@go-to-k/cdkd 0.283.6 → 0.283.8

package/dist/{deploy-engine-DaEsg4mn.js → deploy-engine-D95wmKN8.js}

@@ -9850,6 +9850,40 @@ function s3BucketWebsiteUrl(bucketName, region) {
 * but a downstream refusal can still leave earlier sub-config PUTs applied —
 * the same exposure the pre-existing `applyOwnershipControls` throw has, and
 * still strictly better than a silent wrong-direction PUT.
+*
+* ## Every `onUnusable` message is a SENTENCE, and describes the READ only
+*
+* Issue #1735. Callers compose these as `${message} <their sentence>` — the
+* `.claude/rules/providers.md` per-site clause ("keep the PREVIOUS value" /
+* "SKIP the block" / "SUPPRESS the diff") is prescribed, so the appending set
+* GROWS. Two defects lived in that seam, and both are fixed HERE rather than
+* at the callers, so a future appender inherits the fix instead of repeating
+* the bug:
+*
+* 1. **Terminal punctuation.** Every message ended bare, so the composition
+*    ran two sentences together (`...template-path create The mode this
+*    update...`). Each `onUnusable` message now ends with a period. The
+*    `throw` arms deliberately do NOT — nothing composes onto those.
+* 2. **The message must not claim an OUTCOME the caller overrides.**
+*    `requireConfigString` said "Ignoring it and using the default
+*    (PROVISIONED)" while `DynamoDBTableProvider`'s clause said the compared
+*    mode (PAY_PER_REQUEST) "is kept" — both true of different things (what
+*    the HELPER returned vs what the provider SENDS), but read as one sentence
+*    the user could not tell which value reached AWS, which is the only
+*    question the warning exists to answer. The helper now describes its own
+*    READ ("This read falls back to the default (X)") and leaves the outcome
+*    entirely to the caller. For a caller that appends NOTHING the read IS the
+*    outcome, so nothing is lost there.
+*
+* `requireConfigArray` / `requireConfigObject` take (1) but NOT (2): they
+* return `undefined` and every caller SKIPS, so "Leaving this configuration
+* unapplied" is what actually happens on all of them and no caller's clause
+* contradicts it.
+*
+* Every existing assertion in this family uses `stringContaining`, so none of
+* them ever rendered the COMPOSED sentence — which is why a live run was what
+* surfaced this. `config-shape.test.ts` carries a composition block that
+* asserts the joined string directly.
 */
 /**
 * Read an optional string field out of a nested CFn config block, refusing a
@@ -9881,7 +9915,7 @@ function readConfigString(container, key, fallback, containerPath, options) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
-			options.onUnusable(`${containerPath} must be an object ${detail}. Treating the block as empty, so ${containerPath}.${key} takes its default${named} here; the same value is REFUSED on a template-path create`);
+			options.onUnusable(`${containerPath} must be an object ${detail}. Treating the block as empty, so this read of ${containerPath}.${key} falls back to its default${named}; the same value is REFUSED on a template-path create.`);
 			return fallback;
 		}
 		throw new Error(`${containerPath} must be an object ${detail}`);
@@ -9919,7 +9953,7 @@ function requireConfigString(value, fallback, path, options) {
 	}
 	const named = fallback === "" ? "" : ` (${fallback})`;
 	if (options?.onUnusable) {
-		options.onUnusable(`${refusal}. Ignoring it and using the default${named} here; the same value is REFUSED on a template-path create`);
+		options.onUnusable(`${refusal}. This read falls back to the default${named}; the same value is REFUSED on a template-path create.`);
 		return fallback;
 	}
 	throw new Error(`${refusal}. Omit the field entirely to use the default${named}`);
@@ -9949,7 +9983,7 @@ function requireConfigArray(value, path, options) {
 	if (!Array.isArray(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
-			options.onUnusable(`${path} must be an array ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create`);
+			options.onUnusable(`${path} must be an array ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
 			return;
 		}
 		throw new Error(`${path} must be an array ${detail}`);
@@ -9960,7 +9994,7 @@ function requireConfigObject(value, path, options) {
 	if (!isPlainObject$1(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
-			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create`);
+			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
 			return;
 		}
 		throw new Error(`${path} must be an object ${detail}`);
@@ -13937,7 +13971,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BA2wc324.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Tu4sDbhu.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -14621,7 +14655,7 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 * torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
-const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, tear the resource down by hand.";
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
 /**
 * Type guard to validate Lambda response payload structure
 */
@@ -20052,8 +20086,98 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
+//#endregion
+//#region src/deployment/delete-outcome.ts
+/**
+* Deploy-side consumption of {@link ResourceDeleteResult} (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)) — the twin of what
+* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`.
+*
+* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
+* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
+* means **the resource this result names was NOT destroyed and may still be
+* ALIVE**, and taught the destroy runner to report it. Every OTHER
+* `provider.delete(...)` call site — the deploy engine's template-DELETE
+* branch, its four replacement / recreate delete sites, and the five
+* `rollback-executor.ts` delete arms — discarded the value, so the same skip
+* printed as `deleted`, counted as `deleted`, and dropped the state record.
+*
+* **The module must stay a LEAF — no imports beyond the type, ever.** Same
+* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
+* engine and the rollback executor consume it, and those two already sit on a
+* dense import ring (engine -> executor -> provider registry -> every
+* provider). A helper that pulled anything else in would close it.
+*/
+/**
+* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
+* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
+* `void` return ~80 providers still use).
+*
+* A function rather than an inline `result?.outcome === 'skipped'` test at
+* ten call sites so the back-compat `void` reading lives in ONE place: the
+* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
+* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
+* you compare against nothing useful.
+*/
+function deleteSkipReason(result) {
+	if (!result || result.outcome !== "skipped") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
+}
+/**
+* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
+*
+* Deliberately says the cause is unknown rather than inventing one: the line
+* it renders on is the user's only signal that the resource survived, and a
+* fabricated cause would send them looking in the wrong place.
+*/
+const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
+/**
+* The sentence every deploy-side skip renders, in the log line AND in the
+* `Error` the sites that must FAIL the resource throw.
+*
+* Wording rules, both load-bearing:
+*
+* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
+*    no AWS call at every producer but `NestedStackProvider.delete`, so the
+*    old resource is presumed alive — which is the whole reason a replacement
+*    site cannot proceed to create its replacement beside it.
+* 2. It must NOT contain any phrase the callers' already-deleted classifiers
+*    substring-match (`does not exist` / `was not found` / `not found` /
+*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
+*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
+*    the mis-accounting this change exists to remove, and the deploy engine's
+*    DELETE branch and its update-not-supported fallback each carry such a
+*    classifier. The call sites additionally handle the skip OUTSIDE their
+*    `catch`, so a future `reason` carrying one of those phrases still cannot
+*    reach a classifier — belt and braces, because `reason` is provider text.
+*/
+function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
+	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor.ts
+/**
+* Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762): turn a
+* `{ outcome: 'skipped' }` delete into a thrown error at every rollback delete
+* arm.
+*
+* A skip means the resource was NOT deleted, so the rollback op did not
+* happen. Throwing routes it into the per-op accounting each arm already has —
+* `result.failures++` plus a `ROLLBACK_RESOURCE_FAILED` event and a kept
+* journal segment for the shared catch, or the local warn + `result.warnings++`
+* at the one arm whose delete is already best-effort. Both are correct and
+* neither needs a second code path; what is NOT correct is the pre-#1762
+* behavior, where every arm read a skip as a successful revert, dropped the
+* state record, and popped the segment.
+*/
+function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
+	const reason = deleteSkipReason(result);
+	if (reason === void 0) return;
+	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
+}
 /** The `--skip-final-snapshot` flag name cited by every refusal below. */
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 /**
@@ -20483,10 +20607,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					resourceType: op.resourceType,
 					provisionedBy: deleteProvisionedBy
 				});
-				await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, {
+				throwIfDeleteSkipped(await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, {
 					expectedRegion: ctx.region,
 					...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-				});
+				}), op.logicalId, op.physicalId, "while rolling back its CREATE");
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
 				await afterOp?.(op.logicalId);
@@ -20510,10 +20634,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				});
 				{
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)");
 				}
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
@@ -20558,10 +20682,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-						await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 							expectedRegion: ctx.region,
 							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-						});
+						}), op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
 					}
 					deletedNewFirst = true;
 					delete stateResources[op.logicalId];
@@ -20595,10 +20719,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
 					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
 					result.warnings++;
@@ -20744,10 +20868,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
 					});
-					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
+					throwIfDeleteSkipped(await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)");
 					delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -20901,7 +21025,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.6";
+	return "0.283.8";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21868,6 +21992,7 @@ var DeployEngine = class {
 					created: 0,
 					updated: 0,
 					deleted: 0,
+					deleteSkipped: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
 					outputs: this.buildDisplayOutputs(template, persistedOutputs),
@@ -21885,6 +22010,7 @@ var DeployEngine = class {
 					created: createChanges.length,
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
+					deleteSkipped: 0,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
 					durationMs: Date.now() - startTime,
 					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
@@ -21907,6 +22033,7 @@ var DeployEngine = class {
 				created: actualCounts.created,
 				updated: actualCounts.updated,
 				deleted: actualCounts.deleted,
+				deleteSkipped: actualCounts.deleteSkipped,
 				unchanged: unchangedCount,
 				durationMs,
 				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
@@ -21940,7 +22067,8 @@ var DeployEngine = class {
 			created: 0,
 			updated: 0,
 			deleted: 0,
-			skipped: 0
+			skipped: 0,
+			deleteSkipped: 0
 		};
 		const completedOperations = [];
 		const failedOperations = [];
@@ -22047,8 +22175,9 @@ var DeployEngine = class {
 						const logicalId = node.id;
 						const change = node.data;
 						const previousState = currentState.resources[logicalId] ? { ...currentState.resources[logicalId] } : void 0;
+						let deleteOutcome;
 						try {
-							await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
+							deleteOutcome = await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
@@ -22062,6 +22191,7 @@ var DeployEngine = class {
 							});
 							throw provisionError;
 						}
+						if (deleteOutcome) return;
 						completedOperations.push({
 							logicalId,
 							changeType: "DELETE",
@@ -22353,9 +22483,10 @@ var DeployEngine = class {
 			resourceType,
 			...labelRouting && { provisionedBy: labelRouting }
 		});
+		let deleteSkipped;
 		try {
 			await withResourceDeadline(async () => {
-				await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress);
+				deleteSkipped = (await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress))?.deleteSkipped;
 			}, {
 				warnAfterMs,
 				timeoutMs,
@@ -22369,6 +22500,20 @@ var DeployEngine = class {
 				},
 				onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
 			});
+			if (deleteSkipped !== void 0) {
+				this.recordEvent({
+					eventType: "RESOURCE_SKIPPED",
+					stackName,
+					operation: eventOp,
+					logicalId,
+					resourceType,
+					...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+					...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+					reason: deleteSkipped,
+					durationMs: Date.now() - resourceStartedAt
+				});
+				return { deleteSkipped };
+			}
 			this.recordEvent({
 				eventType: "RESOURCE_SUCCEEDED",
 				stackName,
@@ -22465,8 +22610,9 @@ var DeployEngine = class {
 	*/
 	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy) {
 		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+		let deleteResult;
 		try {
-			await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+			deleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 				expectedRegion: this.stackRegion,
 				forceDataDelete: this.options.forceStatefulRecreation === true,
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
@@ -22474,6 +22620,8 @@ var DeployEngine = class {
 		} catch (deleteError) {
 			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 		}
+		const replaceSkipReason = deleteSkipReason(deleteResult);
+		if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 		this.logger.info(`  ${green("✓")} Old resource deleted`);
 		this.logger.info(`  Re-creating ${logicalId}...`);
 		try {
@@ -22611,16 +22759,19 @@ var DeployEngine = class {
 						else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+							let recreateDeleteResult;
 							try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+								recreateDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 									expectedRegion: this.stackRegion,
 									forceDataDelete: this.options.forceStatefulRecreation === true,
 									...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId }
 								});
-								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
 								throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 							}
+							const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
+							if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
+							this.logger.info(`  ${green("✓")} Old resource deleted`);
 						}
 						this.logger.info(`  Creating new ${logicalId}...`);
 						createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider), logicalId, {
@@ -22668,15 +22819,22 @@ var DeployEngine = class {
 								snapshotBlockedDelete = true;
 								this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
 							}
-							if (!snapshotBlockedDelete) try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
-									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true,
-									...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
-								});
-								this.logger.info(`  ${green("✓")} Old resource deleted`);
-							} catch (deleteError) {
-								this.logger.warn(`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+							if (!snapshotBlockedDelete) {
+								let cleanupDeleteResult = void 0;
+								let cleanupDeleteFailed = false;
+								try {
+									cleanupDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+										expectedRegion: this.stackRegion,
+										forceDataDelete: this.options.forceStatefulRecreation === true,
+										...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
+									});
+								} catch (deleteError) {
+									this.logger.warn(`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+									cleanupDeleteFailed = true;
+								}
+								const cleanupSkipReason = deleteSkipReason(cleanupDeleteResult);
+								if (cleanupSkipReason !== void 0) this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, cleanupSkipReason, "while cleaning up the replaced resource")}. Delete it manually — it is no longer tracked in state.`);
+								else if (!cleanupDeleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
 							}
 						}
 					}
@@ -22719,8 +22877,9 @@ var DeployEngine = class {
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
+							let fallbackDeleteResult = void 0;
 							try {
-								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+								fallbackDeleteResult = await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
 									expectedRegion: this.stackRegion,
 									forceDataDelete: this.options.forceStatefulRecreation === true,
 									...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId }
@@ -22730,6 +22889,8 @@ var DeployEngine = class {
 								if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 								else throw deleteError;
 							}
+							const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
+							if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 							const replDecision = this.providerRegistry.getProviderFor({
 								resourceType,
 								properties: resolvedProps
@@ -22783,8 +22944,9 @@ var DeployEngine = class {
 					provisionedBy: currentResource.provisionedBy
 				}).provider;
 				this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+				let deleteResult = void 0;
 				try {
-					await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+					deleteResult = await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 						expectedRegion: this.stackRegion,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), logicalId, 3, 5e3, deleteProvider);
@@ -22793,6 +22955,16 @@ var DeployEngine = class {
 					if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
+				const deleteSkipped = deleteSkipReason(deleteResult);
+				if (deleteSkipped !== void 0) {
+					if (progress) progress.current++;
+					const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+					renderer.removeTask(logicalId);
+					this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
+					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first ('cdkd state show ${stackName}' to inspect; for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record with 'cdkd state orphan ${stackName}'.`);
+					if (counts) counts.deleteSkipped++;
+					return { deleteSkipped };
+				}
 				delete stateResources[logicalId];
 				if (counts) counts.deleted++;
 				if (progress) progress.current++;
@@ -23069,5 +23241,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveSkipPrefix as $t, green as A, LockError as An, rewriteTemplateAssetReferences as At, slowCcOperationTimeoutMs as B, SynthesisError as Bn, formatDockerLoginError as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, CdkdError as Cn, shouldRetainResource as Ct, bold as D, LocalInvokeBuildError as Dn, buildAssetRedirectMap as Dt, formatResourceLine as E, DeployCancelledError as En, WorkGraph as Et, clearOnUpdateRemoval as F, ResourceTimeoutError as Fn, parseBootstrapMarker as Ft, getAccountInfo as G, __exportAll as Gn, getDockerImageBySourceHash as Gt, isTerminationProtectionPropagationError as H, isCdkdError as Hn, runDockerForeground as Ht, ProviderRegistry as I, ResourceUpdateNotSupportedError as In, validateAssetBucketName as It, normalizeAwsTagsToCfn as J, getDefaultStateBucketName as Jt, refStateLookupFromResource as K, Synthesizer as Kt, findActionableSilentDrops as L, StackHasActiveImportsError as Ln, validateContainerRepoName as Lt, yellow as M, NestedStackChildDirectDestroyError as Mn, BOOTSTRAP_MARKER_PREFIX as Mt, IAMRoleProvider as N, PartialFailureError as Nn, ensureAssetStorage as Nt, cyan as O, LocalMigrateError as On, createAssetRedirectResolver as Ot, collectInlinePolicyNamesManagedBySiblings as P, ProvisioningError as Pn, getBootstrapMarkerKey as Pt, configBooleanRefusal as Q, resolveCaptureObservedState as Qt, findSilentDropProperties as R, StackTerminationProtectionError as Rn, buildDenyExternalAccessPolicy as Rt, extractDeploymentEventError as S, AssetError as Sn, rebuildClientForBucketRegion as St, renderStatefulReason as T, DependencyError as Tn, stringifyValue as Tt, IntrinsicFunctionResolver as U, normalizeAwsError as Un, runDockerStreaming as Ut, disableInstanceApiTermination as V, formatError as Vn, getDockerCmd as Vt, cfnRefValueFromPhysicalId as W, withErrorHandling as Wn, AssetManifestLoader as Wt, assertRegionMatch as X, resolveApp as Xt, resolveExplicitPhysicalId as Y, getLegacyStateBucketName as Yt, coerceCfnBoolean as Z, resolveAutoAssetStorage as Zt, createPreDeleteFinalSnapshot as _, resolveBucketRegion as _n, markNonRetryable as _t, DeploymentEventsStore as a, CFN_TEMPLATE_BODY_LIMIT as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, resetAwsClients as bn, LockManager as bt, replayFailedOperations as c, findLargeInlineResources as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, PARTITION_TABLE as dn, DiffCalculator as dt, resolveStateBucketWithDefault as en, readConfigString as et, computeImplicitDeleteEdges as f, canonicalizeRegion as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, clearBucketRegionCache as gn, isThrottlingError as gt, buildFinalSnapshotIdentifier as h, processStackMessages as hn, isRetryableTransientError as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as in, requireConfigString as it, red as j, MissingCdkCliError as jn, AssetModeResolver as jt, gray as k, LocalStartServiceError as kn, loadPublishableAssetManifest as kt, replayRollback as l, uploadCfnTemplate as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AssemblyReader as mn, isMarkedNonRetryable as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as nn, requireConfigArray as nt, planFailedOps as o, CFN_TEMPLATE_URL_LIMIT as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, derivePartitionAndUrlSuffix as pn, withRetry as pt, WAFv2WebACLProvider as q, synthesisStatusMessage as qt, DeployEngine as r, stateBucketExistenceConfirmed as rn, requireConfigObject as rt, planRollback as s, MIGRATE_TMP_PREFIX as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as tn, replayWarn as tt, withResourceDeadline as u, expectedOwnerParam as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AwsClients as vn, DagBuilder as vt, isStatefulRecreateTargetSync as w, ConfigError as wn, AssetPublisher as wt, makeCanonicalizePropertiesFn as x, setAwsClients as xn, S3StateBackend as xt, refusesFinalSnapshot as y, getAwsClients as yn, TemplateParser as yt, CloudControlProvider as z, StateError as zn, buildDockerImage as zt };
-//# sourceMappingURL=deploy-engine-DaEsg4mn.js.map
+export { coerceCfnBoolean as $, resolveAutoAssetStorage as $t, cyan as A, LocalMigrateError as An, createAssetRedirectResolver as At, findSilentDropProperties as B, StackTerminationProtectionError as Bn, buildDenyExternalAccessPolicy as Bt, makeCanonicalizePropertiesFn as C, setAwsClients as Cn, S3StateBackend as Ct, renderStatefulReason as D, DependencyError as Dn, stringifyValue as Dt, isStatefulRecreateTargetSync as E, ConfigError as En, AssetPublisher as Et, IAMRoleProvider as F, PartialFailureError as Fn, ensureAssetStorage as Ft, IntrinsicFunctionResolver as G, normalizeAwsError as Gn, runDockerStreaming as Gt, slowCcOperationTimeoutMs as H, SynthesisError as Hn, formatDockerLoginError as Ht, collectInlinePolicyNamesManagedBySiblings as I, ProvisioningError as In, getBootstrapMarkerKey as It, refStateLookupFromResource as J, Synthesizer as Jt, cfnRefValueFromPhysicalId as K, withErrorHandling as Kn, AssetManifestLoader as Kt, clearOnUpdateRemoval as L, ResourceTimeoutError as Ln, parseBootstrapMarker as Lt, green as M, LockError as Mn, rewriteTemplateAssetReferences as Mt, red as N, MissingCdkCliError as Nn, AssetModeResolver as Nt, formatResourceLine as O, DeployCancelledError as On, WorkGraph as Ot, yellow as P, NestedStackChildDirectDestroyError as Pn, BOOTSTRAP_MARKER_PREFIX as Pt, assertRegionMatch as Q, resolveApp as Qt, ProviderRegistry as R, ResourceUpdateNotSupportedError as Rn, validateAssetBucketName as Rt, unsupportedFinalSnapshotError as S, resetAwsClients as Sn, LockManager as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, CdkdError as Tn, shouldRetainResource as Tt, disableInstanceApiTermination as U, formatError as Un, getDockerCmd as Ut, CloudControlProvider as V, StateError as Vn, buildDockerImage as Vt, isTerminationProtectionPropagationError as W, isCdkdError as Wn, runDockerForeground as Wt, normalizeAwsTagsToCfn as X, getDefaultStateBucketName as Xt, WAFv2WebACLProvider as Y, synthesisStatusMessage as Yt, resolveExplicitPhysicalId as Z, getLegacyStateBucketName as Zt, buildFinalSnapshotIdentifier as _, processStackMessages as _n, isRetryableTransientError as _t, DeploymentEventsStore as a, stateBucketExistenceConfirmed as an, requireConfigObject as at, isFinalSnapshotError as b, AwsClients as bn, DagBuilder as bt, replayFailedOperations as c, CFN_TEMPLATE_URL_LIMIT as cn, s3BucketDomainName as ct, deleteSkipReason as d, uploadCfnTemplate as dn, s3BucketWebsiteUrl as dt, resolveCaptureObservedState as en, configBooleanRefusal as et, withResourceDeadline as f, expectedOwnerParam as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, AssemblyReader as gn, isMarkedNonRetryable as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, derivePartitionAndUrlSuffix as hn, withRetry as ht, DeploymentEventsReader as i, resolveUseCdkBootstrapAssets as in, requireConfigArray as it, gray as j, LocalStartServiceError as jn, loadPublishableAssetManifest as jt, bold as k, LocalInvokeBuildError as kn, buildAssetRedirectMap as kt, replayRollback as l, MIGRATE_TMP_PREFIX as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, canonicalizeRegion as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefault as nn, readConfigString as nt, planFailedOps as o, warnDeprecatedNoPrefixCliFlag as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, PARTITION_TABLE as pn, DiffCalculator as pt, getAccountInfo as q, __exportAll as qn, getDockerImageBySourceHash as qt, DeployEngine as r, resolveStateBucketWithDefaultAndSource as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_BODY_LIMIT as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveSkipPrefix as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, findLargeInlineResources as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, clearBucketRegionCache as vn, isThrottlingError as vt, extractDeploymentEventError as w, AssetError as wn, rebuildClientForBucketRegion as wt, refusesFinalSnapshot as x, getAwsClients as xn, TemplateParser as xt, createPreDeleteFinalSnapshot as y, resolveBucketRegion as yn, markNonRetryable as yt, findActionableSilentDrops as z, StackHasActiveImportsError as zn, validateContainerRepoName as zt };
+//# sourceMappingURL=deploy-engine-D95wmKN8.js.map