@go-to-k/cdkd 0.60.1 → 0.60.2

package/dist/cli.js

@@ -22162,8 +22162,9 @@ var EC2Provider = class {
   async deleteInternetGateway(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting InternetGateway ${logicalId}: ${physicalId}`);
     try {
-      await this.ec2Client.send(
-        new DeleteInternetGatewayCommand({ InternetGatewayId: physicalId })
+      await this.withDependencyViolationRetry(
+        () => this.ec2Client.send(new DeleteInternetGatewayCommand({ InternetGatewayId: physicalId })),
+        { description: `DeleteInternetGateway ${logicalId} (${physicalId})` }
       );
       this.logger.debug(`Successfully deleted InternetGateway ${logicalId}`);
     } catch (error) {
@@ -22247,11 +22248,14 @@ var EC2Provider = class {
     }
     const [internetGatewayId, vpcId] = parts;
     try {
-      await this.ec2Client.send(
-        new DetachInternetGatewayCommand({
-          InternetGatewayId: internetGatewayId,
-          VpcId: vpcId
-        })
+      await this.withDependencyViolationRetry(
+        () => this.ec2Client.send(
+          new DetachInternetGatewayCommand({
+            InternetGatewayId: internetGatewayId,
+            VpcId: vpcId
+          })
+        ),
+        { description: `DetachInternetGateway ${logicalId} (${internetGatewayId} from ${vpcId})` }
       );
       this.logger.debug(`Successfully deleted VPCGatewayAttachment ${logicalId}`);
     } catch (error) {
@@ -23653,6 +23657,99 @@ var EC2Provider = class {
       }
     }
   }
+  /**
+   * Retry an operation that AWS may reject with `DependencyViolation`
+   * for an extended window — specifically `DeleteInternetGateway` and
+   * `DetachInternetGateway` after a sibling EC2 Instance with an
+   * auto-assigned public IP was terminated. AWS releases the public-IP
+   * → IGW mapping asynchronously (5–10 min lag observed in practice);
+   * during that window AWS rejects IGW-detach / -delete with
+   * `DependencyViolation: Network has some mapped public address(es).
+   * Please unmap those public address(es) before detaching the gateway.`
+   * (or similar `has dependencies and cannot be deleted`).
+   *
+   * cdkd's deploy-engine `withRetry` wrapper caps at ~1 min total
+   * (1s/2s/4s/8s × 10 attempts capped at 8s), and the destroy-runner's
+   * inner 3-attempt loop adds ~35s on top — neither is enough for
+   * AWS's 5–10 min release window. This helper extends the budget to
+   * 10 min for the IGW-specific case so `cdkd destroy
+   * --remove-protection` is self-healing on the public-IP release lag
+   * without operator intervention.
+   *
+   * Modeled on the Lambda hyperplane ENI cleanup pattern (~30 min
+   * budget) and the EC2 Subnet/SG side-channel ENI retry — both wait
+   * on AWS-side eventual-consistency that the standard `withRetry`
+   * budget cannot cover.
+   *
+   * Only `DependencyViolation` errors are retried; other errors
+   * (NotFound, AccessDenied, throttle, etc.) propagate immediately so
+   * the caller's existing error handling is unchanged.
+   *
+   * Note on retry layering: `DependencyViolation` is also in
+   * `RETRYABLE_ERROR_MESSAGE_PATTERNS` (consumed by `withRetry`) and
+   * the destroy-runner's inner 3-attempt loop also matches it. After
+   * this helper's budget exhausts and re-throws, those outer retry
+   * loops will see the error and try a few more times — adding at
+   * most ~1 min on top of the 10 min budget, still bounded by the
+   * per-resource `--resource-timeout` deadline (default 30 min).
+   * That extra is harmless (worst case slightly later failure surface)
+   * and avoids threading a per-error-class "already exhausted" flag
+   * through every retry layer.
+   */
+  async withDependencyViolationRetry(operation, opts) {
+    const totalBudgetMs = opts.totalBudgetMs ?? 6e5;
+    const initialDelayMs = 5e3;
+    const maxDelayMs = 6e4;
+    const startedAt = Date.now();
+    let attempt = 0;
+    let delay = initialDelayMs;
+    while (true) {
+      try {
+        return await operation();
+      } catch (error) {
+        if (!this.isDependencyViolationError(error)) {
+          throw error;
+        }
+        const elapsed = Date.now() - startedAt;
+        if (elapsed >= totalBudgetMs) {
+          throw error;
+        }
+        attempt += 1;
+        const sleepMs = Math.min(delay, totalBudgetMs - elapsed);
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.debug(
+          `${opts.description}: dependency still mapped (attempt ${attempt}, retrying in ${sleepMs}ms): ${message}`
+        );
+        await this.sleep(sleepMs);
+        delay = Math.min(delay * 2, maxDelayMs);
+      }
+    }
+  }
+  /**
+   * Match an AWS `DependencyViolation` error by error code or message.
+   * AWS surfaces this as `Code: 'DependencyViolation'` in the parsed SDK
+   * error, with a human message like `The internetGateway 'igw-xxx' has
+   * dependencies and cannot be deleted.` or `Network has some mapped
+   * public address(es). Please unmap those public address(es)`.
+   */
+  isDependencyViolationError(error) {
+    if (!(error instanceof Error))
+      return false;
+    const code = error.Code ?? "";
+    const name = error.name ?? "";
+    if (code === "DependencyViolation" || name === "DependencyViolation")
+      return true;
+    const message = error.message ?? "";
+    return message.includes("DependencyViolation") || message.includes("has dependencies and cannot be deleted") || message.includes("Network has some mapped public address");
+  }
+  /**
+   * Indirect sleep so unit tests can swap in a fake-timer-aware
+   * implementation via `vi.useFakeTimers()` without monkey-patching
+   * `setTimeout` globally.
+   */
+  sleep(ms) {
+    return new Promise((resolve4) => setTimeout(resolve4, ms));
+  }
   /**
    * Check if an error indicates the resource was not found
    */
@@ -49246,7 +49343,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.60.1");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.60.2");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());