@go-to-k/cdkd 0.230.26 → 0.230.28

package/dist/{deploy-engine-BERaDgMo.js → deploy-engine-DhL8rX8u.js}

@@ -7956,6 +7956,28 @@ function stripNullValues(obj) {
 	}
 	return obj;
 }
+/**
+* Thrown when a Cloud Control operation's async progress event reports
+* FAILED. Carries the handler-reported `ErrorCode` and the operation kind so
+* the CREATE path can distinguish "our CreateResource materialized a resource
+* and then failed stabilization" (the remnant must be deleted or every outer
+* retry collides with AlreadyExists — surfaced by AWS::Synthetics::Canary,
+* whose create materializes the canary before the IAM-propagation race lands
+* it in ERROR state) from "the resource already existed before this create"
+* (`ErrorCode: AlreadyExists` — deleting by that identifier would destroy a
+* pre-existing user resource, so it is never cleaned up).
+*/
+var CloudControlOperationFailedError = class CloudControlOperationFailedError extends ProvisioningError {
+	ccErrorCode;
+	ccOperation;
+	constructor(message, resourceType, logicalId, physicalId, ccErrorCode, ccOperation) {
+		super(message, resourceType, logicalId, physicalId);
+		this.ccErrorCode = ccErrorCode;
+		this.ccOperation = ccOperation;
+		this.name = "CloudControlOperationFailedError";
+		Object.setPrototypeOf(this, CloudControlOperationFailedError.prototype);
+	}
+};
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -7990,10 +8012,54 @@ var CloudControlProvider = class {
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes || {});
 			return result;
 		} catch (error) {
+			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId);
 			this.handleError(error, "CREATE", resourceType, logicalId);
 		}
 	}
 	/**
+	* Best-effort deletion of the physical resource a FAILED async CREATE left
+	* behind.
+	*
+	* Some Cloud Control create handlers materialize the resource first and
+	* stabilize it afterwards (e.g. `AWS::Synthetics::Canary` creates the canary
+	* entity, then builds its backing Lambda). When stabilization fails — most
+	* commonly the just-created-IAM-role propagation race cdkd's fast path is
+	* prone to — the FAILED progress event carries the materialized resource's
+	* `Identifier`, but the half-created remnant keeps occupying the name. The
+	* deploy engine's outer `withRetry` then re-invokes `create()` (the
+	* stabilization message matches the transient-error patterns) and every
+	* retry fails with `AlreadyExists` instead of recovering, and the remnant is
+	* ALSO invisible to rollback (the create never returned, so it is not in
+	* state) — an orphan CloudFormation would have deleted on rollback.
+	*
+	* Deleting the remnant here restores both behaviors: the next retry starts
+	* with a free name (and succeeds once AWS stabilizes), and a final failure
+	* leaves nothing behind.
+	*
+	* Safety: never fires when the handler reported `ErrorCode: AlreadyExists`
+	* — there the identifier names a resource that pre-dates this create (our
+	* CreateCanary repro's SECOND attempt reported exactly that shape), and
+	* deleting it would destroy a user's pre-existing resource. Handlers may
+	* also stuff a speculative identifier into a FAILED event without having
+	* materialized anything (observed on `AWS::CodeDeploy::DeploymentGroup`);
+	* the delete then no-ops via the NotFound-idempotent path. Cleanup failures
+	* are warned, not thrown — the original create error must surface.
+	*/
+	async cleanupFailedCreateRemnant(error, resourceType, logicalId) {
+		if (!(error instanceof CloudControlOperationFailedError)) return;
+		if (error.ccOperation !== "CREATE" || !error.physicalId) return;
+		if (error.ccErrorCode === "AlreadyExists") return;
+		if (error.ccErrorCode === "ResourceConflict") return;
+		this.logger.info(`CREATE of ${logicalId} failed after materializing ${error.physicalId}; deleting the remnant so a retry can re-create it`);
+		try {
+			await this.delete(logicalId, error.physicalId, resourceType);
+			this.logger.debug(`Removed failed-create remnant ${error.physicalId} for ${logicalId}`);
+		} catch (cleanupError) {
+			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${message} — a retry may fail with AlreadyExists until it is removed manually`);
+		}
+	}
+	/**
 	* Update a resource using Cloud Control API
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -8113,7 +8179,7 @@ var CloudControlProvider = class {
 			this.logger.debug(`${operation} ${logicalId}: ${progressEvent.OperationStatus} (attempt ${attempts}, next poll ${pollInterval}ms)`);
 			switch (progressEvent.OperationStatus) {
 				case "SUCCESS": return progressEvent;
-				case "FAILED": throw new ProvisioningError(`${operation} failed for ${logicalId}: ${progressEvent.StatusMessage || "Unknown error"}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
+				case "FAILED": throw new CloudControlOperationFailedError(`${operation} failed for ${logicalId}: ${progressEvent.StatusMessage || "Unknown error"}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier, progressEvent.ErrorCode, operation);
 				case "CANCEL_COMPLETE": throw new ProvisioningError(`${operation} cancelled for ${logicalId}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
 				case "IN_PROGRESS":
 				case "PENDING":
@@ -14221,4 +14287,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-BERaDgMo.js.map
+//# sourceMappingURL=deploy-engine-DhL8rX8u.js.map