@go-to-k/cdkd 0.24.0 → 0.26.0

package/dist/index.js

@@ -613,6 +613,22 @@ var LiveRenderer = class {
     if (this.active)
       this.draw();
   }
+  /**
+   * Replace the label of a previously-added task in place. No-op if the
+   * task is not currently tracked (e.g. it already finished). Used by the
+   * per-resource deadline wrapper to surface a "[taking longer than
+   * expected, Nm+]" suffix without disturbing the elapsed-time counter
+   * the renderer tracks via `startedAt`.
+   */
+  updateTaskLabel(id, label) {
+    const stackName = getCurrentStackName();
+    const task = this.tasks.get(scopedKey(id, stackName));
+    if (!task)
+      return;
+    task.label = label;
+    if (this.active)
+      this.draw();
+  }
   /**
    * Print content above the live area. Clears the live area, runs the writer,
    * then redraws the live area. When the renderer is inactive, the writer
@@ -898,6 +914,38 @@ var ProvisioningError = class _ProvisioningError extends CdkdError {
     Object.setPrototypeOf(this, _ProvisioningError.prototype);
   }
 };
+var ResourceTimeoutError = class _ResourceTimeoutError extends CdkdError {
+  constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+    const elapsedLabel = formatDuration(elapsedMs);
+    const timeoutLabel = formatDuration(timeoutMs);
+    super(
+      `Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).
+This may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
+slow ENI provisioning. Re-run with --resource-timeout 1h if the resource genuinely
+needs more time, or --verbose to see the underlying provider activity.`,
+      "RESOURCE_TIMEOUT"
+    );
+    this.logicalId = logicalId;
+    this.resourceType = resourceType;
+    this.region = region;
+    this.elapsedMs = elapsedMs;
+    this.operation = operation;
+    this.timeoutMs = timeoutMs;
+    this.name = "ResourceTimeoutError";
+    Object.setPrototypeOf(this, _ResourceTimeoutError.prototype);
+  }
+};
+function formatDuration(ms) {
+  if (ms < 6e4) {
+    return `${Math.round(ms / 1e3)}s`;
+  }
+  const totalMinutes = Math.round(ms / 6e4);
+  if (totalMinutes < 60)
+    return `${totalMinutes}m`;
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
 var DependencyError = class _DependencyError extends CdkdError {
   constructor(message, cause) {
     super(message, "DEPENDENCY_ERROR", cause);
@@ -8108,7 +8156,85 @@ async function withRetry(operation, logicalId, opts = {}) {
   throw lastError;
 }
 
+// src/deployment/resource-deadline.ts
+var InvalidResourceDeadlineError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidResourceDeadlineError";
+  }
+};
+function validateOptions(opts) {
+  const { warnAfterMs, timeoutMs } = opts;
+  if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) {
+    throw new InvalidResourceDeadlineError(
+      `withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`
+    );
+  }
+  if (warnAfterMs >= timeoutMs) {
+    throw new InvalidResourceDeadlineError(
+      `withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`
+    );
+  }
+}
+async function withResourceDeadline(operation, opts) {
+  validateOptions(opts);
+  const startedAt = Date.now();
+  return new Promise((resolve4, reject) => {
+    let settled = false;
+    let warnTimer;
+    let timeoutTimer;
+    const cleanup = () => {
+      if (warnTimer !== void 0)
+        clearTimeout(warnTimer);
+      if (timeoutTimer !== void 0)
+        clearTimeout(timeoutTimer);
+      warnTimer = void 0;
+      timeoutTimer = void 0;
+    };
+    if (opts.onWarn) {
+      warnTimer = setTimeout(() => {
+        if (settled)
+          return;
+        try {
+          opts.onWarn(Date.now() - startedAt);
+        } catch {
+        }
+      }, opts.warnAfterMs);
+      if (typeof warnTimer.unref === "function")
+        warnTimer.unref();
+    }
+    timeoutTimer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      const elapsed = Date.now() - startedAt;
+      reject(opts.onTimeout(elapsed));
+    }, opts.timeoutMs);
+    if (typeof timeoutTimer.unref === "function")
+      timeoutTimer.unref();
+    Promise.resolve().then(() => operation()).then(
+      (value) => {
+        if (settled)
+          return;
+        settled = true;
+        cleanup();
+        resolve4(value);
+      },
+      (err) => {
+        if (settled)
+          return;
+        settled = true;
+        cleanup();
+        reject(err);
+      }
+    );
+  });
+}
+
 // src/deployment/deploy-engine.ts
+var DEFAULT_RESOURCE_WARN_AFTER_MS = 5 * 60 * 1e3;
+var DEFAULT_RESOURCE_TIMEOUT_MS = 30 * 60 * 1e3;
 var InterruptedError = class extends Error {
   constructor() {
     super("Deployment interrupted by user (Ctrl+C)");
@@ -8129,6 +8255,8 @@ var DeployEngine = class {
     this.options.dryRun = options.dryRun ?? false;
     this.options.lockTimeout = options.lockTimeout ?? 5 * 60 * 1e3;
     this.options.noRollback = options.noRollback ?? false;
+    this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
+    this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
   }
   logger = getLogger().child("DeployEngine");
   resolver;
@@ -8727,259 +8855,305 @@ var DeployEngine = class {
    */
   async provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
     const resourceType = change.resourceType;
-    const provider = this.providerRegistry.getProvider(resourceType);
     const renderer = getLiveRenderer();
     const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
     const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-    renderer.addTask(logicalId, `${verb} ${logicalId} (${resourceType})`);
+    const baseLabel = `${verb} ${logicalId} (${resourceType})`;
+    renderer.addTask(logicalId, baseLabel);
+    const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
+    const warnAfterMs = this.options.resourceWarnAfterByType?.[resourceType] ?? this.options.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
+    const timeoutMs = this.options.resourceTimeoutByType?.[resourceType] ?? this.options.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
     try {
-      switch (change.changeType) {
-        case "CREATE": {
-          const desiredProps = change.desiredProperties || {};
-          const context = {
+      await withResourceDeadline(
+        async () => {
+          await this.provisionResourceBody(
+            logicalId,
+            change,
+            stateResources,
+            stackName,
             template,
-            resources: stateResources,
-            ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-            ...conditions && Object.keys(conditions).length > 0 && { conditions },
-            stateBackend: this.stateBackend,
-            stackName
-          };
-          const resolvedProps = await this.resolver.resolve(desiredProps, context);
-          const { provider: createProvider, properties: createProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-          const result = await this.withRetry(
-            () => createProvider.create(logicalId, resourceType, createProps),
+            parameterValues,
+            conditions,
+            counts,
+            progress
+          );
+        },
+        {
+          warnAfterMs,
+          timeoutMs,
+          onWarn: (elapsedMs) => {
+            const minutes = Math.max(1, Math.round(elapsedMs / 6e4));
+            const warnSuffix = ` [taking longer than expected, ${minutes}m+]`;
+            renderer.updateTaskLabel(logicalId, `${baseLabel}${warnSuffix}`);
+            renderer.printAbove(() => {
+              this.logger.warn(
+                `${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m \u2014 still waiting`
+              );
+            });
+          },
+          onTimeout: (elapsedMs) => new ResourceTimeoutError(
+            logicalId,
+            resourceType,
+            this.stackRegion,
+            elapsedMs,
+            operationKind,
+            timeoutMs
+          )
+        }
+      );
+    } catch (error) {
+      renderer.removeTask(logicalId);
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+      throw new ProvisioningError(
+        `Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`,
+        resourceType,
+        logicalId,
+        stateResources[logicalId]?.physicalId,
+        error instanceof Error ? error : void 0
+      );
+    } finally {
+      renderer.removeTask(logicalId);
+    }
+  }
+  /**
+   * Inner body of provisionResource, extracted so the outer wrapper can
+   * apply the per-resource deadline (`withResourceDeadline`) without
+   * having the timeout / warn timer code dwarf the real provisioning
+   * logic. Behaviour is unchanged from the pre-deadline implementation.
+   */
+  async provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
+    const resourceType = change.resourceType;
+    const provider = this.providerRegistry.getProvider(resourceType);
+    const renderer = getLiveRenderer();
+    switch (change.changeType) {
+      case "CREATE": {
+        const desiredProps = change.desiredProperties || {};
+        const context = {
+          template,
+          resources: stateResources,
+          ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
+          ...conditions && Object.keys(conditions).length > 0 && { conditions },
+          stateBackend: this.stateBackend,
+          stackName
+        };
+        const resolvedProps = await this.resolver.resolve(desiredProps, context);
+        const { provider: createProvider, properties: createProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+        const result = await this.withRetry(
+          () => createProvider.create(logicalId, resourceType, createProps),
+          logicalId
+        );
+        const dependencies = this.extractAllDependencies(template, logicalId);
+        stateResources[logicalId] = {
+          physicalId: result.physicalId,
+          resourceType,
+          properties: resolvedProps,
+          ...result.attributes && { attributes: result.attributes },
+          ...dependencies && dependencies.length > 0 && { dependencies }
+        };
+        if (counts)
+          counts.created++;
+        if (progress)
+          progress.current++;
+        const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+        renderer.removeTask(logicalId);
+        this.logger.info(`${createPrefix}\u2705 ${logicalId} (${resourceType}) created`);
+        break;
+      }
+      case "UPDATE": {
+        const currentResource = stateResources[logicalId];
+        if (!currentResource) {
+          throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+        }
+        const desiredProps = change.desiredProperties || {};
+        const currentProps = change.currentProperties || {};
+        const context = {
+          template,
+          resources: stateResources,
+          ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
+          ...conditions && Object.keys(conditions).length > 0 && { conditions },
+          stateBackend: this.stateBackend,
+          stackName
+        };
+        const resolvedProps = await this.resolver.resolve(desiredProps, context);
+        if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
+          this.logger.debug(
+            `Skipping ${logicalId}: no actual changes after intrinsic function resolution`
+          );
+          if (counts)
+            counts.skipped++;
+          break;
+        }
+        const needsReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
+        const dependencies = this.extractAllDependencies(template, logicalId);
+        if (needsReplacement) {
+          const replacedProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
+          this.logger.info(
+            `Replacing ${logicalId} (${resourceType}) - immutable properties changed: ${replacedProps}`
+          );
+          this.logger.info(`  Creating new ${logicalId}...`);
+          const { provider: replaceProvider, properties: replaceProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+          const createResult = await this.withRetry(
+            () => replaceProvider.create(logicalId, resourceType, replaceProps),
             logicalId
           );
-          const dependencies = this.extractAllDependencies(template, logicalId);
+          const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
+          if (updateReplacePolicy === "Retain") {
+            this.logger.info(
+              `  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`
+            );
+          } else {
+            this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
+            try {
+              await provider.delete(
+                logicalId,
+                currentResource.physicalId,
+                resourceType,
+                currentResource.properties,
+                { expectedRegion: this.stackRegion }
+              );
+              this.logger.info(`  \u2713 Old resource deleted`);
+            } catch (deleteError) {
+              this.logger.warn(
+                `  \u26A0 Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`
+              );
+            }
+          }
           stateResources[logicalId] = {
-            physicalId: result.physicalId,
+            physicalId: createResult.physicalId,
             resourceType,
             properties: resolvedProps,
-            ...result.attributes && { attributes: result.attributes },
+            ...createResult.attributes && { attributes: createResult.attributes },
             ...dependencies && dependencies.length > 0 && { dependencies }
           };
           if (counts)
-            counts.created++;
+            counts.updated++;
           if (progress)
             progress.current++;
-          const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+          const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
           renderer.removeTask(logicalId);
-          this.logger.info(`${createPrefix}\u2705 ${logicalId} (${resourceType}) created`);
-          break;
-        }
-        case "UPDATE": {
-          const currentResource = stateResources[logicalId];
-          if (!currentResource) {
-            throw new Error(`Cannot update ${logicalId}: resource not found in state`);
-          }
-          const desiredProps = change.desiredProperties || {};
-          const currentProps = change.currentProperties || {};
-          const context = {
-            template,
-            resources: stateResources,
-            ...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-            ...conditions && Object.keys(conditions).length > 0 && { conditions },
-            stateBackend: this.stateBackend,
-            stackName
-          };
-          const resolvedProps = await this.resolver.resolve(desiredProps, context);
-          if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
-            this.logger.debug(
-              `Skipping ${logicalId}: no actual changes after intrinsic function resolution`
-            );
-            if (counts)
-              counts.skipped++;
-            break;
-          }
-          const needsReplacement2 = change.propertyChanges?.some((pc) => pc.requiresReplacement);
-          const dependencies = this.extractAllDependencies(template, logicalId);
-          if (needsReplacement2) {
-            const replacedProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
-            this.logger.info(
-              `Replacing ${logicalId} (${resourceType}) - immutable properties changed: ${replacedProps}`
-            );
-            this.logger.info(`  Creating new ${logicalId}...`);
-            const { provider: replaceProvider, properties: replaceProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-            const createResult = await this.withRetry(
-              () => replaceProvider.create(logicalId, resourceType, replaceProps),
+          this.logger.info(`${replacePrefix}\u2705 ${logicalId} (${resourceType}) replaced`);
+        } else {
+          this.logger.debug(`Updating ${logicalId} (${resourceType})`);
+          const { provider: updateProvider, properties: updateProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+          let result;
+          try {
+            result = await this.withRetry(
+              () => updateProvider.update(
+                logicalId,
+                currentResource.physicalId,
+                resourceType,
+                updateProps,
+                currentProps
+              ),
               logicalId
             );
-            const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
-            if (updateReplacePolicy === "Retain") {
+          } catch (updateError) {
+            const msg = updateError instanceof Error ? updateError.message : String(updateError);
+            if (msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE")) {
               this.logger.info(
-                `  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`
+                `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE \u2192 CREATE)`
               );
-            } else {
-              this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
               try {
                 await provider.delete(
                   logicalId,
                   currentResource.physicalId,
                   resourceType,
-                  currentResource.properties,
+                  currentProps,
                   { expectedRegion: this.stackRegion }
                 );
-                this.logger.info(`  \u2713 Old resource deleted`);
               } catch (deleteError) {
-                this.logger.warn(
-                  `  \u26A0 Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`
-                );
-              }
-            }
-            stateResources[logicalId] = {
-              physicalId: createResult.physicalId,
-              resourceType,
-              properties: resolvedProps,
-              ...createResult.attributes && { attributes: createResult.attributes },
-              ...dependencies && dependencies.length > 0 && { dependencies }
-            };
-            if (counts)
-              counts.updated++;
-            if (progress)
-              progress.current++;
-            const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-            renderer.removeTask(logicalId);
-            this.logger.info(`${replacePrefix}\u2705 ${logicalId} (${resourceType}) replaced`);
-          } else {
-            this.logger.debug(`Updating ${logicalId} (${resourceType})`);
-            const { provider: updateProvider, properties: updateProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
-            let result;
-            try {
-              result = await this.withRetry(
-                () => updateProvider.update(
-                  logicalId,
-                  currentResource.physicalId,
-                  resourceType,
-                  updateProps,
-                  currentProps
-                ),
-                logicalId
-              );
-            } catch (updateError) {
-              const msg = updateError instanceof Error ? updateError.message : String(updateError);
-              if (msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE")) {
-                this.logger.info(
-                  `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE \u2192 CREATE)`
-                );
-                try {
-                  await provider.delete(
-                    logicalId,
-                    currentResource.physicalId,
-                    resourceType,
-                    currentProps,
-                    { expectedRegion: this.stackRegion }
+                const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+                if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) {
+                  this.logger.debug(
+                    `Old resource ${logicalId} already gone, proceeding with CREATE`
                   );
-                } catch (deleteError) {
-                  const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-                  if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) {
-                    this.logger.debug(
-                      `Old resource ${logicalId} already gone, proceeding with CREATE`
-                    );
-                  } else {
-                    throw deleteError;
-                  }
+                } else {
+                  throw deleteError;
                 }
-                const { provider: replProvider, properties: replProps } = this.selectProviderWithSafetyNet(
-                  provider,
-                  resourceType,
-                  resolvedProps,
-                  logicalId
-                );
-                const createResult = await this.withRetry(
-                  () => replProvider.create(logicalId, resourceType, replProps),
-                  logicalId
-                );
-                result = {
-                  physicalId: createResult.physicalId,
-                  attributes: createResult.attributes,
-                  wasReplaced: true
-                };
-              } else {
-                throw updateError;
               }
-            }
-            if (result.wasReplaced) {
-              this.logger.info(
-                `Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`
+              const { provider: replProvider, properties: replProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
+              const createResult = await this.withRetry(
+                () => replProvider.create(logicalId, resourceType, replProps),
+                logicalId
               );
+              result = {
+                physicalId: createResult.physicalId,
+                attributes: createResult.attributes,
+                wasReplaced: true
+              };
+            } else {
+              throw updateError;
             }
-            stateResources[logicalId] = {
-              physicalId: result.physicalId,
-              resourceType,
-              properties: resolvedProps,
-              ...result.attributes && { attributes: result.attributes },
-              ...dependencies && dependencies.length > 0 && { dependencies }
-            };
-            if (counts)
-              counts.updated++;
-            if (progress)
-              progress.current++;
-            const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-            renderer.removeTask(logicalId);
-            this.logger.info(`${updatePrefix}\u2705 ${logicalId} (${resourceType}) updated`);
-          }
-          break;
-        }
-        case "DELETE": {
-          const currentResource = stateResources[logicalId];
-          if (!currentResource) {
-            throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
           }
-          const deletionPolicy = template?.Resources?.[logicalId]?.DeletionPolicy;
-          if (deletionPolicy === "Retain") {
-            this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: Retain`);
-            delete stateResources[logicalId];
-            break;
-          }
-          this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
-          try {
-            await this.withRetry(
-              () => provider.delete(
-                logicalId,
-                currentResource.physicalId,
-                resourceType,
-                currentResource.properties,
-                { expectedRegion: this.stackRegion }
-              ),
-              logicalId,
-              3,
-              // fewer retries for DELETE
-              5e3
+          if (result.wasReplaced) {
+            this.logger.info(
+              `Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`
             );
-          } catch (deleteError) {
-            const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-            if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) {
-              this.logger.debug(
-                `Resource ${logicalId} already deleted (${msg}), removing from state`
-              );
-            } else {
-              throw deleteError;
-            }
           }
-          delete stateResources[logicalId];
+          stateResources[logicalId] = {
+            physicalId: result.physicalId,
+            resourceType,
+            properties: resolvedProps,
+            ...result.attributes && { attributes: result.attributes },
+            ...dependencies && dependencies.length > 0 && { dependencies }
+          };
           if (counts)
-            counts.deleted++;
+            counts.updated++;
           if (progress)
             progress.current++;
-          const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+          const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
           renderer.removeTask(logicalId);
-          this.logger.info(`${deletePrefix}\u2705 ${logicalId} (${resourceType}) deleted`);
+          this.logger.info(`${updatePrefix}\u2705 ${logicalId} (${resourceType}) updated`);
+        }
+        break;
+      }
+      case "DELETE": {
+        const currentResource = stateResources[logicalId];
+        if (!currentResource) {
+          throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
+        }
+        const deletionPolicy = template?.Resources?.[logicalId]?.DeletionPolicy;
+        if (deletionPolicy === "Retain") {
+          this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: Retain`);
+          delete stateResources[logicalId];
           break;
         }
+        this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+        try {
+          await this.withRetry(
+            () => provider.delete(
+              logicalId,
+              currentResource.physicalId,
+              resourceType,
+              currentResource.properties,
+              { expectedRegion: this.stackRegion }
+            ),
+            logicalId,
+            3,
+            // fewer retries for DELETE
+            5e3
+          );
+        } catch (deleteError) {
+          const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+          if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) {
+            this.logger.debug(
+              `Resource ${logicalId} already deleted (${msg}), removing from state`
+            );
+          } else {
+            throw deleteError;
+          }
+        }
+        delete stateResources[logicalId];
+        if (counts)
+          counts.deleted++;
+        if (progress)
+          progress.current++;
+        const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+        renderer.removeTask(logicalId);
+        this.logger.info(`${deletePrefix}\u2705 ${logicalId} (${resourceType}) deleted`);
+        break;
       }
-    } catch (error) {
-      renderer.removeTask(logicalId);
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
-      throw new ProvisioningError(
-        `Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`,
-        resourceType,
-        logicalId,
-        stateResources[logicalId]?.physicalId,
-        error instanceof Error ? error : void 0
-      );
-    } finally {
-      renderer.removeTask(logicalId);
     }
   }
   /**