fix: narrow exception handling in child template LE expansion

The previous code caught bare Exception when expanding language extensions
on a nested-stack child template, downgrading every failure (including SAM
CLI bugs) to a single WARNING line. That masked real defects: any crash
in the new library silently fell through to the non-expanded path, leaving
the packaged child with unresolved local paths that CloudFormation could
not resolve at deploy time.

Two changes:

1. InvalidSamDocumentException (the documented failure surface of
   expand_language_extensions) keeps the warn-and-fallback behavior, but
   the message now explains the consequence: artifact URIs inside
   Fn::ForEach blocks will NOT be uploaded.

2. Any other exception is logged at ERROR with traceback (exc_info=True)
   and a pointer to file an issue. We still fall back so the rest of
   sam package keeps going, but the failure is observable to users
   running --debug and to telemetry instead of silently degrading.

Also removed the check_using_language_extension branch that was dead:
expand_language_extensions only raises InvalidSamDocumentException when
it actually tried to expand, which implies the transform was present.

Tests:
- TestCloudFormationStackResourceExpansionErrorHandling covers both
  branches (warn vs error) and confirms the non-expanded fallback is
  still taken.

Author: bnusunny

samcli/lib/package/artifact_exporter.py

@@ -122,7 +122,6 @@ def do_export(self, resource_id, resource_dict, parent_dir):
         (preserving the Fn::ForEach structure) before uploading.
         """
         from samcli.lib.cfn_language_extensions.sam_integration import (
-            check_using_language_extension,
             expand_language_extensions,
         )
         from samcli.lib.intrinsic_resolver.intrinsics_symbol_table import IntrinsicsSymbolTable
@@ -170,13 +169,34 @@ def do_export(self, resource_id, resource_dict, parent_dir):
         try:
             result = expand_language_extensions(child_template_dict, parameter_values, template_path=abs_template_path)
         except InvalidSamDocumentException as e:
-            if check_using_language_extension(child_template_dict):
-                LOG.warning("Language extensions expansion failed for %s: %s", abs_template_path, e)
-            else:
-                LOG.debug("Language extensions expansion failed for %s, using original template", abs_template_path)
+            # Expected failure path: the child template triggered the
+            # AWS::LanguageExtensions transform but SAM CLI could not expand it
+            # locally. Defer to CloudFormation's server-side transform. Note: any
+            # artifact paths inside Fn::ForEach bodies will NOT be uploaded, so
+            # child stacks with dynamic artifact properties (e.g. CodeUri using a
+            # loop variable) will fail at deploy time.
+            LOG.warning(
+                "Language extensions expansion failed for %s. "
+                "CloudFormation will process the AWS::LanguageExtensions transform "
+                "server-side; artifact URIs inside Fn::ForEach blocks will NOT be "
+                "uploaded. Error: %s",
+                abs_template_path,
+                e,
+            )
             result = None
-        except Exception as e:
-            LOG.warning("Unexpected error during language extensions expansion for %s: %s", abs_template_path, e)
+        except Exception as e:  # pylint: disable=broad-except
+            # Unexpected failure: a bug in SAM CLI rather than a malformed template.
+            # Surface at ERROR with a traceback so users running --debug (and SAM
+            # telemetry) see it, but don't abort the rest of the package run.
+            LOG.error(
+                "Internal error expanding language extensions for %s. This is a "
+                "SAM CLI bug; please report at "
+                "https://github.com/aws/aws-sam-cli/issues with the template. "
+                "Falling back to server-side transform. Error: %s",
+                abs_template_path,
+                e,
+                exc_info=True,
+            )
             result = None
 
         if result and result.had_language_extensions:

tests/unit/lib/package/test_artifact_exporter.py

@@ -2694,3 +2694,83 @@ def test_child_template_receives_parent_parameters(self):
             import shutil
 
             shutil.rmtree(tmpdir, ignore_errors=True)
+
+
+class TestCloudFormationStackResourceExpansionErrorHandling(unittest.TestCase):
+    """Error-path behavior for language-extensions expansion in do_export.
+
+    Issue #2 in the review: the broad `except Exception` was downgrading
+    SAM CLI bugs to warnings, silently masking defects. The new behavior:
+    - InvalidSamDocumentException: warn (expected user-facing failure)
+    - Other exceptions: log ERROR with traceback (bug, not user input)
+    Both still fall back to the non-expanded path so the rest of sam
+    package keeps going.
+    """
+
+    def _make_stack_resource(self):
+        uploaders_mock = Mock()
+        uploaders_mock.get.return_value = Mock()
+        uploaders_mock.get.return_value.upload.return_value = "s3://bucket/key"
+        uploaders_mock.get.return_value.to_path_style_s3_url.return_value = "http://s3.amazonaws.com/bucket/key"
+        code_signer_mock = Mock()
+        code_signer_mock.should_sign_package.return_value = False
+        return CloudFormationStackResource(uploaders_mock, code_signer_mock)
+
+    def _write_child(self, tmpdir):
+        child = {
+            "AWSTemplateFormatVersion": "2010-09-09",
+            "Transform": "AWS::LanguageExtensions",
+            "Resources": {"Dummy": {"Type": "AWS::SNS::Topic", "Properties": {}}},
+        }
+        from samcli.yamlhelper import yaml_dump
+
+        path = os.path.join(tmpdir, "child.yaml")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(yaml_dump(child))
+        return path
+
+    def test_invalid_sam_document_exception_logs_warning_and_falls_back(self):
+        stack_resource = self._make_stack_resource()
+        tmpdir = tempfile.mkdtemp()
+        try:
+            child_path = self._write_child(tmpdir)
+            with (
+                patch("samcli.lib.cfn_language_extensions.sam_integration.expand_language_extensions") as expand_mock,
+                patch("samcli.lib.package.artifact_exporter.Template") as TemplateMock,
+                self.assertLogs("samcli.lib.package.artifact_exporter", level="WARNING") as log_ctx,
+            ):
+                expand_mock.side_effect = InvalidSamDocumentException("bad template")
+                TemplateMock.return_value.export.return_value = {"Resources": {}}
+                stack_resource.do_export("ChildStack", {"TemplateURL": child_path}, tmpdir)
+
+            # Warning emitted (not error) and fallback path taken.
+            self.assertTrue(any("Language extensions expansion failed" in m for m in log_ctx.output))
+            TemplateMock.assert_called_once()  # non-extension fallback constructor
+        finally:
+            import shutil
+
+            shutil.rmtree(tmpdir, ignore_errors=True)
+
+    def test_unexpected_exception_logs_error_and_falls_back(self):
+        stack_resource = self._make_stack_resource()
+        tmpdir = tempfile.mkdtemp()
+        try:
+            child_path = self._write_child(tmpdir)
+            with (
+                patch("samcli.lib.cfn_language_extensions.sam_integration.expand_language_extensions") as expand_mock,
+                patch("samcli.lib.package.artifact_exporter.Template") as TemplateMock,
+                self.assertLogs("samcli.lib.package.artifact_exporter", level="ERROR") as log_ctx,
+            ):
+                expand_mock.side_effect = AttributeError("unexpected bug")
+                TemplateMock.return_value.export.return_value = {"Resources": {}}
+                stack_resource.do_export("ChildStack", {"TemplateURL": child_path}, tmpdir)
+
+            # ERROR-level log containing the bug-report pointer; fallback still taken.
+            joined = "\n".join(log_ctx.output)
+            self.assertIn("Internal error expanding language extensions", joined)
+            self.assertIn("github.com/aws/aws-sam-cli/issues", joined)
+            TemplateMock.assert_called_once()
+        finally:
+            import shutil
+
+            shutil.rmtree(tmpdir, ignore_errors=True)