@go-to-k/cdkd 0.275.1 → 0.275.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-C44YX-go.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-_U0eVWNU.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-c0TMaGXW.js";
+import { t as ASGProvider } from "./asg-provider-UUnRzwMx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33,7 +33,7 @@ import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, Cha
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
-import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
+import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
@@ -4701,6 +4701,53 @@ var IAMUserGroupProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/data-delete-intent.ts
+/**
+* Shared helpers for detecting a template-borne "destroy my data" opt-in on
+* resources whose delete API fails by default while they still hold data
+* (issue #1340).
+*
+* CloudFormation fails the delete of a non-empty S3 bucket / image-carrying
+* ECR repository and the user opts into force-cleanup explicitly (CDK's
+* `autoDeleteObjects` custom resource + tag, `emptyOnDelete` /
+* `EmptyOnDelete: true`). cdkd honors exactly those signals — plus the
+* deploy engine's `--force-stateful-recreation` consent, threaded via
+* `DeleteContext.forceDataDelete` — instead of force-cleaning every
+* resource unconditionally.
+*/
+/**
+* Tag key CDK's `aws-s3.Bucket` sets when `autoDeleteObjects: true`.
+* The tag is what the AutoDeleteObjects custom-resource handler itself
+* checks before emptying, so it is the canonical opt-in marker.
+*/
+const S3_AUTO_DELETE_OBJECTS_TAG = "aws-cdk:auto-delete-objects";
+/**
+* Tag key CDK's `aws-ecr.Repository` sets when `autoDeleteImages: true`
+* (the pre-`emptyOnDelete` opt-in; both signals are honored).
+*/
+const ECR_AUTO_DELETE_IMAGES_TAG = "aws-cdk:auto-delete-images";
+/**
+* True when the resource's CFn `Tags` list carries `tagKey` with a truthy
+* value. Tolerates the CFn boolean-as-string shape (`"true"`).
+*/
+function hasCdkAutoDeleteTag(properties, tagKey) {
+	const tags = properties?.["Tags"];
+	if (!Array.isArray(tags)) return false;
+	return tags.some((tag) => {
+		if (typeof tag !== "object" || tag === null) return false;
+		const entry = tag;
+		return entry.Key === tagKey && isTruthyCfnBoolean(entry.Value);
+	});
+}
+/**
+* CFn booleans arrive as `true` or the string `"true"` depending on how the
+* template was authored / resolved; treat both as true.
+*/
+function isTruthyCfnBoolean(value) {
+	return value === true || value === "true";
+}
+
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 /**
@@ -5599,10 +5646,11 @@ var S3BucketProvider = class {
 	*
 	* Note: The bucket must be empty before deletion.
 	*/
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting S3 bucket ${logicalId}: ${physicalId}`);
+		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
-			await this.deleteBucketWithEmptyRetry(logicalId, physicalId);
+			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
 			if (error instanceof NoSuchBucket) {
 				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
@@ -6134,11 +6182,21 @@ var S3BucketProvider = class {
 		return null;
 	}
 	/**
-	* Delete a bucket, emptying it first if not empty.
-	* Handles the race condition where objects (e.g., ALB logs) are written
-	* after CustomResource cleanup but before bucket deletion.
+	* Delete a bucket, emptying it first if not empty — but ONLY when
+	* `allowAutoEmpty` is set (issue #1340).
+	*
+	* With `allowAutoEmpty` (CDK `autoDeleteObjects` tag present, or
+	* `--force-stateful-recreation` consent via
+	* {@link DeleteContext.forceDataDelete}), the retry loop handles the race
+	* condition where objects (e.g., ALB logs) are written after
+	* CustomResource cleanup but before bucket deletion.
+	*
+	* Without it, a not-empty bucket refuses deletion with an actionable
+	* error — matching CloudFormation's DELETE_FAILED, which is the safety
+	* net users rely on to keep `cdkd destroy` from silently destroying data
+	* they never opted into losing.
 	*/
-	async deleteBucketWithEmptyRetry(logicalId, bucketName) {
+	async deleteBucketWithEmptyRetry(logicalId, bucketName, allowAutoEmpty) {
 		const maxAttempts = 3;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -6147,7 +6205,8 @@ var S3BucketProvider = class {
 		} catch (error) {
 			const msg = error instanceof Error ? error.message : String(error);
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				this.logger.debug(`Bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying...`);
+				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
+				this.logger.info(`Bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
 				await this.emptyBucket(bucketName);
 				continue;
 			}
@@ -41327,16 +41386,33 @@ var S3DirectoryBucketProvider = class {
 	/**
 	* Delete an S3 Express Directory Bucket
 	*
-	* Must empty the bucket before deletion. Directory buckets do not support
-	* versioning, so only current objects need to be deleted.
+	* CloudFormation-parity data guard (issue #1344, sibling of #1340): a
+	* non-empty directory bucket is only auto-emptied when the user opted in —
+	* the `aws-cdk:auto-delete-objects` tag on the bucket (settable only via
+	* `--allow-unsupported-properties` today, since `Tags` is not yet a
+	* handled property for this type) or the deploy engine's
+	* `--force-stateful-recreation` consent on a replacement delete
+	* (`DeleteContext.forceDataDelete`). Otherwise the not-empty error
+	* surfaces exactly like CloudFormation's DELETE_FAILED (live-A/B-verified
+	* 2026-08-03: CFn fails a non-empty DirectoryBucket delete with "The
+	* bucket you tried to delete is not empty", 409).
+	*
+	* Directory buckets do not support versioning, so the opted-in auto-empty
+	* only needs to delete current objects.
 	*/
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting S3 Express Directory Bucket ${logicalId}: ${physicalId}`);
+		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
-			await this.emptyBucket(physicalId);
+			if (allowAutoEmpty) {
+				this.logger.info(`Emptying directory bucket ${physicalId} before deletion (auto-delete opt-in present)`);
+				await this.emptyBucket(physicalId);
+			}
 			await this.s3Client.send(new DeleteBucketCommand({ Bucket: physicalId }));
 			this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
 		} catch (error) {
+			const notEmptyMsg = error instanceof Error ? error.message : String(error);
+			if (!allowAutoEmpty && (notEmptyMsg.includes("not empty") || notEmptyMsg.includes("BucketNotEmpty"))) throw new ProvisioningError(`Failed to delete S3 Express Directory Bucket ${logicalId}: bucket ${physicalId} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. Delete all objects first (e.g. aws s3 rm s3://${physicalId} --recursive) and destroy again.`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 			if (error instanceof Error && (error.name === "NoSuchBucket" || error.name === "BucketNotFound")) {
 				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
@@ -42015,8 +42091,11 @@ var S3TablesProvider = class {
 *
 * Implements resource provisioning for AWS::ECR::Repository using the ECR SDK.
 * WHY: The CC API cannot force-delete repositories that contain images.
-* This SDK provider uses DeleteRepositoryCommand with `force: true` to delete
-* repositories along with all their images, supporting CDK's `emptyOnDelete: true`.
+* This SDK provider implements CDK's `emptyOnDelete: true` by passing
+* `force: true` to DeleteRepositoryCommand — gated on the user's opt-in
+* (`EmptyOnDelete: true`, the `aws-cdk:auto-delete-images` tag, or
+* `--force-stateful-recreation` on a replacement), never unconditionally
+* (issue #1340; CloudFormation parity for repositories without the opt-in).
 */
 var ECRProvider = class {
 	client;
@@ -42208,18 +42287,27 @@ var ECRProvider = class {
 	/**
 	* Delete an ECR Repository
 	*
-	* Uses `force: true` to delete the repository even if it contains images.
-	* This supports CDK's `emptyOnDelete: true` / `removalPolicy: DESTROY` pattern.
+	* `force: true` (delete the repository along with any images it still
+	* contains) is applied ONLY when the user opted in (issue #1340):
+	* `EmptyOnDelete: true` (CDK `emptyOnDelete`), CDK's legacy
+	* `autoDeleteImages` tag, or the deploy engine's
+	* `--force-stateful-recreation` consent on a replacement delete.
+	* Without an opt-in, a repository that still contains images refuses
+	* deletion with an actionable error — matching CloudFormation's
+	* DELETE_FAILED (`RepositoryNotEmptyException`).
 	*/
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting ECR Repository ${logicalId}: ${physicalId}`);
+		const force = context?.forceDataDelete === true || isTruthyCfnBoolean(properties?.["EmptyOnDelete"]) || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-images");
 		try {
+			if (force) this.logger.debug(`Force-deleting ECR Repository ${logicalId} (empty-on-delete opt-in present)`);
 			await this.getClient().send(new DeleteRepositoryCommand({
 				repositoryName: physicalId,
-				force: true
+				force
 			}));
 			this.logger.debug(`Successfully deleted ECR Repository ${logicalId}`);
 		} catch (error) {
+			if (error instanceof RepositoryNotEmptyException) throw new ProvisioningError(`Failed to delete ECR Repository ${logicalId}: repository ${physicalId} still contains images. Matching CloudFormation, cdkd does not force-delete an image-carrying repository unless it opted in via EmptyOnDelete: true (CDK's emptyOnDelete) or the '${ECR_AUTO_DELETE_IMAGES_TAG}' tag (CDK's autoDeleteImages). Either delete the images first (aws ecr batch-delete-image), or redeploy with emptyOnDelete: true and destroy again.`, resourceType, logicalId, physicalId, error);
 			if (error instanceof RepositoryNotFoundException) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECR Repository ${physicalId} does not exist, skipping deletion`);
@@ -63483,7 +63571,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;