@go-to-k/cdkd 0.102.2 → 0.102.4

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-CuHRHcyW.js";
-import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-D4t--jpp.js";
+import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-DGKtcKF6.js";
 import { createHash, createPublicKey, createVerify, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagUserCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -1592,12 +1592,32 @@ var IAMInstanceProfileProvider = class {
 				Path: path
 			}));
 			this.logger.debug(`Created IAM instance profile: ${instanceProfileName}`);
-			if (roles && Array.isArray(roles)) for (const roleName of roles) {
-				await this.iamClient.send(new AddRoleToInstanceProfileCommand({
-					InstanceProfileName: instanceProfileName,
-					RoleName: roleName
-				}));
-				this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+			const attachedRoles = [];
+			try {
+				if (roles && Array.isArray(roles)) for (const roleName of roles) {
+					await this.iamClient.send(new AddRoleToInstanceProfileCommand({
+						InstanceProfileName: instanceProfileName,
+						RoleName: roleName
+					}));
+					attachedRoles.push(roleName);
+					this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+				}
+			} catch (innerError) {
+				try {
+					for (const roleName of attachedRoles) try {
+						await this.iamClient.send(new RemoveRoleFromInstanceProfileCommand({
+							InstanceProfileName: instanceProfileName,
+							RoleName: roleName
+						}));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					this.logger.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${instanceProfileName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM instance profile ${logicalId} (${instanceProfileName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove every role (aws iam remove-role-from-instance-profile --instance-profile-name ${instanceProfileName} --role-name <name>) then aws iam delete-instance-profile --instance-profile-name ${instanceProfileName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM instance profile ${logicalId}: ${instanceProfileName}`);
 			return {
@@ -1825,48 +1845,71 @@ var IAMUserGroupProvider = class {
 			const tags = properties["Tags"];
 			if (tags && Array.isArray(tags)) createParams.Tags = tags;
 			const response = await this.iamClient.send(new CreateUserCommand(createParams));
-			const permissionsBoundary = properties["PermissionsBoundary"];
-			if (permissionsBoundary) {
-				await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
-					UserName: userName,
-					PermissionsBoundary: permissionsBoundary
-				}));
-				this.logger.debug(`Set permissions boundary on user ${userName}`);
-			}
-			const loginProfile = properties["LoginProfile"];
-			if (loginProfile) {
-				await this.iamClient.send(new CreateLoginProfileCommand({
-					UserName: userName,
-					Password: loginProfile.Password,
-					PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
-				}));
-				this.logger.debug(`Created login profile for user ${userName}`);
-			}
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachUserPolicyCommand({
-					UserName: userName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
-			}
-			const userGroups = properties["Groups"];
-			if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
-				await this.iamClient.send(new AddUserToGroupCommand({
-					UserName: userName,
-					GroupName: groupName
-				}));
-				this.logger.debug(`Added user ${userName} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutUserPolicyCommand({
-					UserName: userName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+			try {
+				const permissionsBoundary = properties["PermissionsBoundary"];
+				if (permissionsBoundary) {
+					await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
+						UserName: userName,
+						PermissionsBoundary: permissionsBoundary
+					}));
+					this.logger.debug(`Set permissions boundary on user ${userName}`);
+				}
+				const loginProfile = properties["LoginProfile"];
+				if (loginProfile) {
+					await this.iamClient.send(new CreateLoginProfileCommand({
+						UserName: userName,
+						Password: loginProfile.Password,
+						PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
+					}));
+					this.logger.debug(`Created login profile for user ${userName}`);
+				}
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachUserPolicyCommand({
+						UserName: userName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
+				}
+				const userGroups = properties["Groups"];
+				if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
+					await this.iamClient.send(new AddUserToGroupCommand({
+						UserName: userName,
+						GroupName: groupName
+					}));
+					this.logger.debug(`Added user ${userName} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutUserPolicyCommand({
+						UserName: userName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.removeUserFromAllGroups(userName);
+					await this.detachAllUserPolicies(userName);
+					await this.deleteAllUserInlinePolicies(userName);
+					try {
+						await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					try {
+						await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					this.logger.debug(`Cleaned up partially-created IAM user ${logicalId} (${userName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM user ${logicalId} (${userName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove from groups, detach managed policies, delete inline policies, delete login profile (aws iam delete-login-profile --user-name ${userName}), remove permissions boundary (aws iam delete-user-permissions-boundary --user-name ${userName}), then aws iam delete-user --user-name ${userName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM user ${logicalId}: ${userName}`);
 			return {
@@ -2135,23 +2178,35 @@ var IAMUserGroupProvider = class {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+			try {
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.detachAllGroupPolicies(groupName);
+					await this.deleteAllGroupInlinePolicies(groupName);
+					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					this.logger.debug(`Cleaned up partially-created IAM group ${logicalId} (${groupName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM group ${logicalId} (${groupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies + delete inline policies, then aws iam delete-group --group-name ${groupName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM group ${logicalId}: ${groupName}`);
 			return {
@@ -3435,15 +3490,27 @@ var S3BucketProvider = class {
 			const region = await this.getRegion();
 			if (region !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: region };
 			if (properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true") createParams.ObjectLockEnabledForBucket = true;
+			let createdNewBucket = false;
 			try {
 				await this.s3Client.send(new CreateBucketCommand(createParams));
+				createdNewBucket = true;
 				this.logger.debug(`Created S3 bucket: ${bucketName}`);
 			} catch (createError) {
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
 				else throw createError;
 			}
-			await this.applyConfiguration(bucketName, properties);
-			await this.applyAllSubConfigsForCreate(bucketName, properties);
+			try {
+				await this.applyConfiguration(bucketName, properties);
+				await this.applyAllSubConfigsForCreate(bucketName, properties);
+			} catch (innerError) {
+				if (createdNewBucket) try {
+					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
+					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+				}
+				throw innerError;
+			}
 			const attributes = await this.buildAttributes(bucketName);
 			this.logger.debug(`Successfully created S3 bucket ${logicalId}: ${bucketName}`);
 			return {
@@ -7810,46 +7877,56 @@ var LogsLogGroupProvider = class {
 				const cfnTags = properties["Tags"];
 				createParams.tags = Object.fromEntries(cfnTags.map((t) => [t.Key, t.Value]));
 			}
-			await this.logsClient.send(new CreateLogGroupCommand(createParams));
-			const retentionInDays = properties["RetentionInDays"];
-			if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
-				logGroupName,
-				retentionInDays
-			}));
-			if (properties["DataProtectionPolicy"]) {
-				const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
-				await this.logsClient.send(new PutDataProtectionPolicyCommand({
-					logGroupIdentifier: logGroupName,
-					policyDocument
-				}));
+			let createdNewLogGroup = false;
+			try {
+				await this.logsClient.send(new CreateLogGroupCommand(createParams));
+				createdNewLogGroup = true;
+			} catch (createError) {
+				if (createError instanceof ResourceAlreadyExistsException) this.logger.debug(`Log group ${logGroupName} already exists, using existing`);
+				else throw createError;
 			}
-			const fieldIndexPolicies = properties["FieldIndexPolicies"];
-			if (fieldIndexPolicies && fieldIndexPolicies.length > 0) {
-				if (fieldIndexPolicies.length > 1) this.logger.debug(`Log group ${logicalId} declares ${fieldIndexPolicies.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
-				const first = fieldIndexPolicies[0];
-				const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
-				await this.logsClient.send(new PutIndexPolicyCommand({
+			try {
+				const retentionInDays = properties["RetentionInDays"];
+				if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
+					logGroupName,
+					retentionInDays
+				}));
+				if (properties["DataProtectionPolicy"]) {
+					const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
+					await this.logsClient.send(new PutDataProtectionPolicyCommand({
+						logGroupIdentifier: logGroupName,
+						policyDocument
+					}));
+				}
+				const fieldIndexPolicies = properties["FieldIndexPolicies"];
+				if (fieldIndexPolicies && fieldIndexPolicies.length > 0) {
+					if (fieldIndexPolicies.length > 1) this.logger.debug(`Log group ${logicalId} declares ${fieldIndexPolicies.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
+					const first = fieldIndexPolicies[0];
+					const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
+					await this.logsClient.send(new PutIndexPolicyCommand({
+						logGroupIdentifier: logGroupName,
+						policyDocument
+					}));
+				}
+				if (properties["BearerTokenAuthenticationEnabled"] !== void 0) await this.logsClient.send(new PutBearerTokenAuthenticationCommand({
 					logGroupIdentifier: logGroupName,
-					policyDocument
+					bearerTokenAuthenticationEnabled: properties["BearerTokenAuthenticationEnabled"]
 				}));
+			} catch (innerError) {
+				if (createdNewLogGroup) try {
+					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
+					this.logger.debug(`Cleaned up partially-created log group ${logicalId} (${logGroupName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws logs delete-log-group --log-group-name '${logGroupName}'`);
+				}
+				throw innerError;
 			}
-			if (properties["BearerTokenAuthenticationEnabled"] !== void 0) await this.logsClient.send(new PutBearerTokenAuthenticationCommand({
-				logGroupIdentifier: logGroupName,
-				bearerTokenAuthenticationEnabled: properties["BearerTokenAuthenticationEnabled"]
-			}));
 			this.logger.debug(`Successfully created log group ${logicalId}: ${logGroupName}`);
 			return {
 				physicalId: logGroupName,
 				attributes: { Arn: await this.buildArn(logGroupName) }
 			};
 		} catch (error) {
-			if (error instanceof ResourceAlreadyExistsException) {
-				this.logger.debug(`Log group ${logGroupName} already exists, using existing`);
-				return {
-					physicalId: logGroupName,
-					attributes: { Arn: await this.buildArn(logGroupName) }
-				};
-			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, logGroupName, cause);
 		}
@@ -8756,16 +8833,26 @@ var SSMParameterProvider = class {
 			if (properties["Policies"]) putParams.Policies = properties["Policies"];
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
-			if (properties["Tags"]) {
-				const ssmTags = properties["Tags"].map((t) => ({
-					Key: t.Key,
-					Value: t.Value
-				}));
-				await this.ssmClient.send(new AddTagsToResourceCommand({
-					ResourceType: "Parameter",
-					ResourceId: name,
-					Tags: ssmTags
-				}));
+			try {
+				if (properties["Tags"]) {
+					const ssmTags = properties["Tags"].map((t) => ({
+						Key: t.Key,
+						Value: t.Value
+					}));
+					await this.ssmClient.send(new AddTagsToResourceCommand({
+						ResourceType: "Parameter",
+						ResourceId: name,
+						Tags: ssmTags
+					}));
+				}
+			} catch (innerError) {
+				try {
+					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
+					this.logger.debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
 			return {
@@ -42738,7 +42825,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());