							logger.debug(`  ⏳ Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`);
 							await new Promise((resolve) => setTimeout(resolve, delay));
@@ -88546,4 +88588,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DQwxvn6O.js.map
+//# sourceMappingURL=program-SpnBYAoA.js.map