@go-to-k/cdkd 0.284.8 → 0.284.9

package/dist/{deploy-engine-36yWG1OT.js → deploy-engine-CY2fx4K1.js}

@@ -296,6 +296,182 @@ function isThrottlingError(error) {
 	return false;
 }
 /**
+* HTTP status codes that indicate a TRANSIENT SERVER-side failure worth
+* retrying (issue #2026).
+*
+* Mirrors `@smithy/service-error-classification`'s own
+* `TRANSIENT_ERROR_STATUS_CODES` (`[500, 502, 503, 504]`), which is what the
+* AWS SDK's default retry strategy treats as transient. Deliberately a
+* SEPARATE set from {@link RETRYABLE_HTTP_STATUS_CODES} rather than an
+* extension of it, because that one is consumed by {@link isThrottlingError},
+* which SEVEN call sites across four files pass as a deliberately NARROW
+* `isRetryable`: `describe-type.ts:67` (which states the intent outright --
+* "retry ONLY throttle-shaped failures"), `dynamodb-globaltable-provider.ts`
+* (x4), `export.ts:1744`, and `intrinsic-function-resolver.ts:5216`. Widening
+* the shared set would have silently converted every one of them from "retry
+* throttles" into "retry throttles and server errors", which none of them
+* asked for.
+*
+* Three FURTHER sites call it as a bare classification rather than as a retry
+* filter -- `drift.ts:518`, `export.ts:1755`, `dynamodb-index-busy-delete.ts:381`
+* -- and they make the case stronger, not weaker: `drift.ts` would have started
+* returning `undefined` (reporting "cannot compare") for a resource whose read
+* merely 500'd, and the index poll would have waited a server error out as
+* though it were a throttle.
+*
+* Measured, not inferred. `tests/integration/iam-propagation-stress` against
+* real AWS (us-east-1, 2026-08-19 08:57:30Z, round 11 of 11) produced:
+*
+*   StressQueuePolicyDC3E35C3: gave up after 5 IAM-propagation retries over
+*   5.75s of propagation backoff - Failed to create SQS queue policy
+*   StressQueuePolicyDC3E35C3: UnknownError
+*   [name=InternalFailure http=500 requestId=ebf581cc-6072-5ffc-943a-e33312488615]
+*
+* SQS answered a `SetQueueAttributes` mid-propagation with HTTP 500
+* `InternalFailure` and an empty message body -- hence the `UnknownError`
+* placeholder, which matches no message pattern. With 500 absent from every
+* status set, `withRetry` classified it non-retryable and threw at 5.75s of a
+* 47.75s budget the sequence needed roughly 10s of.
+*
+* Why 502 and 504 come along rather than only the measured 500: they are the
+* same class (a gateway or timeout between AWS's edge and the service), the
+* SDK groups all four, and adding only the one status seen would leave the
+* identical defect behind for its siblings.
+*
+* Note the SDK has ALREADY retried these before cdkd sees them (default
+* `maxAttempts` is 3), so a 5xx reaching this classifier is one that persisted
+* across the SDK's own attempts. That is an argument FOR retrying it here, not
+* against: the eventual-consistency window this schedule exists to cover is
+* measured in seconds, while the SDK's three attempts span well under one.
+*
+* ACCEPTED RISK, stated rather than discovered later: this makes a
+* NON-IDEMPOTENT create retryable on a 500 that may have succeeded
+* server-side. `EC2Provider.createInstance` issues `RunInstances` with no
+* `ClientToken` (only four providers use one at all), and
+* `IAMAccessKeyProvider` mints an unnamed key, so a replay can leave a
+* resource that is absent from state and therefore from destroy. The class is
+* PRE-EXISTING -- the SDK's own three attempts already reach it, and 503 was
+* already retryable here -- but this widens the window from ~1s to the full
+* schedule. Judged worth it because the alternative is the measured failure
+* (a deploy that dies outright on a transient 500), and because the durable
+* remedy is per-provider idempotency tokens rather than a blanket refusal to
+* retry server errors. Tracked in issue #2039.
+*/
+const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
+	500,
+	502,
+	503,
+	504
+]);
+/**
+* Walk the error + its `.cause` chain (bounded, same depth 5 as
+* {@link isThrottlingError}) looking for a transient SERVER-side HTTP status
+* ({@link TRANSIENT_SERVER_ERROR_STATUS_CODES}) on `$metadata`.
+*
+* The walk is what makes it work in practice: providers wrap the AWS error in
+* a `ProvisioningError`, so the `$metadata` carrying the status sits one link
+* down, and the wrapper's interpolated message is all a message-based
+* classifier can see. In the measured failure that message was the literal
+* `UnknownError`, so the status was the ONLY usable evidence in the whole
+* error.
+*/
+function isTransientServerError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Collect {@link RetryClassificationSignals} from an error and its bounded
+* `.cause` chain — the SAME walk, to the same depth 5, that
+* {@link isThrottlingError} performs, so the line reports what the classifier
+* genuinely saw rather than a second opinion gathered differently.
+*
+* The signals are taken from the first link carrying a `$metadata` object,
+* because that link IS the AWS SDK error by construction: `$metadata` is
+* attached by the SDK's own `deserializeMetadata`, so nothing else can carry
+* it. When no link has one, the fallback is the deepest name found BELOW depth
+* 0 -- which keeps the field useful for the wrapped-network-error case, where
+* the name is all that survives.
+*
+* Excluding depth 0 from that fallback is deliberate and is what stops the
+* suffix from being noise. The error `withRetry` is handed is the provider's
+* own wrapper by construction (every provider catches the AWS error and
+* rethrows a `ProvisioningError`), so its `name` is a cdkd class name and says
+* nothing about the service. Reporting it produced the actively misleading
+* ` [name=ProvisioningError no-$metadata]` on a wrapper carrying no cause at
+* all -- a suffix asserting the SDK never parsed a response, about an error
+* that never came from the SDK.
+*
+* Nothing is lost in the case this helper exists for. A degenerate
+* `UnknownError` message can only be produced by `decorateServiceException`,
+* i.e. by a smithy `ServiceException`, and those always carry `$metadata` --
+* so that case is answered by the FIRST branch and never reaches this
+* fallback.
+*
+* Known narrowness: the first link with a NUMERIC status wins, so an outer
+* link carrying a 400 that wraps a cause carrying a 500 reports the 400 while
+* `isTransientServerError` retried on the 500. Left as-is because cdkd's own
+* wrappers carry no `$metadata` at all, so producing that shape takes two
+* stacked SDK errors -- but it is the same "must not contradict the
+* classifier" case one link further out, and is the thing to revisit if such a
+* chain is ever observed. A cdkd module deliberately importing no other module, this one
+* cannot ask `error instanceof CdkdError` directly: `error-handler.ts` imports
+* `markNonRetryable` from here, so the dependency only runs one way.
+*/
+function describeRetryClassificationSignals(error) {
+	let current = error;
+	let deepestName;
+	let sawMetadata = false;
+	let metadataName;
+	let metadataRequestId;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
+		const metadata = current.$metadata;
+		if (metadata != null && typeof metadata === "object" && !Array.isArray(metadata)) {
+			const { httpStatusCode, requestId } = metadata;
+			const linkName = typeof name === "string" && name !== "" ? name : void 0;
+			if (!sawMetadata) {
+				sawMetadata = true;
+				metadataName = linkName;
+				metadataRequestId = typeof requestId === "string" && requestId !== "" ? requestId : void 0;
+			}
+			if (typeof httpStatusCode === "number") return {
+				name: linkName ?? deepestName,
+				httpStatusCode,
+				requestId: (typeof requestId === "string" && requestId !== "" ? requestId : void 0) ?? metadataRequestId,
+				noMetadata: false
+			};
+		}
+		current = current.cause;
+	}
+	return {
+		name: metadataName ?? deepestName,
+		requestId: metadataRequestId,
+		noMetadata: !sawMetadata
+	};
+}
+/**
+* Render {@link describeRetryClassificationSignals} as a compact log suffix.
+*
+* Returns `''` when there is nothing to say (no name and no metadata), so a
+* caller can append unconditionally without emitting an empty bracket pair.
+*/
+function formatRetryClassificationSignals(error) {
+	const signals = describeRetryClassificationSignals(error);
+	if (signals.name === void 0 && signals.httpStatusCode === void 0 && signals.requestId === void 0) return "";
+	const parts = [];
+	if (signals.name !== void 0) parts.push(`name=${signals.name}`);
+	if (signals.httpStatusCode !== void 0) parts.push(`http=${signals.httpStatusCode}`);
+	if (signals.requestId !== void 0) parts.push(`requestId=${signals.requestId}`);
+	if (signals.noMetadata) parts.push("no-$metadata");
+	return ` [${parts.join(" ")}]`;
+}
+/**
 * Determine whether an AWS error should be retried.
 *
 * Checks (in order):
@@ -307,11 +483,16 @@ function isThrottlingError(error) {
 *      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
 *      429, so the name check carries most of the weight). See
 *      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*   2. Transient SERVER-side HTTP status (500 / 502 / 503 / 504) on the error
+*      or any wrapped cause — see {@link isTransientServerError}. Ahead of the
+*      message patterns because it is the only check that still works when the
+*      response carried NO message (issue #2026).
+*   3. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
 function isRetryableTransientError(error, message) {
 	if (isMarkedNonRetryable(error)) return false;
 	if (isThrottlingError(error)) return true;
+	if (isTransientServerError(error)) return true;
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
@@ -8748,6 +8929,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 	let sawPropagation = false;
 	let propagationRetries = 0;
 	let propagationSleptMs = 0;
+	let serverErrorRetries = 0;
 	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
@@ -8759,11 +8941,14 @@ async function withRetry(operation, logicalId, opts = {}) {
 		if (propagation) sawPropagation = true;
 		const attemptLimit = sawPropagation ? 26 : maxRetries;
 		if (!retryable || attempt >= attemptLimit) {
-			if (propagationRetries > 0) {
+			if (propagationRetries > 0 || serverErrorRetries > 0) {
 				const budgetExhausted = sawPropagation && attempt >= attemptLimit;
-				const summary = `${logicalId}: gave up after ${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""} - ${message}`;
+				const spent = [];
+				if (propagationRetries > 0) spent.push(`${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""}`);
+				if (serverErrorRetries > 0) spent.push(`${serverErrorRetries} transient server-error ${serverErrorRetries === 1 ? "retry" : "retries"} (HTTP 5xx)`);
+				const summary = () => `${logicalId}: gave up after ${spent.join(" and ")} - ${message}` + formatRetryClassificationSignals(error);
 				try {
-					opts.logger?.warn?.(summary);
+					opts.logger?.warn?.(summary());
 				} catch {}
 			}
 			throw error;
@@ -8778,7 +8963,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 		if (propagation) {
 			propagationRetries++;
 			propagationSleptMs = backoffThroughThisAttemptMs;
-		}
+		} else if (opts.isRetryable === void 0 && isTransientServerError(error)) serverErrorRetries++;
 	}
 	throw lastError;
 }
@@ -15860,7 +16045,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-jYyUCsx_.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B09ceB1r.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23438,7 +23623,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.8";
+	return "0.284.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25907,4 +26092,4 @@ var DeployEngine = class {
 
 //#endregion
 export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-36yWG1OT.js.map
+//# sourceMappingURL=deploy-engine-CY2fx4K1.js.map