@go-to-k/cdkd 0.296.21 → 0.296.22

package/dist/{provider-classes-D9az4nS4.js → provider-classes-SKdRlxGS.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-BoZuWtxK.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { A as beginDeleteWait, B as S3_AUTO_DELETE_OBJECTS_TAG, Ba as configStringRefusal, Bi as refuseMalformedNestedChildOutputs, Bn as DBPROXY_TAGS_WHAT, Br as s3BucketDualStackDomainName, Co as markSameGenerationBag, Do as dynamicReferenceTokens, Et as awaitInFlightSibling, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fa as toFiniteNumber, Fn as earliestDefined, Ga as requireConfigString, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, H as isTruthyCfnBoolean, Ha as replayWarn, Hn as planTagDiff, Hr as s3BucketWebsiteUrl, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as coerceCfnBoolean, Jn as stringifyIfAssigned, Kn as tagPlanWarning, Kr as getAccountInfo, Kt as redactedDeleteAddressSkip, L as deleteTableWithIndexBusyRetry, La as coerceCfnInteger, Ln as reserveStackCreateToken, Lr as isSettledInstanceState, M as deleteBudgetKey, Ma as coerceWarmThroughput$1, Mc as displayAssemblyPath, N as resolveDynamoDbDeleteBudgetClock, Na as isWarmThroughputDecrease, Nc as renderAssemblyPathEscape, No as recoverMaskedOutput, O as DynamoDBGlobalTableProvider, Ot as getStackRecords, P as resolveDynamoDbDeleteBudgetMs, Pa as toCfnInteger, Pc as resolveAssemblyPath, Po as carriesSecretMask, Qa as sameLambdaFunctionAddress, R as waitForIndexesSettled, Ra as configBooleanRefusal, Rr as s3BucketArn, Sa as withoutSilentDropProperties, U as getPriorAttempts, Ua as requireConfigArray, Un as readTagList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as hasCdkAutoDeleteTag, Va as readConfigString, Vn as DBPROXY_TAG_OPTIONS, Vr as s3BucketRegionalDomainName, Vt as getCurrentProducerRegions, W as markRefusedBeforeApplying, Wa as requireConfigObject, Wn as refuseMalformedDesiredTags, Wt as isRedactedRecordedValue, Xa as canonicalLambdaFunctionName, Ya as withRetry, Za as lambdaFunctionNameForMask, _c as decodeListingKey, _r as observeThenDisableInstanceApiTermination, _s as rewriteTemplateAssetReferences, a as findNestedTemplateTreeDefect, ai as passedParameterClassesOf, ba as findSilentDropProperties, bc as canonicalizeRegion, c as renderNestedTemplateTreeDefect, di as accountArgs, dr as withIndeterminateGuard, fo as hasMaskableValues, fr as isWaitAbandonedError, fs as stringifyValue, ft as revertNestedChildFromJournal, gr as isTerminationProtectionPropagationError, gt as withNestedStackContext, hr as ec2InstanceProtectionSite, ht as getCurrentNestedStackContext, j as compensateRemovedDeletionProtection, ja as WARM_THROUGHPUT_MEMBERS, jc as describeFileReadFailure, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as getNestedRevertRun, ni as parseWebACLArn, o as isAbsoluteAssetPath, oa as refuseMalformedResourcesForDestroy, or as slowCcOperationTimeoutMs, pr as markWaitAbandoned, qn as definedAttributes, rr as getCurrentResourceSecrets, s as listNestedTemplateRows, so as passedNoEchoParametersOf, sr as unchangedBehindSecretReference, t as DeployEngine, ur as deleteSkipReason, va as withheldAccountClause, vr as reDisableInstanceApiTermination, wo as redactSecretsForState, xc as derivePartitionAndUrlSuffix, yr as reEnableInstanceApiTermination, z as ECR_AUTO_DELETE_IMAGES_TAG, za as configIntegerRefusal, zn as acquireIdempotencyToken, zr as s3BucketDomainName } from "./deploy-engine-CFgNpsEy.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-lZJS9r6W.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B5hwPYpu.js";
-import { RDSProvider } from "./rds-provider-CE85wFCg.js";
-import { NeptuneProvider } from "./neptune-provider-DGI_r9C8.js";
-import { ASGProvider } from "./asg-provider-D5_Zlj5T.js";
+import { $a as lambdaFunctionNameForMask, A as beginDeleteWait, B as S3_AUTO_DELETE_OBJECTS_TAG, Ba as configBooleanRefusal, Br as s3BucketArn, Cc as derivePartitionAndUrlSuffix, Eo as redactSecretsForState, Et as awaitInFlightSibling, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fa as isWarmThroughputDecrease, Fc as renderAssemblyPathEscape, Fo as recoverMaskedOutput, Ga as requireConfigArray, Gn as readTagList, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, H as isTruthyCfnBoolean, Ha as configStringRefusal, Hi as refuseMalformedNestedChildOutputs, Hn as DBPROXY_TAGS_WHAT, Hr as s3BucketDualStackDomainName, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as toCfnInteger, Ic as resolveAssemblyPath, Io as carriesSecretMask, Jn as tagPlanWarning, Jr as getAccountInfo, Jt as redactedDeleteAddressSkip, Ka as requireConfigObject, Kn as refuseMalformedDesiredTags, Kt as isRedactedRecordedValue, L as deleteTableWithIndexBusyRetry, La as toFiniteNumber, Ln as earliestDefined, M as deleteBudgetKey, N as resolveDynamoDbDeleteBudgetClock, Na as WARM_THROUGHPUT_MEMBERS, Nc as describeFileReadFailure, O as DynamoDBGlobalTableProvider, Ot as getStackRecords, P as resolveDynamoDbDeleteBudgetMs, Pa as coerceWarmThroughput$1, Pc as displayAssemblyPath, Qa as canonicalLambdaFunctionName, R as waitForIndexesSettled, Ra as coerceCfnBoolean, Sa as findSilentDropProperties, Sc as canonicalizeRegion, To as markSameGenerationBag, U as getPriorAttempts, Ua as readConfigString, Un as DBPROXY_TAG_OPTIONS, Ur as s3BucketRegionalDomainName, Ut as getCurrentProducerRegions, V as hasCdkAutoDeleteTag, Va as configIntegerRefusal, Vn as acquireIdempotencyToken, Vr as s3BucketDomainName, W as markRefusedBeforeApplying, Wa as replayWarn, Wn as planTagDiff, Wr as s3BucketWebsiteUrl, Xn as stringifyIfAssigned, Yn as definedAttributes, Za as withRetry, _r as ec2InstanceProtectionSite, a as findNestedTemplateTreeDefect, ar as getCurrentResourceSecrets, ba as withheldAccountClause, br as reDisableInstanceApiTermination, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcesForDestroy, cr as slowCcOperationTimeoutMs, eo as sameLambdaFunctionAddress, fr as deleteSkipReason, ft as revertNestedChildFromJournal, gt as withNestedStackContext, hr as markWaitAbandoned, ht as getCurrentNestedStackContext, ii as parseWebACLArn, j as compensateRemovedDeletionProtection, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ko as dynamicReferenceTokens, lo as passedNoEchoParametersOf, lr as unchangedBehindSecretReference, lt as getNestedRevertRun, mo as hasMaskableValues, mr as isWaitAbandonedError, ms as stringifyValue, o as isAbsoluteAssetPath, pi as accountArgs, pr as withIndeterminateGuard, qa as requireConfigString, qn as tagMapAsList, qt as redactedDeleteAddressFields, s as listNestedTemplateRows, si as passedParameterClassesOf, t as DeployEngine, vr as isTerminationProtectionPropagationError, wa as withoutSilentDropProperties, xr as reEnableInstanceApiTermination, yc as decodeListingKey, yr as observeThenDisableInstanceApiTermination, ys as rewriteTemplateAssetReferences, z as ECR_AUTO_DELETE_IMAGES_TAG, za as coerceCfnInteger, zn as reserveStackCreateToken, zr as isSettledInstanceState } from "./deploy-engine-BueFQdfN.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CGY8o8Pv.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B6NoMGdN.js";
+import { RDSProvider } from "./rds-provider-Cc9l4-JW.js";
+import { NeptuneProvider } from "./neptune-provider-7hDILb3t.js";
+import { ASGProvider } from "./asg-provider-BYk2trWp.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -3089,6 +3089,23 @@ function holdCreateBucketWindow(logicalId, window) {
 		heldAtMs: Date.now()
 	});
 }
+const ownLeftoverBuckets = /* @__PURE__ */ new Map();
+function holdOwnLeftoverBucket(logicalId, identity) {
+	setBounded(ownLeftoverBuckets, createAttemptKey("CreateBucket", logicalId), {
+		identity,
+		heldAtMs: Date.now()
+	});
+}
+const OWN_LEFTOVER_IDENTITY_TIMEOUT_MS = 1e4;
+function tokenDate(token) {
+	return token.slice(token.lastIndexOf("|") + 1);
+}
+function takeOwnLeftoverBucket(logicalId) {
+	const key = createAttemptKey("CreateBucket", logicalId);
+	const held = ownLeftoverBuckets.get(key);
+	ownLeftoverBuckets.delete(key);
+	return held !== void 0 && Date.now() - held.heldAtMs <= 18e5 ? held.identity : void 0;
+}
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	createClientHolder = {};
@@ -3150,6 +3167,40 @@ var S3BucketProvider = class S3BucketProvider {
 		const listed = await this.listOwnedBucket(bucketName);
 		return "unknown" in listed ? listed : { owned: listed.bucket !== void 0 };
 	}
+	async boundedIdentity(bucketName, resourceType, region) {
+		let timer;
+		try {
+			return await Promise.race([this.resourceIdentity(bucketName, resourceType, { expectedRegion: region }), new Promise((resolve) => {
+				timer = setTimeout(() => resolve(void 0), OWN_LEFTOVER_IDENTITY_TIMEOUT_MS);
+			})]);
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	async holdOwnLeftover(logicalId, resourceType, bucketName) {
+		try {
+			const region = canonicalizeRegion(await this.getRegion());
+			const identity = await this.boundedIdentity(bucketName, resourceType, region);
+			if (typeof identity === "string") {
+				holdOwnLeftoverBucket(logicalId, identity);
+				this.logger.debug(safeMsg`Recorded the bucket ${this.shown(bucketName)} this failed create of ${displaySafe(logicalId)} leaves (created ${tokenDate(identity)}), for its retry`);
+			} else this.logger.debug(safeMsg`No identity for the bucket ${this.shown(bucketName)} this failed create of ${displaySafe(logicalId)} leaves; a retry will refuse it`);
+		} catch {}
+	}
+	async isOwnLeftoverBucket(leftover, bucketName, resourceType, region) {
+		if (leftover === void 0) {
+			this.logger.debug(safeMsg`Not this create's own bucket: no earlier attempt recorded ${this.shown(bucketName)}`);
+			return false;
+		}
+		try {
+			const identity = await this.boundedIdentity(bucketName, resourceType, region);
+			if (typeof identity === "string" && identity === leftover) return true;
+			this.logger.debug(safeMsg`Not this create's own bucket: ${this.shown(bucketName)} reads ` + safeMsg`${typeof identity === "string" ? `created ${tokenDate(identity)}` : "no identity"}, ` + safeMsg`the earlier attempt recorded created ${tokenDate(leftover)}`);
+			return false;
+		} catch {
+			return false;
+		}
+	}
 	async listOwnedBucket(bucketName) {
 		try {
 			let token;
@@ -4342,30 +4393,38 @@ var S3BucketProvider = class S3BucketProvider {
 			let createdNewBucket = false;
 			const createClient = await this.getCreateClient();
 			ambiguousWindow = takeCreateBucketWindow(logicalId);
+			const ownLeftover = takeOwnLeftoverBucket(logicalId);
+			const adoptedOwnLeftover = explicitBucketName && ownLeftover !== void 0 && context?.replayingState !== true && await this.isOwnLeftoverBucket(ownLeftover, bucketName, resourceType, canonicalRegion);
+			if (adoptedOwnLeftover) {
+				createdNewBucket = true;
+				bucketLeftBehind = true;
+			}
 			if (ambiguousWindow !== void 0 && (preflight.kind === "indeterminate" || preflight.kind === "region" && preflight.region === "us-east-1")) {
 				windowSpent = true;
 				this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { preflight: preflight.kind }, explicitBucketName);
 			}
-			if (explicitBucketName && preflight.kind === "region" && preflight.region === "us-east-1") this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { preflightRegion: preflight.region });
+			if (explicitBucketName && preflight.kind === "region" && preflight.region === "us-east-1") {
+				if (!adoptedOwnLeftover) this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { preflightRegion: preflight.region });
+			}
 			let ownershipUnknown;
-			if (explicitBucketName && preflight.kind === "indeterminate") {
+			if (explicitBucketName && preflight.kind === "indeterminate" && !adoptedOwnLeftover) {
 				const owned = await this.ownsBucketNamed(bucketName);
 				if ("owned" in owned && owned.owned) this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { listed: true });
 				if ("unknown" in owned) ownershipUnknown = owned.unknown;
 			}
 			try {
 				const attemptStartMs = Date.now();
-				try {
+				if (!adoptedOwnLeftover) try {
 					await createClient.send(new CreateBucketCommand(createParams));
 				} catch (sendError) {
 					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
 					throw sendError;
 				}
-				createdNewBucket = preflight.kind === "absent";
+				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
 				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
-				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
+				if (preflight.kind === "region" && !adoptedOwnLeftover) this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
 				if (ownershipUnknown !== void 0 && preflight.kind === "indeterminate") this.logger.warn(safeMsg`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) was ` + `sent to CreateBucket without knowing whether a bucket of that explicit name ` + safeMsg`already existed: the region probe (${preflight.errorName}) and the bucket ` + safeMsg`listing (${ownershipUnknown}) both failed. In us-east-1 CreateBucket answers 200 ` + "OK over a bucket you own, so if one existed it has now been configured and recorded as this stack's. Re-run with --verbose for AWS's own message.");
 				this.logger.debug(`Created S3 bucket: ${this.shown(bucketName)}`);
 			} catch (createError) {
@@ -4414,7 +4473,10 @@ var S3BucketProvider = class S3BucketProvider {
 		} catch (error) {
 			if (ambiguousWindow !== void 0 && !windowSpent) holdCreateBucketWindow(logicalId, ambiguousWindow);
 			const thrown = this.wrapOperationError("create", logicalId, resourceType, bucketName, error);
-			if (bucketLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
+			if (bucketLeftBehind) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
+				if (explicitBucketName) await this.holdOwnLeftover(logicalId, resourceType, bucketName);
+			}
 			throw thrown;
 		}
 	}
@@ -44435,4 +44497,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-D9az4nS4.js.map
+//# sourceMappingURL=provider-classes-SKdRlxGS.js.map