@go-to-k/cdkd 0.281.21 → 0.281.23

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as CFN_TEMPLATE_URL_LIMIT, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as synthesisStatusMessage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerForeground, G as getAccountInfo, Gt as resolveCaptureObservedState, H as isTerminationProtectionPropagationError, Ht as getLegacyStateBucketName, I as ProviderRegistry, It as runDockerStreaming, J as normalizeAwsTagsToCfn, Jt as resolveStateBucketWithDefaultAndSource, K as refStateLookupFromResource, Kt as resolveSkipPrefix, L as findActionableSilentDrops, Lt as AssetManifestLoader, M as yellow, Mt as buildDockerImage, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as formatDockerLoginError, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as getDockerCmd, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_BODY_LIMIT, R as findSilentDropProperties, Rt as getDockerImageBySourceHash, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveApp, V as disableInstanceApiTermination, Vt as getDefaultStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveAutoAssetStorage, X as assertRegionMatch, Xt as stateBucketExistenceConfirmed, Y as resolveExplicitPhysicalId, Yt as resolveUseCdkBootstrapAssets, Z as coerceCfnBoolean, Zt as warnDeprecatedNoPrefixCliFlag, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as MIGRATE_TMP_PREFIX, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as derivePartitionAndUrlSuffix, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as uploadCfnTemplate, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefault, r as DeployEngine, rn as expectedOwnerParam, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findLargeInlineResources, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as Synthesizer } from "./deploy-engine-Cx48pqGQ.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-uxo_FCje.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CH0YfbOn.js";
+import { t as ASGProvider } from "./asg-provider-CCSQkGwO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12455,16 +12455,57 @@ function formatShape(segments) {
 * ## The `skipping` variant
 *
 * On the DELETE path the established policy is warn-and-continue, so a
-* malformed record leaves the AWS resource ALIVE while `cdkd destroy` reports
-* success. That policy is not changed here — but the warning now says what the
-* skip costs, because an orphan the user is never told about is one they cannot
-* go and delete.
+* malformed record leaves the AWS resource ALIVE. That policy is unchanged —
+* the warning says what the skip costs, because an orphan the user is never
+* told about is one they cannot go and delete.
+*
+* Since issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) the ACCOUNTING
+* around it is no longer a lie: an arm emitting this message must also return
+* `{ outcome: 'skipped', reason: COMPOSITE_ID_SKIP_REASON }` so `cdkd destroy`
+* prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
+* `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
+* wording here changed accordingly — it used to promise unconditionally that
+* cdkd "will report this delete as successful", which is no longer true on the
+* destroy path. It is STILL true for the deploy engine's replacement / rollback
+* deletes, which discard the return value (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)), so the message names
+* both callers rather than describing only the fixed one — a remedy of
+* "drop the record with 'cdkd state orphan'" is impossible on a path that has
+* already dropped it.
 */
 function compositeIdFormatMessage(format, logicalId, physicalId, options) {
 	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
 	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
 	if (!options?.skipping) return head;
-	return `${head}. Skipping the delete — the AWS resource is LEFT IN PLACE and cdkd will report this delete as successful, so delete it by hand (or repair the id in state.json and re-run) if it still exists. NOTE this arm is reached from cdkd destroy AND from the deploy engine's replacement / rollback deletes.`;
+	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. On 'cdkd destroy' / 'cdkd state destroy' the state record is KEPT and the run exits non-zero, so repair the id in state.json and re-run (or delete the resource by hand and drop the record with 'cdkd state orphan'). NOTE this arm is ALSO reached from cdkd deploy — the plain DELETE of a resource removed from the template (the most common one), plus the replacement and rollback deletes — all of which still DROP the record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, delete it by hand.`;
+}
+/**
+* The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
+* skip reports (issue [#1752](https://github.com/go-to-k/cdkd/issues/1752)).
+*
+* Deliberately short and IDENTICAL across the five arms: it is rendered inline
+* on the per-resource status line (`⚠ MyTable (AWS::Glue::Table) skipped
+* (malformed physicalId in state — no delete issued)`), where the full
+* remediation sentence built by {@link compositeIdFormatMessage} would not fit.
+* The full text is still emitted, as the `logger.warn` right beside it.
+*
+* A shared constant rather than five literals so the five arms cannot drift and
+* a grep for the wording finds all of them.
+*/
+const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
+/**
+* The `ResourceDeleteResult` a malformed-composite-id DELETE arm returns.
+*
+* Pairs with the `{ skipping: true }` warning: emit the warning, return this.
+* Providers call it as `return compositeIdSkipResult();` so the arm reads as
+* the deliberate skip it is rather than as the bare `return;` that made issue
+* #1752's mis-accounting possible.
+*/
+function compositeIdSkipResult() {
+	return {
+		outcome: "skipped",
+		reason: COMPOSITE_ID_SKIP_REASON
+	};
 }
 
 //#endregion
@@ -21890,7 +21931,7 @@ var EC2Provider = class {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
 			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const networkAclId = parts[0];
 		const ruleNumber = parseInt(parts[1], 10);
@@ -39028,7 +39069,7 @@ var AppSyncProvider = class {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		try {
 			await this.getClient().send(new DeleteDataSourceCommand({
@@ -39091,7 +39132,7 @@ var AppSyncProvider = class {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const [apiId, typeName, fieldName] = parts;
 		try {
@@ -39147,7 +39188,7 @@ var AppSyncProvider = class {
 		const [apiId, apiKeyId] = physicalId.split("|");
 		if (!apiId || !apiKeyId) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		try {
 			await this.getClient().send(new DeleteApiKeyCommand({
@@ -39873,7 +39914,7 @@ var GlueProvider = class {
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
 			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const target = deleteCatalogId(properties);
 		if (target.declaredButUnusable) this.logger.debug(`Glue Table ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteTable targets ${describeCatalog(target.catalogId)}.`);
@@ -52076,6 +52117,12 @@ var ECRProvider = class {
 *
 * Exported for unit-test coverage of `countProtectedResources`.
 */
+/**
+* The nested-stack resource type. A skipped row of this type means the CHILD
+* stack was not destroyed, and the record a user must repair lives in the
+* child's own state file (`<parent>~<logicalId>`) — see `skippedStateTargets`.
+*/
+const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -52179,6 +52226,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		skippedEmpty: false,
 		deletedCount: 0,
 		retainedCount: 0,
+		skippedCount: 0,
 		errorCount: 0,
 		interrupted: false
 	};
@@ -52285,6 +52333,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 	}
 	const remainingResources = { ...state.resources };
+	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
 		return {
@@ -52412,15 +52461,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const globalTimeoutMs = ctx.resourceTimeoutMs ?? 18e5;
 					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
+					let deleteResult;
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
 						let lastDeleteError;
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
-							await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
+							deleteResult = await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
 								...ctx.removeProtection === true && { removeProtection: true },
 								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-							});
+							}) ?? void 0;
 							lastDeleteError = null;
 							break;
 						} catch (retryError) {
@@ -52445,6 +52495,23 @@ async function runDestroyForStack(stackName, state, ctx) {
 						onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resource.resourceType, stackRegion, elapsedMs, "DELETE", timeoutMs)
 					});
 					renderer.removeTask(logicalId);
+					if (deleteResult?.outcome === "skipped") {
+						logger.info(`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `skipped (${deleteResult.reason})`)}`);
+						result.skippedCount++;
+						skippedStateTargets.add(resource.resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName);
+						ctx.eventRecorder?.record({
+							eventType: "RESOURCE_SKIPPED",
+							stackName,
+							operation: "DELETE",
+							logicalId,
+							resourceType: resource.resourceType,
+							...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+							...resource.physicalId && { physicalId: resource.physicalId },
+							reason: deleteResult.reason,
+							durationMs: Date.now() - resourceStartedAt
+						});
+						return;
+					}
 					logger.info(`  ${formatResourceLine("deleted", logicalId, resource.resourceType)}`);
 					result.deletedCount++;
 					ctx.eventRecorder?.record({
@@ -52513,7 +52580,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 		result.interrupted = draining;
 		await saveChain;
-		const preserveState = result.errorCount > 0 || result.interrupted;
+		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > 0;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.debug("State deleted");
@@ -52525,12 +52592,19 @@ async function runDestroyForStack(stackName, state, ctx) {
 				logger.warn(`Failed to persist remaining state after partial destroy: ${error instanceof Error ? error.message : String(error)}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
-			else logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
+			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
+			else logger.warn(`${result.skippedCount} resource(s) skipped — cdkd could not address them, so no delete was issued and they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
 		}
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
+		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
 		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors)`);
-		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
-		else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, 'cdkd state orphan ${stackName}' is the last resort: it removes the state record without deleting AWS resources.`);
+		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
+		else if (result.errorCount === 0) {
+			const targets = [...skippedStateTargets];
+			const showHint = targets.map((t) => `'cdkd state show ${t}'`).join(" / ");
+			const orphanHint = targets.map((t) => `'cdkd state orphan ${t}'`).join(" / ");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json (${showHint}) and re-run, or delete them by hand and drop the records with ${orphanHint}.`);
+		} else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, 'cdkd state orphan ${stackName}' is the last resort: it removes the state record without deleting AWS resources.`);
 	} finally {
 		process.removeListener("SIGINT", sigintHandler);
 		renderer.stop();
@@ -52749,7 +52823,7 @@ var NestedStackProvider = class {
 		}
 		const resourceCount = Object.keys(childStateData.state.resources).length;
 		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
-		await withNestedStackContext({
+		const childResult = await withNestedStackContext({
 			...ctx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
@@ -52771,6 +52845,15 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
+		if (childResult.skippedCount > 0 || childResult.interrupted) {
+			const causes = [];
+			if (childResult.skippedCount > 0) causes.push(`skipped ${childResult.skippedCount} resource(s)`);
+			if (childResult.interrupted) causes.push("was interrupted");
+			return {
+				outcome: "skipped",
+				reason: `nested stack ${childStackName} ${causes.join(" and ")}`
+			};
+		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
 		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
@@ -57689,6 +57772,7 @@ async function destroyCommand(stackArgs, options) {
 		} else throw new Error("Could not determine which stacks belong to this app. Specify stack names explicitly, use --all, or ensure --app / cdk.json is configured.");
 		const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
 		let totalErrors = 0;
+		let totalSkipped = 0;
 		let interrupted = false;
 		let stackNames;
 		if (options.all) stackNames = candidateStacks.map((s) => s.stackName);
@@ -57813,8 +57897,9 @@ async function destroyCommand(stackArgs, options) {
 					eventRecorder
 				}));
 				totalErrors += result.errorCount;
+				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
-				destroyRunResult = result.errorCount > 0 ? "FAILED" : "SUCCEEDED";
+				destroyRunResult = result.errorCount > 0 || result.skippedCount > 0 ? "FAILED" : "SUCCEEDED";
 				eventRecorder.record({
 					eventType: "RUN_FINISHED",
 					stackName,
@@ -57823,7 +57908,8 @@ async function destroyCommand(stackArgs, options) {
 						created: 0,
 						updated: 0,
 						deleted: result.deletedCount,
-						...result.errorCount > 0 && { failed: result.errorCount }
+						...result.errorCount > 0 && { failed: result.errorCount },
+						...result.skippedCount > 0 && { skipped: result.skippedCount }
 					}
 				});
 			} catch (destroyError) {
@@ -57842,6 +57928,7 @@ async function destroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
+		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
 		awsClients.destroy();
@@ -61356,6 +61443,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		logger.info(`Found ${stackNames.length} stack(s) to destroy: ${stackNames.join(", ")}`);
 		let totalErrors = 0;
+		let totalSkipped = 0;
 		let interrupted = false;
 		for (const stackName of stackNames) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
@@ -61416,6 +61504,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
 				}));
 				totalErrors += result.errorCount;
+				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
 				if (interrupted) break;
 			}
@@ -61423,6 +61512,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
+		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd state destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
 		setup.dispose();
@@ -62492,6 +62582,11 @@ function printRunList(stackName, region, runs) {
 	logger.info(gray(`\nUse 'cdkd events ${stackName} --run <runId>' to read one run's events.`));
 }
 /** Human-readable single-run event stream (in recorded order). */
+/**
+* Render one run's event stream. Exported for unit-test coverage — the
+* `counts.skipped` / `reason` rendering is the whole value of those fields
+* (issue #1752), so it needs a direct fence rather than only `--json` coverage.
+*/
 function printRunEvents(stackName, region, runId, events) {
 	const logger = getLogger();
 	logger.info(`${bold("Events for run")} ${cyan(runId)} ${gray(`(${stackName}, ${region})`)}`);
@@ -62509,8 +62604,9 @@ function printRunEvents(stackName, region, runId, events) {
 		if (e.cdkdVersion) parts.push(gray(`cdkd ${e.cdkdVersion}`));
 		if (e.result) parts.push(e.result === "SUCCEEDED" ? green(e.result) : red(e.result));
 		if (typeof e.durationMs === "number") parts.push(gray(`${e.durationMs}ms`));
-		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "")));
+		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "") + (e.counts.skipped ? ` ⚠${e.counts.skipped}` : "")));
 		logger.info(`  ${parts.join("  ")}`);
+		if (e.reason) logger.info(`      ${yellow(e.reason)}`);
 		if (e.error) {
 			const code = e.error.awsErrorCode ? ` (${e.error.awsErrorCode})` : "";
 			const reqId = e.error.requestId ? gray(` requestId=${e.error.requestId}`) : "";
@@ -62518,10 +62614,17 @@ function printRunEvents(stackName, region, runId, events) {
 		}
 	}
 }
-/** Color the event-type token by its lifecycle phase. */
+/**
+* Color the event-type token by its lifecycle phase.
+*
+* Exported for unit-test coverage (matching `destroy-runner.ts`'s
+* `PROTECTION_PROPERTY_BY_TYPE` convention) — it is pure, so testing it
+* directly beats driving it through the renderer's log output.
+*/
 function colorizeEventType(eventType) {
 	if (eventType.endsWith("FAILED")) return red(eventType);
 	if (eventType.endsWith("SUCCEEDED") || eventType === "RUN_FINISHED") return green(eventType);
+	if (eventType === "RESOURCE_SKIPPED") return yellow(eventType);
 	if (eventType.startsWith("ROLLBACK")) return yellow(eventType);
 	return cyan(eventType);
 }
@@ -65827,6 +65930,61 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
+//#endregion
+//#region src/utils/ecr-uri.ts
+/**
+* Matching the HOST half of an ECR image URI:
+* `<acct>.dkr.ecr.<region>.<urlSuffix>/`.
+*
+* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
+* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
+* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
+* silently classified a real ECR image as a user-managed one — skipping the
+* `docker login` it needs.
+*/
+const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
+/**
+* The account + region of an ECR image URI, or `undefined` when the URI is not
+* an ECR registry host for the region it names.
+*
+* Lives in `src/utils/` rather than beside its first caller because it has TWO
+* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
+* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
+* image that may carry a digest or no tag at all). Before issue #1758 they each
+* carried their own copy of the hardcoded commercial pattern, and fixing only
+* the pull path left `cdkd local run-task` broken outside the commercial
+* partition; ONE definition is what stops them drifting apart again.
+*
+* The module is deliberately free of AWS SDK imports, which is what lets
+* `ecs-task-resolver.ts` consume it without breaking the invariant that module
+* documents about itself (it resolves secrets through a separate module for
+* exactly that reason).
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const region = m[2];
+	if (m[3] !== derivePartitionAndUrlSuffix(region).urlSuffix) return void 0;
+	return {
+		accountId: m[1],
+		region
+	};
+}
+/**
+* True when the URI has the ECR HOST SHAPE but its suffix does not belong to
+* the region it names — i.e. exactly the case {@link parseEcrRegistryHost}
+* rejects for a reason the caller may want to report.
+*
+* The two rejections are worth telling apart at a call site that degrades
+* silently: a genuinely public image and a registry in a partition
+* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
+* `undefined`, and only the second is a cdkd gap rather than a user choice.
+*/
+function looksLikeEcrHostWithForeignSuffix(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	return m !== null && m[3] !== derivePartitionAndUrlSuffix(m[2]).urlSuffix;
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -66446,13 +66604,14 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). cdkd could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). cdkd local run-task v1 only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(substituted);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(substituted);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri: substituted,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
+	if (looksLikeEcrHostWithForeignSuffix(substituted)) getLogger().child("ecs-task-resolver").debug(`Image '${substituted}' has an ECR host shape but a URL suffix that does not belong to its region's partition; treating it as a public image (no docker login).`);
 	return {
 		kind: "public",
 		uri: substituted
@@ -66489,12 +66648,12 @@ function classifyResolvedImage(uri, cdkAssetContainerRepo) {
 		if (hashMatch) out.assetHash = hashMatch[1];
 		return out;
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(uri);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(uri);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -67080,50 +67239,25 @@ async function buildContainerImage$1(...args) {
 
 //#endregion
 //#region src/local/ecr-puller.ts
-/**
-* ECR pull fallback for `cdkd local invoke` / `cdkd local start-api` /
-* `cdkd local run-task`. When the image URI resolves to an ECR repo but
-* doesn't match any cdk.out asset (typical when invoking a stack
-* deployed elsewhere or sharing a centralized registry), cdkd
-* authenticates against the target registry and runs `docker pull`.
-*
-* **Cross-account / cross-region** (#455):
-*   - Same-account, same-region: fast path. No STS hop. The default
-*     credential chain is used directly for `ecr:GetAuthorizationToken`.
-*   - `ecrRoleArn` is provided: `sts:AssumeRole` is issued via the
-*     default credential chain to obtain temporary credentials for the
-*     target account. The resulting credentials authenticate the ECR
-*     client (regardless of region — the ECR client is built for the
-*     URI's region, which can differ from the caller's profile region).
-*   - Cross-account, NO `ecrRoleArn`: cdkd falls through to the
-*     default credential chain. This works when the caller has been
-*     granted cross-account `ecr:GetAuthorizationToken` +
-*     `ecr:BatchGetImage` permissions on the target repository via an
-*     IAM policy; otherwise AWS rejects the call with `AccessDenied`
-*     and the user is pointed at `--ecr-role-arn`.
-*
-* The `--no-pull` semantics (C3 in the design doc):
-*   - When NOT set: `ecrLogin` + `docker pull <uri>`.
-*   - When set: skip `docker pull`. If the image isn't in the local
-*     cache, the subsequent `docker run` will fail; we surface a clearer
-*     "image not in local cache" error here so the user knows to drop
-*     `--no-pull` or pre-pull manually.
-*/
-/** Regex matching the `<acct>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` shape. */
-const ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
+/** The URL suffix an ECR registry host uses in `region`'s partition (issue #1758). */
+function ecrUrlSuffix(region) {
+	return derivePartitionAndUrlSuffix(region).urlSuffix;
+}
 /**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
 */
 function parseEcrUri(imageUri) {
-	const m = ECR_URI_REGEX.exec(imageUri);
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const m = /^([^:]+):(.+)$/.exec(imageUri.slice(imageUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
-		accountId: m[1],
-		region: m[2],
-		repository: m[3],
-		tag: m[4]
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2]
 	};
 }
 /**
@@ -67262,7 +67396,7 @@ async function ecrLogin(client, accountId, region) {
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 	try {
 		await runDockerStreaming([
 			"login",
@@ -74474,7 +74608,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.21");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.23");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;