Retry GraphQL requests rejected as Throttled without a 429 code

[isaacroldan]

WHY are these changes introduced?

retryAwareRequest only retries rate-limited requests on HTTP 429 or a GraphQL error with extensions.code === '429'. But Shopify GraphQL APIs (App Management among them) throttle with a 200 response and extensions.code: "THROTTLED" — those requests fail instantly on first rejection.

The CLI already treats THROTTLED as a rate-limit signal in crash-report suppression and analytics grouping. The retry path was the only place that didn't.

This is currently the top E2E failure mode (32 of 79 failed shards last week), and real app dev / app deploy users hit the same instant failure.

WHAT is this pull request doing?

The retryability check now reuses the shared hasRateLimitCode helper, so extensions.code === 'THROTTLED' is retried exactly like '429'. The code is server-set (see complexity_throttle.rb and app_error_handling.rb in shop/world), so unlike message matching, user-controlled strings can't trigger retries. Retry mechanics are unchanged: up to 10 retries, Retry-After when present, 1s default backoff.

How to test your changes?

api.test.ts adds two cases: a 200 + THROTTLED error is retried and succeeds; an error whose message merely says "Throttled" without the code is not retried.

🤖 Generated with Claude Code

[amcaplan]

Regex tests always raise some flags... Is there nothing like a canonical error code we can use? Or at least some tighter enforcement around the message text? So someone can't name an app "throttled" and then retry on user errors...

[isaacroldan]

yeah, you are right, this was a very naive solution. I'll look more into this, apparently the AI understood that the API is returning a 200 code with a throttled message, but that's not true

[isaacroldan]

Good call — there is a canonical code: throttle errors carry a server-set extensions.code: "THROTTLED". I assumed there was none because the CLI's rendered error only prints the message.

Reworked to match the code exactly, no message matching left. Added a negative test: a message that just says "Throttled" without the code is not retried.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/private/node/analytics/graphql-error-codes.d.ts

@@ -21,8 +21,8 @@ export declare function graphQLErrorCodes(errors: unknown): string[];
 /**
  * Whether a single code is a rate-limit signal (`THROTTLED` or `429`).
  *
- * Mirrors the established shape detected by `errorsIncludeStatus429` in `private/node/api.ts`,
- * where `extensions.code === '429'` signals rate limiting even at HTTP 200.
+ * Shared with the retry path (`isThrottled` in `private/node/api.ts`), where these codes signal
+ * rate limiting even at HTTP 200.
  */
 export declare function isRateLimitCode(code: string | undefined): boolean;
 /**