@go-to-k/cdkd 0.283.7 → 0.283.9

package/dist/{deploy-engine-CKpBSlde.js → deploy-engine-CWt7h7Nc.js}

@@ -56,219 +56,560 @@ var __exportAll = (all, no_symbols) => {
 };
 
 //#endregion
-//#region src/utils/error-handler.ts
-/**
-* Base error class for cdkd
-*/
-var CdkdError = class CdkdError extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.code = code;
-		this.cause = cause;
-		this.name = "CdkdError";
-		Object.setPrototypeOf(this, CdkdError.prototype);
-	}
-};
+//#region src/deployment/retryable-errors.ts
 /**
-* State management errors
+* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* an AWS service rejecting a call because a just-created IAM entity (role,
+* trust policy, inline policy, instance profile, principal) has not propagated
+* to that service's authorization layer yet.
+*
+* Kept as its own array — and composed back into the full transient table
+* below — so there is exactly ONE list per pattern (no parallel classifier to
+* drift). It exists because this class has a materially different RECOVERY
+* SHAPE from the other transient errors: it resolves in single-digit seconds,
+* so `withRetry` polls it on a dense sub-second schedule instead of the
+* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
+* for long resource-state transitions, and wrong here — see
+* {@link file://../deployment/retry.ts}).
+*
+* When adding a new pattern: put it here if the fix is "wait a moment and ask
+* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
+* misfiled entry only changes the retry CADENCE, never whether the error is
+* retryable at all.
 */
-var StateError = class StateError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "STATE_ERROR", cause);
-		this.name = "StateError";
-		Object.setPrototypeOf(this, StateError.prototype);
-	}
-};
+const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"is unable to assume the role",
+	"security token included in the request is invalid. (Service:",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"Invalid principal in policy",
+	"Verify in IAM that the role has adequate trust relationships",
+	"The user with name",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"is not a valid role to allow SNS"
+];
 /**
-* Lock acquisition errors
+* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
+* transient failures whose recovery window is either long (SQS's 60s same-name
+* cooldown, a resource still leaving a Pending/Creating state) or genuinely
+* load-related (throttling), where hammering AWS with dense retries is harmful
+* and exponential backoff is the correct shape.
 */
-var LockError = class LockError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCK_ERROR", cause);
-		this.name = "LockError";
-		Object.setPrototypeOf(this, LockError.prototype);
-	}
-};
+const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded",
+	"is marked disabled for mutation",
+	"There is an operation running on the Cluster",
+	"Unable to complete operation due to concurrent modification"
+];
 /**
-* Synthesis errors
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*
+* Composed from the two halves above so retryability has ONE source of truth
+* while `withRetry` can still pick a per-class backoff cadence.
 */
-var SynthesisError = class SynthesisError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "SYNTHESIS_ERROR", cause);
-		this.name = "SynthesisError";
-		Object.setPrototypeOf(this, SynthesisError.prototype);
-	}
-};
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
 /**
-* Control-flow signal: the user declined a pre-provisioning confirmation
-* prompt, so the deploy must unwind WITHOUT being reported as a failure.
-*
-* Raised from `DeployEngineOptions.onCurrentStateLoaded` (the post-lock
-* gate the `--prefix-user-supplied-names` migration check runs in). The
-* engine does not catch it — it propagates out of `deploy()` through the
-* usual `finally`, which releases the lock and stops the renderer — and the
-* deploy CLI catches it and returns quietly instead of logging an error or
-* recording a FAILED run event. Nothing has been provisioned at that point.
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
 */
-var DeployCancelledError = class DeployCancelledError extends CdkdError {
-	constructor(message = "Deployment cancelled by user") {
-		super(message, "DEPLOY_CANCELLED");
-		this.name = "DeployCancelledError";
-		Object.setPrototypeOf(this, DeployCancelledError.prototype);
-	}
-};
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
 /**
-* Asset errors
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
 */
-var AssetError = class AssetError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "ASSET_ERROR", cause);
-		this.name = "AssetError";
-		Object.setPrototypeOf(this, AssetError.prototype);
-	}
-};
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
 /**
-* Local-invoke `docker build` failures.
+* Marker for an error cdkd raised as a DELIBERATE refusal rather than as a
+* relayed AWS failure (issue [#1778](https://github.com/go-to-k/cdkd/issues/1778)).
 *
-* Surfaces the stderr captured from `docker build` so the user can
-* re-run the same command directly to debug Dockerfile syntax errors
-* or missing build context. Used by `src/local/docker-image-builder.ts`
-* (PR 5) for container Lambdas; the parallel `AssetError` covers the
-* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
-* `AssetError` so `cdkd local invoke` failures don't show up under the
-* "asset" error class.
+* Every classifier below is SUBSTRING-based, which is the right shape for
+* relaying a vendor's message and the wrong one for cdkd's own prose: a
+* refusal message is assembled from values cdkd does not control — a provider
+* `reason`, a state-borne physicalId, a template logical id — and any of them
+* can happen to contain a retryable pattern. Measured: a resource named
+* `MyDependencyViolationSub` puts `DependencyViolation` in the message, so a
+* deterministic refusal was classified transient and burned the whole backoff
+* schedule before failing exactly as it would have immediately. Keeping the
+* offending values OUT of the message narrows that surface but cannot close
+* it, because a message with no identifiers at all is not diagnosable.
+*
+* A marker inverts the burden: the raiser STATES that the error is terminal,
+* so no wording can make it retryable. Deliberately a `Symbol.for` key —
+* global-registry symbols survive a duplicated module instance (dual
+* bundling), where a module-local symbol would silently stop matching — and
+* non-enumerable, so it cannot leak into a serialized error payload.
 */
-var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
-		this.name = "LocalInvokeBuildError";
-		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
-	}
-};
+const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 /**
-* Resource provisioning errors
+* Mark a cdkd-authored refusal as terminal and return it, for
+* `throw markNonRetryable(new ProvisioningError(...))`.
+*
+* Reach for it when the error means "this cannot succeed on a retry" as a
+* matter of cdkd's own logic — NOT for a relayed AWS failure, whose
+* retryability is the classifiers' business.
+*
+* The known live instance this JSDoc used to flag as uncovered —
+* `ResourceUpdateNotSupportedError` (`src/utils/error-handler.ts`), which
+* interpolates the logical id and is thrown by ~20 providers from inside the
+* retried `update()` in `deploy-engine.ts` — IS covered as of issue
+* [#1838](https://github.com/go-to-k/cdkd/issues/1838): it marks itself in its
+* CONSTRUCTOR, so every construction is terminal and no provider throw site
+* has to remember. That is the shape to prefer for a whole error CLASS that is
+* always a refusal; mark at the `throw` (as the SNS abort below does) only
+* when the class is retryable in general and this one raising of it is not.
 */
-var ProvisioningError = class ProvisioningError extends CdkdError {
-	resourceType;
-	logicalId;
-	physicalId;
-	constructor(message, resourceType, logicalId, physicalId, cause) {
-		super(message, "PROVISIONING_ERROR", cause);
-		this.resourceType = resourceType;
-		this.logicalId = logicalId;
-		this.physicalId = physicalId;
-		this.name = "ProvisioningError";
-		Object.setPrototypeOf(this, ProvisioningError.prototype);
-	}
-};
+function markNonRetryable(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
 /**
-* Resource provisioning timeout errors (per-resource wall-clock deadline).
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markNonRetryable}.
 *
-* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
-* operation exceeds the user-configured `--resource-timeout`. The deploy
-* engine catches this, wraps it in {@link ProvisioningError}, and lets the
-* existing failure path (interrupt siblings → pre-rollback save → rollback
-* unless `--no-rollback`) take over.
+* The chain walk mirrors {@link isThrottlingError}'s: cdkd wraps errors, so a
+* marked refusal can end up one or more links deep, and a marker that stopped
+* counting after a single wrap would be a fence that quietly falls open.
 *
-* The message intentionally names the resource, type, region, elapsed time
-* and operation, plus how to override the default. Long-running providers
-* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
-* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
-* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
-* specific non-self-reporting type or shorten a self-reported one.
-*/
-var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
-	logicalId;
-	resourceType;
-	region;
-	elapsedMs;
-	operation;
-	timeoutMs;
-	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
-		const elapsedLabel = formatDuration(elapsedMs);
-		const timeoutLabel = formatDuration(timeoutMs);
-		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
-slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
-underlying provider activity.`, "RESOURCE_TIMEOUT");
-		this.logicalId = logicalId;
-		this.resourceType = resourceType;
-		this.region = region;
-		this.elapsedMs = elapsedMs;
-		this.operation = operation;
-		this.timeoutMs = timeoutMs;
-		this.name = "ResourceTimeoutError";
-		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+* That reach is DIRECTIONAL, and the upward direction is a hazard worth
+* stating. Downward — a marked refusal wrapped by an outer error — is the
+* intended case and stays terminal. UPWARD is the inverse: wrapping a marked
+* refusal as the `cause` of a genuinely RETRYABLE outer error
+* (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
+* too, because this walk finds the marker on the cause. Unconstructible today
+* (`ProvisioningError` is built with no `cause` at the one marking site), and
+* the failure is fail-fast rather than silent, but a future wrapper that
+* carries a marked cause into a transient error would stop retrying something
+* that should retry. Strip or re-raise the cause there rather than nesting it.
+*/
+function isMarkedNonRetryable(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[NON_RETRYABLE_MARKER] === true) return true;
+		}
+		current = current.cause;
 	}
-};
+	return false;
+}
 /**
-* Format a duration in milliseconds as a short human-readable label
-* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
-* error message stays compact.
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
+*
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed.
 */
-function formatDuration(ms) {
-	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
-	const totalMinutes = Math.round(ms / 6e4);
-	if (totalMinutes < 60) return `${totalMinutes}m`;
-	const hours = Math.floor(totalMinutes / 60);
-	const minutes = totalMinutes % 60;
-	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
 }
 /**
-* A DELIBERATE refusal to resolve an intrinsic function, as opposed to a
-* "the referenced thing does not exist" miss (issue
-* [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
+* Determine whether an AWS error should be retried.
 *
-* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
-* resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
-* the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
-* long-standing, deliberate behavior for a genuinely unknown variable — but a
-* bare `catch` around it also swallowed every REFUSAL the resolver raises on
-* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
-* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
-* that hard-fails when the reference sits in a resource property silently
-* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
-* IDENTICAL reference was written inside an `Fn::Sub`.
+* Checks (in order):
+*   0. {@link isMarkedNonRetryable} — a cdkd-authored refusal is terminal by
+*      declaration, ahead of every message / name heuristic below. FIRST on
+*      purpose: the marker states the error cannot succeed on a retry, so
+*      nothing a later check reads out of the message can overturn it.
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*/
+function isRetryableTransientError(error, message) {
+	if (isMarkedNonRetryable(error)) return false;
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
+* True when the message is a just-created-IAM-entity propagation rejection
+* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
 *
-* Throwing this class rather than a bare `Error` is what lets that catch
-* re-raise a refusal (carrying its own message and remedy) while leaving the
-* not-found path on warn-and-keep. Nothing else branches on it.
+* This does NOT decide retryability — every pattern it matches is already in
+* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
+* `withRetry` polls this class densely (sub-second initial delay, low cap)
+* because IAM propagation resolves in single-digit seconds, whereas the
+* generic exponential schedule is tuned for throttling and long resource-state
+* transitions.
+*
+* Deliberately message-only (no error-object inspection): the propagation
+* signal is always carried in the vendor's message text, and cdkd wraps the
+* original error in a `ProvisioningError` that preserves it.
 */
-var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+function isIamPropagationError(message) {
+	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
+* Match the "already exists" name-collision signature raised when a create
+* targets a physical name still held by another resource (or by the same
+* name's not-yet-released tombstone after an async delete).
+*
+* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
+* collision is only worth retrying at the specific re-create sites that just
+* deleted the old holder (the deploy engine's --replace delete-first fallback
+* and the rollback executor's reverse-replacement) — everywhere else it is a
+* genuine conflict that must fail fast. Shared by those sites' collision
+* detection + retry filters so a signature extension lands in one place.
+*
+* The optional `s` is load-bearing, not defensive spelling (issue #1625):
+* Lambda's `CreateFunction` raises `ResourceConflictException: Function
+* already exist: <name>` — SINGULAR — so the `already exists` form missed it
+* entirely and NO Lambda function could take the collision path. The
+* consequence was not a cosmetic message: a property-driven replacement of a
+* Lambda (dropping `DurableConfig`, changing `TenancyConfig`) create-firsts
+* into its own still-live name, the raw `ResourceConflictException` escaped
+* instead of the actionable `NAMED_REPLACEMENT_COLLISION` error, and
+* `cdkd deploy --replace`'s delete-first fallback never fired — so the
+* replacement was unperformable by any flag. Verified against real AWS
+* (us-east-1, 2026-08-12) by creating one function name twice.
+*
+* Two fences keep the widened arm from crediting a NON-collision, which
+* matters because the sites that consult it react DESTRUCTIVELY (the
+* `--replace` delete-first fallback deletes the old resource):
+*  - `\b` after `exists?` rejects a participle ("already existed as a draft");
+*  - the lookbehind rejects a NEGATED or MODAL phrase — "the bucket does NOT
+*    already exist", "the destination bucket MUST already exist" — which the
+*    bare pattern matched. The modal form is the one that bites: a create
+*    rejected for a missing PREREQUISITE would be reported to the user as a
+*    name collision pointing at `--replace`, and following that advice
+*    deletes the live old resource before the re-create fails again for the
+*    same reason, leaving it absent from AWS with state still recording it.
+* The error-CODE arm stays exact (`AlreadyExists`): the singular
+* `AlreadyExist` is not an AWS code spelling, and loosening it would match
+* inside unrelated identifiers.
+*
+* Classification stays MESSAGE-based rather than moving to the exception
+* NAME, and that is load-bearing here rather than inherited: Lambda raises
+* `ResourceConflictException` for a function in a PENDING state too (see
+* `lambda-function-provider.ts`), so keying on the name would classify a
+* transient state conflict as a collision and delete a live function under
+* `--replace`.
+*/
+function isNameCollisionError(message) {
+	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
+}
+/**
+* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
+* a queue with the SAME name inside ~60s fails with
+* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
+* after deleting a queue before you can create another with the same name").
+*
+* The generic transient table above already carries 'wait 60 seconds' for
+* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
+* sites (the deploy engine's --replace delete-first fallback and the rollback
+* executor's reverse-replacement) override the retry filter with
+* {@link isNameCollisionError}, which this signature does NOT match — so a
+* replacement revert used to fail fast mid-flight with the resource absent
+* from both AWS and state (issue #1206). Those sites now OR this matcher into
+* their retry filter, with a schedule long enough to cover the 60s window.
+*
+* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
+* create-first site must NOT be treated as a collision (deleting the new
+* resource would not release the cooldown on the old name).
+*/
+function isNameCooldownError(message) {
+	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
+}
+/**
+* Retry filter for the delete-then-re-create sites: the old name holder was
+* just deleted, so both the late name release ("already exists" from an async
+* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
+* schedule that covers the full cooldown window (maxRetries 8, delays
+* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
+*/
+function isRecreateRetryableError(message) {
+	return isNameCollisionError(message) || isNameCooldownError(message);
+}
+
+//#endregion
+//#region src/utils/error-handler.ts
+/**
+* Base error class for cdkd
+*/
+var CdkdError = class CdkdError extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "CdkdError";
+		Object.setPrototypeOf(this, CdkdError.prototype);
+	}
+};
+/**
+* State management errors
+*/
+var StateError = class StateError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
-		this.name = "IntrinsicResolutionRefusalError";
-		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+		super(message, "STATE_ERROR", cause);
+		this.name = "StateError";
+		Object.setPrototypeOf(this, StateError.prototype);
 	}
 };
 /**
-* Dependency resolution errors
+* Lock acquisition errors
 */
-var DependencyError = class DependencyError extends CdkdError {
+var LockError = class LockError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "DEPENDENCY_ERROR", cause);
-		this.name = "DependencyError";
-		Object.setPrototypeOf(this, DependencyError.prototype);
+		super(message, "LOCK_ERROR", cause);
+		this.name = "LockError";
+		Object.setPrototypeOf(this, LockError.prototype);
 	}
 };
 /**
-* Configuration errors
+* Synthesis errors
 */
-var ConfigError = class ConfigError extends CdkdError {
+var SynthesisError = class SynthesisError extends CdkdError {
 	constructor(message, cause) {
-		super(message, "CONFIG_ERROR", cause);
-		this.name = "ConfigError";
-		Object.setPrototypeOf(this, ConfigError.prototype);
+		super(message, "SYNTHESIS_ERROR", cause);
+		this.name = "SynthesisError";
+		Object.setPrototypeOf(this, SynthesisError.prototype);
 	}
 };
 /**
-* Signals a partial-failure outcome that should map to exit code 2 (not 1).
+* Control-flow signal: the user declined a pre-provisioning confirmation
+* prompt, so the deploy must unwind WITHOUT being reported as a failure.
 *
-* Used by `cdkd destroy` and `cdkd state destroy` when one or more
-* per-resource deletes failed but the overall command finished its work
-* (state.json is preserved, the rest of the stack was deleted, and the
-* user can re-run to clean up the remaining resources).
+* Raised from `DeployEngineOptions.onCurrentStateLoaded` (the post-lock
+* gate the `--prefix-user-supplied-names` migration check runs in). The
+* engine does not catch it — it propagates out of `deploy()` through the
+* usual `finally`, which releases the lock and stops the renderer — and the
+* deploy CLI catches it and returns quietly instead of logging an error or
+* recording a FAILED run event. Nothing has been provisioned at that point.
+*/
+var DeployCancelledError = class DeployCancelledError extends CdkdError {
+	constructor(message = "Deployment cancelled by user") {
+		super(message, "DEPLOY_CANCELLED");
+		this.name = "DeployCancelledError";
+		Object.setPrototypeOf(this, DeployCancelledError.prototype);
+	}
+};
+/**
+* Asset errors
+*/
+var AssetError = class AssetError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "ASSET_ERROR", cause);
+		this.name = "AssetError";
+		Object.setPrototypeOf(this, AssetError.prototype);
+	}
+};
+/**
+* Local-invoke `docker build` failures.
+*
+* Surfaces the stderr captured from `docker build` so the user can
+* re-run the same command directly to debug Dockerfile syntax errors
+* or missing build context. Used by `src/local/docker-image-builder.ts`
+* (PR 5) for container Lambdas; the parallel `AssetError` covers the
+* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
+* `AssetError` so `cdkd local invoke` failures don't show up under the
+* "asset" error class.
+*/
+var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+		this.name = "LocalInvokeBuildError";
+		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
+	}
+};
+/**
+* Resource provisioning errors
+*/
+var ProvisioningError = class ProvisioningError extends CdkdError {
+	resourceType;
+	logicalId;
+	physicalId;
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, "PROVISIONING_ERROR", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.physicalId = physicalId;
+		this.name = "ProvisioningError";
+		Object.setPrototypeOf(this, ProvisioningError.prototype);
+	}
+};
+/**
+* Resource provisioning timeout errors (per-resource wall-clock deadline).
+*
+* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
+* operation exceeds the user-configured `--resource-timeout`. The deploy
+* engine catches this, wraps it in {@link ProvisioningError}, and lets the
+* existing failure path (interrupt siblings → pre-rollback save → rollback
+* unless `--no-rollback`) take over.
+*
+* The message intentionally names the resource, type, region, elapsed time
+* and operation, plus how to override the default. Long-running providers
+* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
+* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
+* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
+* specific non-self-reporting type or shorten a self-reported one.
+*/
+var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
+	logicalId;
+	resourceType;
+	region;
+	elapsedMs;
+	operation;
+	timeoutMs;
+	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+		const elapsedLabel = formatDuration(elapsedMs);
+		const timeoutLabel = formatDuration(timeoutMs);
+		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
+slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
+underlying provider activity.`, "RESOURCE_TIMEOUT");
+		this.logicalId = logicalId;
+		this.resourceType = resourceType;
+		this.region = region;
+		this.elapsedMs = elapsedMs;
+		this.operation = operation;
+		this.timeoutMs = timeoutMs;
+		this.name = "ResourceTimeoutError";
+		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+	}
+};
+/**
+* Format a duration in milliseconds as a short human-readable label
+* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
+* error message stays compact.
+*/
+function formatDuration(ms) {
+	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+	const totalMinutes = Math.round(ms / 6e4);
+	if (totalMinutes < 60) return `${totalMinutes}m`;
+	const hours = Math.floor(totalMinutes / 60);
+	const minutes = totalMinutes % 60;
+	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
+/**
+* A DELIBERATE refusal to resolve an intrinsic function, as opposed to a
+* "the referenced thing does not exist" miss (issue
+* [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
+*
+* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
+* resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
+* the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
+* long-standing, deliberate behavior for a genuinely unknown variable — but a
+* bare `catch` around it also swallowed every REFUSAL the resolver raises on
+* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
+* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
+* that hard-fails when the reference sits in a resource property silently
+* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
+* IDENTICAL reference was written inside an `Fn::Sub`.
+*
+* Throwing this class rather than a bare `Error` is what lets that catch
+* re-raise a refusal (carrying its own message and remedy) while leaving the
+* not-found path on warn-and-keep. Nothing else branches on it.
+*/
+var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
+		this.name = "IntrinsicResolutionRefusalError";
+		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+	}
+};
+/**
+* Dependency resolution errors
+*/
+var DependencyError = class DependencyError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "DEPENDENCY_ERROR", cause);
+		this.name = "DependencyError";
+		Object.setPrototypeOf(this, DependencyError.prototype);
+	}
+};
+/**
+* Configuration errors
+*/
+var ConfigError = class ConfigError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "CONFIG_ERROR", cause);
+		this.name = "ConfigError";
+		Object.setPrototypeOf(this, ConfigError.prototype);
+	}
+};
+/**
+* Signals a partial-failure outcome that should map to exit code 2 (not 1).
+*
+* Used by `cdkd destroy` and `cdkd state destroy` when one or more
+* per-resource deletes failed but the overall command finished its work
+* (state.json is preserved, the rest of the stack was deleted, and the
+* user can re-run to clean up the remaining resources).
 *
 * Exit code conventions:
 *   - 0: command completed successfully, no resources left in error state.
@@ -310,6 +651,27 @@ var PartialFailureError = class PartialFailureError extends CdkdError {
 * success rather than fatal — the rest of the drifted resources still
 * had their `update` invoked, and the user has a clear next step printed
 * for the unsupported one.
+*
+* **Marked non-retryable in the constructor** (issue
+* [#1838](https://github.com/go-to-k/cdkd/issues/1838)). This is a
+* deterministic, cdkd-authored refusal — the deploy engine matches it BY
+* CLASS to choose the `--replace` DELETE+CREATE fallback, and `cdkd drift
+* --revert` reports it as its own per-resource outcome — so it can never
+* succeed on a retry, whatever its message happens to say. That last clause
+* is the whole point: the message interpolates the resource's LOGICAL ID,
+* and the retry classifiers match by SUBSTRING, so a perfectly ordinary
+* composite CDK id like `MyDependencyViolationSub` made
+* `isRetryableTransientError` return true (`DependencyViolation` is the only
+* whitespace-free entry in `RETRYABLE_ERROR_MESSAGE_PATTERNS`) and burned the
+* full generic schedule — 8 retries, ~47s of pure sleep — on a path that was
+* never going to succeed, before the fallback the error exists to trigger was
+* even reached.
+*
+* Marking in the CONSTRUCTOR rather than at each `throw` is deliberate: ~20
+* providers raise this from inside the `update()` call `deploy-engine.ts`
+* wraps in `withRetry` (plus `drift.ts`'s `--revert` update), and a per-site
+* marker is one forgotten call away from re-opening the hole for exactly one
+* provider.
 */
 var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError extends CdkdError {
 	exitCode = 2;
@@ -330,6 +692,7 @@ var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError exte
 		this.suggestion = suggestion;
 		this.name = "ResourceUpdateNotSupportedError";
 		Object.setPrototypeOf(this, ResourceUpdateNotSupportedError.prototype);
+		markNonRetryable(this);
 	}
 };
 /**
@@ -8002,458 +8365,118 @@ var ReplacementRulesRegistry = class {
 			updateableProperties: /* @__PURE__ */ new Set([
 				"ComparisonOperator",
 				"EvaluationPeriods",
-				"DatapointsToAlarm",
-				"Threshold",
-				"TreatMissingData",
-				"MetricName",
-				"Namespace",
-				"Period",
-				"Statistic",
-				"ExtendedStatistic",
-				"Dimensions",
-				"Metrics",
-				"AlarmDescription",
-				"ActionsEnabled",
-				"AlarmActions",
-				"OKActions",
-				"InsufficientDataActions",
-				"Unit",
-				"EvaluateLowSampleCountPercentile",
-				"ThresholdMetricId",
-				"Tags"
-			])
-		});
-		this.rules.set("AWS::ApiGateway::RestApi", {
-			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
-			updateableProperties: /* @__PURE__ */ new Set([
-				"Description",
-				"Policy",
-				"EndpointConfiguration",
-				"BinaryMediaTypes",
-				"MinimumCompressionSize",
-				"Tags"
-			])
-		});
-		this.rules.set("AWS::AppSync::GraphQLApi", {
-			replacementProperties: /* @__PURE__ */ new Set(["ApiType", "Visibility"]),
-			updateableProperties: /* @__PURE__ */ new Set([
-				"AuthenticationType",
-				"LogConfig",
-				"XrayEnabled",
-				"Tags",
-				"UserPoolConfig",
-				"OpenIDConnectConfig",
-				"LambdaAuthorizerConfig",
-				"AdditionalAuthenticationProviders",
-				"EnhancedMetricsConfig",
-				"EnvironmentVariables",
-				"IntrospectionConfig",
-				"QueryDepthLimit",
-				"ResolverCountLimit",
-				"OwnerContact",
-				"MergedApiExecutionRoleArn"
-			])
-		});
-		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: /* @__PURE__ */ new Set([
-			"DBProxyName",
-			"EngineFamily",
-			"VpcSubnetIds"
-		]) });
-		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: /* @__PURE__ */ new Set([
-			"DBProxyName",
-			"DBProxyEndpointName",
-			"VpcSubnetIds",
-			"TargetRole"
-		]) });
-		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
-		this.rules.set("AWS::EC2::Subnet", {
-			replacementProperties: /* @__PURE__ */ new Set([
-				"VpcId",
-				"CidrBlock",
-				"AvailabilityZone"
-			]),
-			updateableProperties: /* @__PURE__ */ new Set(["MapPublicIpOnLaunch", "Tags"])
-		});
-		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set([
-			"EbsOptimized",
-			"AvailabilityZone",
-			"ImageId",
-			"SubnetId",
-			"KeyName",
-			"NetworkInterfaces"
-		]) });
-		this.rules.set("AWS::EC2::Volume", {
-			replacementProperties: /* @__PURE__ */ new Set([
-				"AvailabilityZone",
-				"AvailabilityZoneId",
-				"Encrypted",
-				"KmsKeyId",
-				"OutpostArn",
-				"SnapshotId"
-			]),
-			updateableProperties: /* @__PURE__ */ new Set([
-				"AutoEnableIO",
-				"Iops",
-				"Size",
-				"Throughput",
-				"VolumeType",
-				"Tags"
-			])
-		});
-		this.rules.set("AWS::ECS::TaskDefinition", { replacementProperties: /* @__PURE__ */ new Set([
-			"Family",
-			"ContainerDefinitions",
-			"Cpu",
-			"Memory",
-			"NetworkMode",
-			"RequiresCompatibilities",
-			"ExecutionRoleArn",
-			"TaskRoleArn",
-			"Volumes"
-		]) });
-		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
-	}
-};
-
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* The **IAM-propagation** subset of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
-* an AWS service rejecting a call because a just-created IAM entity (role,
-* trust policy, inline policy, instance profile, principal) has not propagated
-* to that service's authorization layer yet.
-*
-* Kept as its own array — and composed back into the full transient table
-* below — so there is exactly ONE list per pattern (no parallel classifier to
-* drift). It exists because this class has a materially different RECOVERY
-* SHAPE from the other transient errors: it resolves in single-digit seconds,
-* so `withRetry` polls it on a dense sub-second schedule instead of the
-* generic 1s/2s/4s/8s exponential backoff (which is right for throttling and
-* for long resource-state transitions, and wrong here — see
-* {@link file://../deployment/retry.ts}).
-*
-* When adding a new pattern: put it here if the fix is "wait a moment and ask
-* IAM again", and in `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS` otherwise. A
-* misfiled entry only changes the retry CADENCE, never whether the error is
-* retryable at all.
-*/
-const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"is unable to assume the role",
-	"security token included in the request is invalid. (Service:",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"Invalid principal in policy",
-	"Verify in IAM that the role has adequate trust relationships",
-	"The user with name",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"is not a valid role to allow SNS"
-];
-/**
-* The NON-IAM-propagation half of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}:
-* transient failures whose recovery window is either long (SQS's 60s same-name
-* cooldown, a resource still leaving a Pending/Creating state) or genuinely
-* load-related (throttling), where hammering AWS with dense retries is harmful
-* and exponential backoff is the correct shape.
-*/
-const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded",
-	"is marked disabled for mutation",
-	"There is an operation running on the Cluster",
-	"Unable to complete operation due to concurrent modification"
-];
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*
-* Composed from the two halves above so retryability has ONE source of truth
-* while `withRetry` can still pick a per-class backoff cadence.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS, ...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Marker for an error cdkd raised as a DELIBERATE refusal rather than as a
-* relayed AWS failure (issue [#1778](https://github.com/go-to-k/cdkd/issues/1778)).
-*
-* Every classifier below is SUBSTRING-based, which is the right shape for
-* relaying a vendor's message and the wrong one for cdkd's own prose: a
-* refusal message is assembled from values cdkd does not control — a provider
-* `reason`, a state-borne physicalId, a template logical id — and any of them
-* can happen to contain a retryable pattern. Measured: a resource named
-* `MyDependencyViolationSub` puts `DependencyViolation` in the message, so a
-* deterministic refusal was classified transient and burned the whole backoff
-* schedule before failing exactly as it would have immediately. Keeping the
-* offending values OUT of the message narrows that surface but cannot close
-* it, because a message with no identifiers at all is not diagnosable.
-*
-* A marker inverts the burden: the raiser STATES that the error is terminal,
-* so no wording can make it retryable. Deliberately a `Symbol.for` key —
-* global-registry symbols survive a duplicated module instance (dual
-* bundling), where a module-local symbol would silently stop matching — and
-* non-enumerable, so it cannot leak into a serialized error payload.
-*/
-const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
-/**
-* Mark a cdkd-authored refusal as terminal and return it, for
-* `throw markNonRetryable(new ProvisioningError(...))`.
-*
-* Reach for it when the error means "this cannot succeed on a retry" as a
-* matter of cdkd's own logic — NOT for a relayed AWS failure, whose
-* retryability is the classifiers' business.
-*
-* KNOWN LIVE INSTANCE NOT YET COVERED: `ResourceUpdateNotSupportedError`
-* (`src/utils/error-handler.ts`) interpolates the logical id and is thrown by
-* ~20 providers from inside the retried `update()` in `deploy-engine.ts`, so a
-* stack with a resource named e.g. `MyDependencyViolationSub` burns the full
-* ~47s backoff schedule before the `--replace` fallback is even reached. That
-* is a LIVE occurrence of the class this marker exists for, unlike the
-* latent-today SNS abort that motivated it. Marking it belongs in that error's
-* constructor, in a file this change does not own; tracked separately.
-*/
-function markNonRetryable(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-/**
-* True when the error, or anything in its bounded `.cause` chain, was marked
-* by {@link markNonRetryable}.
-*
-* The chain walk mirrors {@link isThrottlingError}'s: cdkd wraps errors, so a
-* marked refusal can end up one or more links deep, and a marker that stopped
-* counting after a single wrap would be a fence that quietly falls open.
-*
-* That reach is DIRECTIONAL, and the upward direction is a hazard worth
-* stating. Downward — a marked refusal wrapped by an outer error — is the
-* intended case and stays terminal. UPWARD is the inverse: wrapping a marked
-* refusal as the `cause` of a genuinely RETRYABLE outer error
-* (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
-* too, because this walk finds the marker on the cause. Unconstructible today
-* (`ProvisioningError` is built with no `cause` at the one marking site), and
-* the failure is fail-fast rather than silent, but a future wrapper that
-* carries a marked cause into a transient error would stop retrying something
-* that should retry. Strip or re-raise the cause there rather than nesting it.
-*/
-function isMarkedNonRetryable(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		if (typeof current === "object" || typeof current === "function") {
-			if (current[NON_RETRYABLE_MARKER] === true) return true;
-		}
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
+				"DatapointsToAlarm",
+				"Threshold",
+				"TreatMissingData",
+				"MetricName",
+				"Namespace",
+				"Period",
+				"Statistic",
+				"ExtendedStatistic",
+				"Dimensions",
+				"Metrics",
+				"AlarmDescription",
+				"ActionsEnabled",
+				"AlarmActions",
+				"OKActions",
+				"InsufficientDataActions",
+				"Unit",
+				"EvaluateLowSampleCountPercentile",
+				"ThresholdMetricId",
+				"Tags"
+			])
+		});
+		this.rules.set("AWS::ApiGateway::RestApi", {
+			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
+			updateableProperties: /* @__PURE__ */ new Set([
+				"Description",
+				"Policy",
+				"EndpointConfiguration",
+				"BinaryMediaTypes",
+				"MinimumCompressionSize",
+				"Tags"
+			])
+		});
+		this.rules.set("AWS::AppSync::GraphQLApi", {
+			replacementProperties: /* @__PURE__ */ new Set(["ApiType", "Visibility"]),
+			updateableProperties: /* @__PURE__ */ new Set([
+				"AuthenticationType",
+				"LogConfig",
+				"XrayEnabled",
+				"Tags",
+				"UserPoolConfig",
+				"OpenIDConnectConfig",
+				"LambdaAuthorizerConfig",
+				"AdditionalAuthenticationProviders",
+				"EnhancedMetricsConfig",
+				"EnvironmentVariables",
+				"IntrospectionConfig",
+				"QueryDepthLimit",
+				"ResolverCountLimit",
+				"OwnerContact",
+				"MergedApiExecutionRoleArn"
+			])
+		});
+		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: /* @__PURE__ */ new Set([
+			"DBProxyName",
+			"EngineFamily",
+			"VpcSubnetIds"
+		]) });
+		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: /* @__PURE__ */ new Set([
+			"DBProxyName",
+			"DBProxyEndpointName",
+			"VpcSubnetIds",
+			"TargetRole"
+		]) });
+		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
+		this.rules.set("AWS::EC2::Subnet", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"VpcId",
+				"CidrBlock",
+				"AvailabilityZone"
+			]),
+			updateableProperties: /* @__PURE__ */ new Set(["MapPublicIpOnLaunch", "Tags"])
+		});
+		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set([
+			"EbsOptimized",
+			"AvailabilityZone",
+			"ImageId",
+			"SubnetId",
+			"KeyName",
+			"NetworkInterfaces"
+		]) });
+		this.rules.set("AWS::EC2::Volume", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"AvailabilityZone",
+				"AvailabilityZoneId",
+				"Encrypted",
+				"KmsKeyId",
+				"OutpostArn",
+				"SnapshotId"
+			]),
+			updateableProperties: /* @__PURE__ */ new Set([
+				"AutoEnableIO",
+				"Iops",
+				"Size",
+				"Throughput",
+				"VolumeType",
+				"Tags"
+			])
+		});
+		this.rules.set("AWS::ECS::TaskDefinition", { replacementProperties: /* @__PURE__ */ new Set([
+			"Family",
+			"ContainerDefinitions",
+			"Cpu",
+			"Memory",
+			"NetworkMode",
+			"RequiresCompatibilities",
+			"ExecutionRoleArn",
+			"TaskRoleArn",
+			"Volumes"
+		]) });
+		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
 	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   0. {@link isMarkedNonRetryable} — a cdkd-authored refusal is terminal by
-*      declaration, ahead of every message / name heuristic below. FIRST on
-*      purpose: the marker states the error cannot succeed on a retry, so
-*      nothing a later check reads out of the message can overturn it.
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isMarkedNonRetryable(error)) return false;
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-/**
-* True when the message is a just-created-IAM-entity propagation rejection
-* ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
-*
-* This does NOT decide retryability — every pattern it matches is already in
-* {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}. It only selects the retry CADENCE:
-* `withRetry` polls this class densely (sub-second initial delay, low cap)
-* because IAM propagation resolves in single-digit seconds, whereas the
-* generic exponential schedule is tuned for throttling and long resource-state
-* transitions.
-*
-* Deliberately message-only (no error-object inspection): the propagation
-* signal is always carried in the vendor's message text, and cdkd wraps the
-* original error in a `ProvisioningError` that preserves it.
-*/
-function isIamPropagationError(message) {
-	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-/**
-* Match the "already exists" name-collision signature raised when a create
-* targets a physical name still held by another resource (or by the same
-* name's not-yet-released tombstone after an async delete).
-*
-* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
-* collision is only worth retrying at the specific re-create sites that just
-* deleted the old holder (the deploy engine's --replace delete-first fallback
-* and the rollback executor's reverse-replacement) — everywhere else it is a
-* genuine conflict that must fail fast. Shared by those sites' collision
-* detection + retry filters so a signature extension lands in one place.
-*
-* The optional `s` is load-bearing, not defensive spelling (issue #1625):
-* Lambda's `CreateFunction` raises `ResourceConflictException: Function
-* already exist: <name>` — SINGULAR — so the `already exists` form missed it
-* entirely and NO Lambda function could take the collision path. The
-* consequence was not a cosmetic message: a property-driven replacement of a
-* Lambda (dropping `DurableConfig`, changing `TenancyConfig`) create-firsts
-* into its own still-live name, the raw `ResourceConflictException` escaped
-* instead of the actionable `NAMED_REPLACEMENT_COLLISION` error, and
-* `cdkd deploy --replace`'s delete-first fallback never fired — so the
-* replacement was unperformable by any flag. Verified against real AWS
-* (us-east-1, 2026-08-12) by creating one function name twice.
-*
-* Two fences keep the widened arm from crediting a NON-collision, which
-* matters because the sites that consult it react DESTRUCTIVELY (the
-* `--replace` delete-first fallback deletes the old resource):
-*  - `\b` after `exists?` rejects a participle ("already existed as a draft");
-*  - the lookbehind rejects a NEGATED or MODAL phrase — "the bucket does NOT
-*    already exist", "the destination bucket MUST already exist" — which the
-*    bare pattern matched. The modal form is the one that bites: a create
-*    rejected for a missing PREREQUISITE would be reported to the user as a
-*    name collision pointing at `--replace`, and following that advice
-*    deletes the live old resource before the re-create fails again for the
-*    same reason, leaving it absent from AWS with state still recording it.
-* The error-CODE arm stays exact (`AlreadyExists`): the singular
-* `AlreadyExist` is not an AWS code spelling, and loosening it would match
-* inside unrelated identifiers.
-*
-* Classification stays MESSAGE-based rather than moving to the exception
-* NAME, and that is load-bearing here rather than inherited: Lambda raises
-* `ResourceConflictException` for a function in a PENDING state too (see
-* `lambda-function-provider.ts`), so keying on the name would classify a
-* transient state conflict as a collision and delete a live function under
-* `--replace`.
-*/
-function isNameCollisionError(message) {
-	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
-}
-/**
-* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
-* a queue with the SAME name inside ~60s fails with
-* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
-* after deleting a queue before you can create another with the same name").
-*
-* The generic transient table above already carries 'wait 60 seconds' for
-* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
-* sites (the deploy engine's --replace delete-first fallback and the rollback
-* executor's reverse-replacement) override the retry filter with
-* {@link isNameCollisionError}, which this signature does NOT match — so a
-* replacement revert used to fail fast mid-flight with the resource absent
-* from both AWS and state (issue #1206). Those sites now OR this matcher into
-* their retry filter, with a schedule long enough to cover the 60s window.
-*
-* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
-* create-first site must NOT be treated as a collision (deleting the new
-* resource would not release the cooldown on the old name).
-*/
-function isNameCooldownError(message) {
-	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
-}
-/**
-* Retry filter for the delete-then-re-create sites: the old name holder was
-* just deleted, so both the late name release ("already exists" from an async
-* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
-* schedule that covers the full cooldown window (maxRetries 8, delays
-* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
-*/
-function isRecreateRetryableError(message) {
-	return isNameCollisionError(message) || isNameCooldownError(message);
-}
+};
 
 //#endregion
 //#region src/deployment/retry.ts
@@ -13971,7 +13994,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-o7QsopaI.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D5ZBSgh2.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -14655,7 +14678,7 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 * torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
-const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, tear the resource down by hand.";
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
 /**
 * Type guard to validate Lambda response payload structure
 */
@@ -20086,8 +20109,98 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
+//#endregion
+//#region src/deployment/delete-outcome.ts
+/**
+* Deploy-side consumption of {@link ResourceDeleteResult} (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)) — the twin of what
+* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`.
+*
+* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
+* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
+* means **the resource this result names was NOT destroyed and may still be
+* ALIVE**, and taught the destroy runner to report it. Every OTHER
+* `provider.delete(...)` call site — the deploy engine's template-DELETE
+* branch, its four replacement / recreate delete sites, and the five
+* `rollback-executor.ts` delete arms — discarded the value, so the same skip
+* printed as `deleted`, counted as `deleted`, and dropped the state record.
+*
+* **The module must stay a LEAF — no imports beyond the type, ever.** Same
+* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
+* engine and the rollback executor consume it, and those two already sit on a
+* dense import ring (engine -> executor -> provider registry -> every
+* provider). A helper that pulled anything else in would close it.
+*/
+/**
+* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
+* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
+* `void` return ~80 providers still use).
+*
+* A function rather than an inline `result?.outcome === 'skipped'` test at
+* ten call sites so the back-compat `void` reading lives in ONE place: the
+* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
+* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
+* you compare against nothing useful.
+*/
+function deleteSkipReason(result) {
+	if (!result || result.outcome !== "skipped") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
+}
+/**
+* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
+*
+* Deliberately says the cause is unknown rather than inventing one: the line
+* it renders on is the user's only signal that the resource survived, and a
+* fabricated cause would send them looking in the wrong place.
+*/
+const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
+/**
+* The sentence every deploy-side skip renders, in the log line AND in the
+* `Error` the sites that must FAIL the resource throw.
+*
+* Wording rules, both load-bearing:
+*
+* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
+*    no AWS call at every producer but `NestedStackProvider.delete`, so the
+*    old resource is presumed alive — which is the whole reason a replacement
+*    site cannot proceed to create its replacement beside it.
+* 2. It must NOT contain any phrase the callers' already-deleted classifiers
+*    substring-match (`does not exist` / `was not found` / `not found` /
+*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
+*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
+*    the mis-accounting this change exists to remove, and the deploy engine's
+*    DELETE branch and its update-not-supported fallback each carry such a
+*    classifier. The call sites additionally handle the skip OUTSIDE their
+*    `catch`, so a future `reason` carrying one of those phrases still cannot
+*    reach a classifier — belt and braces, because `reason` is provider text.
+*/
+function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
+	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor.ts
+/**
+* Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762): turn a
+* `{ outcome: 'skipped' }` delete into a thrown error at every rollback delete
+* arm.
+*
+* A skip means the resource was NOT deleted, so the rollback op did not
+* happen. Throwing routes it into the per-op accounting each arm already has —
+* `result.failures++` plus a `ROLLBACK_RESOURCE_FAILED` event and a kept
+* journal segment for the shared catch, or the local warn + `result.warnings++`
+* at the one arm whose delete is already best-effort. Both are correct and
+* neither needs a second code path; what is NOT correct is the pre-#1762
+* behavior, where every arm read a skip as a successful revert, dropped the
+* state record, and popped the segment.
+*/
+function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
+	const reason = deleteSkipReason(result);
+	if (reason === void 0) return;
+	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
+}
 /** The `--skip-final-snapshot` flag name cited by every refusal below. */
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 /**
@@ -20517,10 +20630,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					resourceType: op.resourceType,
 					provisionedBy: deleteProvisionedBy
 				});
-				await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, {
+				throwIfDeleteSkipped(await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, {
 					expectedRegion: ctx.region,
 					...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-				});
+				}), op.logicalId, op.physicalId, "while rolling back its CREATE");
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
 				await afterOp?.(op.logicalId);
@@ -20544,10 +20657,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				});
 				{
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)");
 				}
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
@@ -20592,10 +20705,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-						await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 							expectedRegion: ctx.region,
 							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-						});
+						}), op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
 					}
 					deletedNewFirst = true;
 					delete stateResources[op.logicalId];
@@ -20629,10 +20742,10 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
 					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
 					result.warnings++;
@@ -20778,10 +20891,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
 					});
-					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
+					throwIfDeleteSkipped(await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-					});
+					}), op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)");
 					delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -20935,7 +21048,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.7";
+	return "0.283.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21902,6 +22015,7 @@ var DeployEngine = class {
 					created: 0,
 					updated: 0,
 					deleted: 0,
+					deleteSkipped: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
 					outputs: this.buildDisplayOutputs(template, persistedOutputs),
@@ -21919,6 +22033,7 @@ var DeployEngine = class {
 					created: createChanges.length,
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
+					deleteSkipped: 0,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
 					durationMs: Date.now() - startTime,
 					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
@@ -21941,6 +22056,7 @@ var DeployEngine = class {
 				created: actualCounts.created,
 				updated: actualCounts.updated,
 				deleted: actualCounts.deleted,
+				deleteSkipped: actualCounts.deleteSkipped,
 				unchanged: unchangedCount,
 				durationMs,
 				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
@@ -21974,7 +22090,8 @@ var DeployEngine = class {
 			created: 0,
 			updated: 0,
 			deleted: 0,
-			skipped: 0
+			skipped: 0,
+			deleteSkipped: 0
 		};
 		const completedOperations = [];
 		const failedOperations = [];
@@ -22081,8 +22198,9 @@ var DeployEngine = class {
 						const logicalId = node.id;
 						const change = node.data;
 						const previousState = currentState.resources[logicalId] ? { ...currentState.resources[logicalId] } : void 0;
+						let deleteOutcome;
 						try {
-							await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
+							deleteOutcome = await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
@@ -22096,6 +22214,7 @@ var DeployEngine = class {
 							});
 							throw provisionError;
 						}
+						if (deleteOutcome) return;
 						completedOperations.push({
 							logicalId,
 							changeType: "DELETE",
@@ -22387,9 +22506,10 @@ var DeployEngine = class {
 			resourceType,
 			...labelRouting && { provisionedBy: labelRouting }
 		});
+		let deleteSkipped;
 		try {
 			await withResourceDeadline(async () => {
-				await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress);
+				deleteSkipped = (await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress))?.deleteSkipped;
 			}, {
 				warnAfterMs,
 				timeoutMs,
@@ -22403,6 +22523,20 @@ var DeployEngine = class {
 				},
 				onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
 			});
+			if (deleteSkipped !== void 0) {
+				this.recordEvent({
+					eventType: "RESOURCE_SKIPPED",
+					stackName,
+					operation: eventOp,
+					logicalId,
+					resourceType,
+					...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+					...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+					reason: deleteSkipped,
+					durationMs: Date.now() - resourceStartedAt
+				});
+				return { deleteSkipped };
+			}
 			this.recordEvent({
 				eventType: "RESOURCE_SUCCEEDED",
 				stackName,
@@ -22499,8 +22633,9 @@ var DeployEngine = class {
 	*/
 	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy) {
 		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+		let deleteResult;
 		try {
-			await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+			deleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 				expectedRegion: this.stackRegion,
 				forceDataDelete: this.options.forceStatefulRecreation === true,
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
@@ -22508,6 +22643,8 @@ var DeployEngine = class {
 		} catch (deleteError) {
 			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 		}
+		const replaceSkipReason = deleteSkipReason(deleteResult);
+		if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 		this.logger.info(`  ${green("✓")} Old resource deleted`);
 		this.logger.info(`  Re-creating ${logicalId}...`);
 		try {
@@ -22645,16 +22782,19 @@ var DeployEngine = class {
 						else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+							let recreateDeleteResult;
 							try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+								recreateDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 									expectedRegion: this.stackRegion,
 									forceDataDelete: this.options.forceStatefulRecreation === true,
 									...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId }
 								});
-								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
 								throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 							}
+							const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
+							if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
+							this.logger.info(`  ${green("✓")} Old resource deleted`);
 						}
 						this.logger.info(`  Creating new ${logicalId}...`);
 						createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider), logicalId, {
@@ -22702,15 +22842,22 @@ var DeployEngine = class {
 								snapshotBlockedDelete = true;
 								this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
 							}
-							if (!snapshotBlockedDelete) try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
-									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true,
-									...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
-								});
-								this.logger.info(`  ${green("✓")} Old resource deleted`);
-							} catch (deleteError) {
-								this.logger.warn(`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+							if (!snapshotBlockedDelete) {
+								let cleanupDeleteResult = void 0;
+								let cleanupDeleteFailed = false;
+								try {
+									cleanupDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+										expectedRegion: this.stackRegion,
+										forceDataDelete: this.options.forceStatefulRecreation === true,
+										...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
+									});
+								} catch (deleteError) {
+									this.logger.warn(`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+									cleanupDeleteFailed = true;
+								}
+								const cleanupSkipReason = deleteSkipReason(cleanupDeleteResult);
+								if (cleanupSkipReason !== void 0) this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, cleanupSkipReason, "while cleaning up the replaced resource")}. Delete it manually — it is no longer tracked in state.`);
+								else if (!cleanupDeleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
 							}
 						}
 					}
@@ -22753,8 +22900,9 @@ var DeployEngine = class {
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
+							let fallbackDeleteResult = void 0;
 							try {
-								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+								fallbackDeleteResult = await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
 									expectedRegion: this.stackRegion,
 									forceDataDelete: this.options.forceStatefulRecreation === true,
 									...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId }
@@ -22764,6 +22912,8 @@ var DeployEngine = class {
 								if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 								else throw deleteError;
 							}
+							const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
+							if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 							const replDecision = this.providerRegistry.getProviderFor({
 								resourceType,
 								properties: resolvedProps
@@ -22817,8 +22967,9 @@ var DeployEngine = class {
 					provisionedBy: currentResource.provisionedBy
 				}).provider;
 				this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+				let deleteResult = void 0;
 				try {
-					await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+					deleteResult = await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 						expectedRegion: this.stackRegion,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), logicalId, 3, 5e3, deleteProvider);
@@ -22827,6 +22978,16 @@ var DeployEngine = class {
 					if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
+				const deleteSkipped = deleteSkipReason(deleteResult);
+				if (deleteSkipped !== void 0) {
+					if (progress) progress.current++;
+					const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+					renderer.removeTask(logicalId);
+					this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
+					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first ('cdkd state show ${stackName}' to inspect; for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record with 'cdkd state orphan ${stackName}'.`);
+					if (counts) counts.deleteSkipped++;
+					return { deleteSkipped };
+				}
 				delete stateResources[logicalId];
 				if (counts) counts.deleted++;
 				if (progress) progress.current++;
@@ -23103,5 +23264,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveSkipPrefix as $t, green as A, LockError as An, rewriteTemplateAssetReferences as At, slowCcOperationTimeoutMs as B, SynthesisError as Bn, formatDockerLoginError as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, CdkdError as Cn, shouldRetainResource as Ct, bold as D, LocalInvokeBuildError as Dn, buildAssetRedirectMap as Dt, formatResourceLine as E, DeployCancelledError as En, WorkGraph as Et, clearOnUpdateRemoval as F, ResourceTimeoutError as Fn, parseBootstrapMarker as Ft, getAccountInfo as G, __exportAll as Gn, getDockerImageBySourceHash as Gt, isTerminationProtectionPropagationError as H, isCdkdError as Hn, runDockerForeground as Ht, ProviderRegistry as I, ResourceUpdateNotSupportedError as In, validateAssetBucketName as It, normalizeAwsTagsToCfn as J, getDefaultStateBucketName as Jt, refStateLookupFromResource as K, Synthesizer as Kt, findActionableSilentDrops as L, StackHasActiveImportsError as Ln, validateContainerRepoName as Lt, yellow as M, NestedStackChildDirectDestroyError as Mn, BOOTSTRAP_MARKER_PREFIX as Mt, IAMRoleProvider as N, PartialFailureError as Nn, ensureAssetStorage as Nt, cyan as O, LocalMigrateError as On, createAssetRedirectResolver as Ot, collectInlinePolicyNamesManagedBySiblings as P, ProvisioningError as Pn, getBootstrapMarkerKey as Pt, configBooleanRefusal as Q, resolveCaptureObservedState as Qt, findSilentDropProperties as R, StackTerminationProtectionError as Rn, buildDenyExternalAccessPolicy as Rt, extractDeploymentEventError as S, AssetError as Sn, rebuildClientForBucketRegion as St, renderStatefulReason as T, DependencyError as Tn, stringifyValue as Tt, IntrinsicFunctionResolver as U, normalizeAwsError as Un, runDockerStreaming as Ut, disableInstanceApiTermination as V, formatError as Vn, getDockerCmd as Vt, cfnRefValueFromPhysicalId as W, withErrorHandling as Wn, AssetManifestLoader as Wt, assertRegionMatch as X, resolveApp as Xt, resolveExplicitPhysicalId as Y, getLegacyStateBucketName as Yt, coerceCfnBoolean as Z, resolveAutoAssetStorage as Zt, createPreDeleteFinalSnapshot as _, resolveBucketRegion as _n, markNonRetryable as _t, DeploymentEventsStore as a, CFN_TEMPLATE_BODY_LIMIT as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, resetAwsClients as bn, LockManager as bt, replayFailedOperations as c, findLargeInlineResources as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, PARTITION_TABLE as dn, DiffCalculator as dt, resolveStateBucketWithDefault as en, readConfigString as et, computeImplicitDeleteEdges as f, canonicalizeRegion as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, clearBucketRegionCache as gn, isThrottlingError as gt, buildFinalSnapshotIdentifier as h, processStackMessages as hn, isRetryableTransientError as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as in, requireConfigString as it, red as j, MissingCdkCliError as jn, AssetModeResolver as jt, gray as k, LocalStartServiceError as kn, loadPublishableAssetManifest as kt, replayRollback as l, uploadCfnTemplate as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AssemblyReader as mn, isMarkedNonRetryable as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as nn, requireConfigArray as nt, planFailedOps as o, CFN_TEMPLATE_URL_LIMIT as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, derivePartitionAndUrlSuffix as pn, withRetry as pt, WAFv2WebACLProvider as q, synthesisStatusMessage as qt, DeployEngine as r, stateBucketExistenceConfirmed as rn, requireConfigObject as rt, planRollback as s, MIGRATE_TMP_PREFIX as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as tn, replayWarn as tt, withResourceDeadline as u, expectedOwnerParam as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AwsClients as vn, DagBuilder as vt, isStatefulRecreateTargetSync as w, ConfigError as wn, AssetPublisher as wt, makeCanonicalizePropertiesFn as x, setAwsClients as xn, S3StateBackend as xt, refusesFinalSnapshot as y, getAwsClients as yn, TemplateParser as yt, CloudControlProvider as z, StateError as zn, buildDockerImage as zt };
-//# sourceMappingURL=deploy-engine-CKpBSlde.js.map
+export { coerceCfnBoolean as $, resolveStateBucketWithDefaultAndSource as $t, cyan as A, NestedStackChildDirectDestroyError as An, BOOTSTRAP_MARKER_PREFIX as At, findSilentDropProperties as B, isCdkdError as Bn, runDockerForeground as Bt, makeCanonicalizePropertiesFn as C, DependencyError as Cn, stringifyValue as Ct, renderStatefulReason as D, LocalStartServiceError as Dn, loadPublishableAssetManifest as Dt, isStatefulRecreateTargetSync as E, LocalMigrateError as En, createAssetRedirectResolver as Et, IAMRoleProvider as F, StackHasActiveImportsError as Fn, validateContainerRepoName as Ft, IntrinsicFunctionResolver as G, isThrottlingError as Gn, synthesisStatusMessage as Gt, slowCcOperationTimeoutMs as H, withErrorHandling as Hn, AssetManifestLoader as Ht, collectInlinePolicyNamesManagedBySiblings as I, StackTerminationProtectionError as In, buildDenyExternalAccessPolicy as It, refStateLookupFromResource as J, resolveApp as Jt, cfnRefValueFromPhysicalId as K, markNonRetryable as Kn, getDefaultStateBucketName as Kt, clearOnUpdateRemoval as L, StateError as Ln, buildDockerImage as Lt, green as M, ProvisioningError as Mn, getBootstrapMarkerKey as Mt, red as N, ResourceTimeoutError as Nn, parseBootstrapMarker as Nt, formatResourceLine as O, LockError as On, rewriteTemplateAssetReferences as Ot, yellow as P, ResourceUpdateNotSupportedError as Pn, validateAssetBucketName as Pt, assertRegionMatch as Q, resolveStateBucketWithDefault as Qt, ProviderRegistry as R, SynthesisError as Rn, formatDockerLoginError as Rt, unsupportedFinalSnapshotError as S, ConfigError as Sn, AssetPublisher as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, LocalInvokeBuildError as Tn, buildAssetRedirectMap as Tt, disableInstanceApiTermination as U, isMarkedNonRetryable as Un, getDockerImageBySourceHash as Ut, CloudControlProvider as V, normalizeAwsError as Vn, runDockerStreaming as Vt, isTerminationProtectionPropagationError as W, isRetryableTransientError as Wn, Synthesizer as Wt, normalizeAwsTagsToCfn as X, resolveCaptureObservedState as Xt, WAFv2WebACLProvider as Y, resolveAutoAssetStorage as Yt, resolveExplicitPhysicalId as Z, resolveSkipPrefix as Zt, buildFinalSnapshotIdentifier as _, getAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, MIGRATE_TMP_PREFIX as an, requireConfigObject as at, isFinalSnapshotError as b, AssetError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, expectedOwnerParam as cn, s3BucketDomainName as ct, deleteSkipReason as d, derivePartitionAndUrlSuffix as dn, s3BucketWebsiteUrl as dt, resolveUseCdkBootstrapAssets as en, configBooleanRefusal as et, withResourceDeadline as f, AssemblyReader as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, AwsClients as gn, DagBuilder as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, resolveBucketRegion as hn, withRetry as ht, DeploymentEventsReader as i, CFN_TEMPLATE_URL_LIMIT as in, requireConfigArray as it, gray as j, PartialFailureError as jn, ensureAssetStorage as jt, bold as k, MissingCdkCliError as kn, AssetModeResolver as kt, replayRollback as l, PARTITION_TABLE as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, clearBucketRegionCache as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nn, readConfigString as nt, planFailedOps as o, findLargeInlineResources as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, processStackMessages as pn, DiffCalculator as pt, getAccountInfo as q, __exportAll as qn, getLegacyStateBucketName as qt, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rn, replayWarn as rt, planRollback as s, uploadCfnTemplate as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, stateBucketExistenceConfirmed as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, canonicalizeRegion as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, resetAwsClients as vn, LockManager as vt, extractDeploymentEventError as w, DeployCancelledError as wn, WorkGraph as wt, refusesFinalSnapshot as x, CdkdError as xn, shouldRetainResource as xt, createPreDeleteFinalSnapshot as y, setAwsClients as yn, S3StateBackend as yt, findActionableSilentDrops as z, formatError as zn, getDockerCmd as zt };
+//# sourceMappingURL=deploy-engine-CWt7h7Nc.js.map