@go-to-k/cdkd 0.284.1 → 0.284.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackTerminationProtectionError, $t as buildDenyExternalAccessPolicy, A as formatResourceLine, An as processStackMessages, At as withRetry, B as isExportAliasCollision, Bt as buildAssetRedirectMap, C as refusesFinalSnapshot, Cn as findLargeInlineResources, Ct as s3BucketDualStackDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as canonicalizeRegion, Dt as DiffCalculator, E as extractDeploymentEventError, En as PARTITION_TABLE, Et as applyRoleArnIfSet, F as red, Fn as resetAwsClients, Ft as rebuildClientForBucketRegion, G as clearOnUpdateRemoval, Gt as stripControlChars, H as stateKeySecretExposure, Hn as LocalInvokeBuildError$1, Ht as loadPublishableAssetManifest, I as yellow, In as setAwsClients, It as shouldRetainResource, J as findSilentDropProperties, Jn as PartialFailureError, Jt as ensureAssetStorage, K as ProviderRegistry, Kn as MissingCdkCliError, Kt as AssetModeResolver, L as collectDeclaredOutputNames, Lt as AssetPublisher, M as cyan, Mn as resolveBucketRegion, Mt as TemplateParser, N as gray, Nn as AwsClients, Nt as LockManager, O as isStatefulRecreateTargetSync, On as derivePartitionAndUrlSuffix, Ot as INTRINSIC_KEYS, P as green, Pn as getAwsClients, Pt as S3StateBackend, Q as isTerminationProtectionPropagationError, Qn as StackHasActiveImportsError, Qt as validateContainerRepoName, R as collectPublishedOutputNames, Rn as CdkdError, Rt as stringifyValue, S as isFinalSnapshotError, Sn as MIGRATE_TMP_PREFIX, St as s3BucketDomainName, T as makeCanonicalizePropertiesFn, Tn as expectedOwnerParam, Tt as s3BucketWebsiteUrl, U as IAMRoleProvider, Un as LocalMigrateError, Ut as rewriteTemplateAssetReferences, V as secretBearingStateKeyWarning, Vn as DeployCancelledError, Vt as createAssetRedirectResolver, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalStartServiceError, Wt as escapeRegExp, X as slowCcOperationTimeoutMs, Xn as ResourceTimeoutError, Xt as parseBootstrapMarker, Y as CloudControlProvider, Yn as ProvisioningError, Yt as getBootstrapMarkerKey, Z as disableInstanceApiTermination, Zn as ResourceUpdateNotSupportedError, Zt as validateAssetBucketName, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveUseCdkBootstrapAssets, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as AssetManifestLoader, ar as withErrorHandling, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as CFN_TEMPLATE_BODY_LIMIT, bt as scrubResourceRecord, c as replayFailedOperations, cn as synthesisStatusMessage, cr as isThrottlingError, ct as configBooleanRefusal, d as updatePartialReason, dn as resolveApp, dt as replayWarn, en as buildDockerImage, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveAutoAssetStorage, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefaultAndSource, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveStateBucketWithDefault, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerStreaming, ir as normalizeAwsError, it as normalizeAwsTagsToCfn, j as bold, jt as DagBuilder, k as renderStatefulReason, kn as AssemblyReader, kt as describeTypeWithThrottleRetry, l as replayRollback, ln as getDefaultStateBucketName, lr as markNonRetryable, lt as configStringRefusal, m as withResourceDeadline, mn as resolveSkipPrefix, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerCmd, nt as refStateLookupFromResource, o as planFailedOps, on as getDockerImageBySourceHash, or as isMarkedNonRetryable, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveCaptureObservedState, pt as requireConfigObject, q as findActionableSilentDrops, qn as NestedStackChildDirectDestroyError, qt as BOOTSTRAP_MARKER_PREFIX, r as DeployEngine, rn as runDockerForeground, rt as WAFv2WebACLProvider, s as planRollback, sn as Synthesizer, sr as isRetryableTransientError, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as formatDockerLoginError, tt as getAccountInfo, u as updatePartialMessage, un as getLegacyStateBucketName, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as stateBucketExistenceConfirmed, vt as maskSecretsInText, w as unsupportedFinalSnapshotError, wn as uploadCfnTemplate, wt as s3BucketRegionalDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_URL_LIMIT, xt as s3BucketArn, y as buildFinalSnapshotIdentifier, yn as warnDeprecatedNoPrefixCliFlag, yt as redactSecretsForState, z as exportAliasCollisionScrubWarning, zt as WorkGraph } from "./deploy-engine-CruC7Qxn.js";
+import { $ as IntrinsicFunctionResolver, $n as StackTerminationProtectionError, $t as buildDenyExternalAccessPolicy, A as formatResourceLine, An as processStackMessages, At as withRetry, B as isExportAliasCollision, Bt as buildAssetRedirectMap, C as refusesFinalSnapshot, Cn as findLargeInlineResources, Ct as s3BucketDualStackDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as canonicalizeRegion, Dt as DiffCalculator, E as extractDeploymentEventError, En as PARTITION_TABLE, Et as applyRoleArnIfSet, F as red, Fn as resetAwsClients, Ft as rebuildClientForBucketRegion, G as clearOnUpdateRemoval, Gt as stripControlChars, H as stateKeySecretExposure, Hn as LocalInvokeBuildError$1, Ht as loadPublishableAssetManifest, I as yellow, In as setAwsClients, It as shouldRetainResource, J as findSilentDropProperties, Jn as PartialFailureError, Jt as ensureAssetStorage, K as ProviderRegistry, Kn as MissingCdkCliError, Kt as AssetModeResolver, L as collectDeclaredOutputNames, Lt as AssetPublisher, M as cyan, Mn as resolveBucketRegion, Mt as TemplateParser, N as gray, Nn as AwsClients, Nt as LockManager, O as isStatefulRecreateTargetSync, On as derivePartitionAndUrlSuffix, Ot as INTRINSIC_KEYS, P as green, Pn as getAwsClients, Pt as S3StateBackend, Q as isTerminationProtectionPropagationError, Qn as StackHasActiveImportsError, Qt as validateContainerRepoName, R as collectPublishedOutputNames, Rn as CdkdError, Rt as stringifyValue, S as isFinalSnapshotError, Sn as MIGRATE_TMP_PREFIX, St as s3BucketDomainName, T as makeCanonicalizePropertiesFn, Tn as expectedOwnerParam, Tt as s3BucketWebsiteUrl, U as IAMRoleProvider, Un as LocalMigrateError, Ut as rewriteTemplateAssetReferences, V as secretBearingStateKeyWarning, Vn as DeployCancelledError, Vt as createAssetRedirectResolver, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalStartServiceError, Wt as escapeRegExp, X as slowCcOperationTimeoutMs, Xn as ResourceTimeoutError, Xt as parseBootstrapMarker, Y as CloudControlProvider, Yn as ProvisioningError, Yt as getBootstrapMarkerKey, Z as disableInstanceApiTermination, Zn as ResourceUpdateNotSupportedError, Zt as validateAssetBucketName, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveUseCdkBootstrapAssets, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as AssetManifestLoader, ar as withErrorHandling, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as CFN_TEMPLATE_BODY_LIMIT, bt as scrubResourceRecord, c as replayFailedOperations, cn as synthesisStatusMessage, cr as isThrottlingError, ct as configBooleanRefusal, d as updatePartialReason, dn as resolveApp, dt as replayWarn, en as buildDockerImage, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveAutoAssetStorage, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefaultAndSource, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveStateBucketWithDefault, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerStreaming, ir as normalizeAwsError, it as normalizeAwsTagsToCfn, j as bold, jt as DagBuilder, k as renderStatefulReason, kn as AssemblyReader, kt as describeTypeWithThrottleRetry, l as replayRollback, ln as getDefaultStateBucketName, lr as markNonRetryable, lt as configStringRefusal, m as withResourceDeadline, mn as resolveSkipPrefix, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerCmd, nt as refStateLookupFromResource, o as planFailedOps, on as getDockerImageBySourceHash, or as isMarkedNonRetryable, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveCaptureObservedState, pt as requireConfigObject, q as findActionableSilentDrops, qn as NestedStackChildDirectDestroyError, qt as BOOTSTRAP_MARKER_PREFIX, r as DeployEngine, rn as runDockerForeground, rt as WAFv2WebACLProvider, s as planRollback, sn as Synthesizer, sr as isRetryableTransientError, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as formatDockerLoginError, tt as getAccountInfo, u as updatePartialMessage, un as getLegacyStateBucketName, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as stateBucketExistenceConfirmed, vt as maskSecretsInText, w as unsupportedFinalSnapshotError, wn as uploadCfnTemplate, wt as s3BucketRegionalDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_URL_LIMIT, xt as s3BucketArn, y as buildFinalSnapshotIdentifier, yn as warnDeprecatedNoPrefixCliFlag, yt as redactSecretsForState, z as exportAliasCollisionScrubWarning, zt as WorkGraph } from "./deploy-engine-DJ-CgH80.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DDEsD6uA.js";
+import { t as ASGProvider } from "./asg-provider-iHWEv4gN.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -591,6 +591,37 @@ const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Pu
 */
 const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
 /**
+* Issue [#1960](https://github.com/go-to-k/cdkd/issues/1960) —
+* `--allow-unaddressed` (deploy only). A deploy that finishes having left a
+* resource cdkd was responsible for ALIVE in AWS and no longer in state exits
+* 2 (partial failure), matching what `cdkd destroy` has done for the identical
+* outcome since issue #1752. Two cases produce it:
+*
+*  - a skipped DELETE (issue #1762) — a resource removed from the template
+*    whose provider could not issue the delete, typically because the state
+*    record is malformed (see `src/provisioning/composite-id.ts`);
+*  - a partial UPDATE (issue #1819) — a replacement whose new resource was
+*    created and whose OLD one survives untracked, most commonly an ACM
+*    certificate a consumer still references.
+*
+* This flag forces exit 0 for both. It exists because the partial-UPDATE case
+* has a legitimate not-yet-fixable window: an ACM replacement blocked on
+* `DescribeCertificate.InUseBy` clears itself once the consumer (e.g. a
+* CloudFront distribution in another stack) finishes updating, so a pipeline
+* can be red for a cause it cannot act on. Wrapping the command in a shell
+* exit-code test is NOT an equivalent workaround — `cdkd deploy` also exits 2
+* for `MacroExpansionError` and `ResourceUpdateNotSupportedError`, so a
+* `|| [ $? -eq 2 ]` wrapper silences unrelated real failures; this flag is
+* scoped to the one cause.
+*
+* The flag suppresses only the EXIT CODE. The summary rows
+* (`Skipped (not deleted)` / `of which left an orphaned predecessor`), the
+* per-resource warnings, and the `RunCounts.skipped` figure in `cdkd events`
+* are all emitted unchanged, so a run that used it still says in its log that
+* a resource survived.
+*/
+const allowUnaddressedOption = new Option("--allow-unaddressed", "Exit 0 even when the deploy left a resource unaddressed — a DELETE the provider could not issue, or a replacement whose old resource survives untracked (default: exit 2, matching cdkd destroy). The summary rows and warnings are printed either way; only the exit code changes.").default(false);
+/**
 * Issue #1697 — `--no-cfn-fallback` (deploy + diff). By default, a
 * cross-stack reference (`Fn::ImportValue` / `Fn::GetStackOutput`) that is
 * not found in cdkd state falls back to CloudFormation (`ListExports` /
@@ -639,6 +670,7 @@ const deployOptions = [
 	useCdkBootstrapAssetsOption,
 	strictGetattOption,
 	noCfnFallbackOption,
+	allowUnaddressedOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -2069,15 +2101,31 @@ function startRunRecorder(args) {
 	return recorder;
 }
 /**
-* Emit a success `RUN_FINISHED`. No-op when `recorder` is `undefined`
-* (dry-run / older state). `durationMs` is optional (destroy does not
-* carry one at the run level).
+* Emit a `RUN_FINISHED` carrying COUNTS under a caller-chosen result. No-op
+* when `recorder` is `undefined` (dry-run / older state). `durationMs` is
+* optional (destroy does not carry one at the run level).
+*
+* Replaced a `recordRunSucceeded` that hard-coded `'SUCCEEDED'`, because
+* deploy has an outcome that is neither a clean success nor a thrown failure:
+* a run that finished, failed no resource, and yet left one
+* cdkd was responsible for alive in AWS (issue
+* [#1960](https://github.com/go-to-k/cdkd/issues/1960)). That run exits 2, so
+* recording it as `SUCCEEDED` would put the durable post-mortem at odds with
+* the exit code the same run returned.
+*
+* {@link recordRunFailed} cannot serve it: that one carries error metadata and
+* NO counts, and the `skipped` count is the only thing in the summary that says
+* a resource survived — dropping it would leave `cdkd events` showing a failed
+* run naming nothing that failed, which is the exact shape the destroy side
+* added `skipped` to avoid. `cdkd destroy` already records `FAILED` for this
+* outcome (see the `skippedCount > 0` arm in src/cli/commands/destroy.ts), so
+* this is parity rather than a new convention.
 */
-function recordRunSucceeded(recorder, stackName, counts, durationMs) {
+function recordRunOutcome(recorder, stackName, result, counts, durationMs) {
 	recorder?.record({
 		eventType: "RUN_FINISHED",
 		stackName,
-		result: "SUCCEEDED",
+		result,
 		...durationMs !== void 0 && { durationMs },
 		counts
 	});
@@ -14308,8 +14356,10 @@ function isIndexBusyDeleteError(message) {
 * gate uses, because THAT default is sized for a wait that runs once while
 * this one runs per retry: the caller's wall clock is
 * `its retry budget x this x ~1.2s per poll + withRetry's backoff`, and `destroy-runner.ts` runs the delete under a per-resource
-* deadline (30 min by default; neither DynamoDB provider declares a
-* `getMinResourceTimeoutMs` to lift it). At 900 polls the product would be
+* deadline (30 min by default; since issue #1955 both DynamoDB providers
+* self-report that same 30 min through `getMinResourceTimeoutMs`, so a lowered
+* `--resource-timeout` cannot shrink it below what the shared delete budget in
+* `providers/dynamodb-delete-budget.ts` assumes). At 900 polls the product would be
 * ~4.2h, so a genuinely stuck index would produce a 30-minute wait ending in a
 * generic `ResourceTimeoutError` that never mentions indexes. At 60 the LOOP's
 * worst case is ~18.4 min on `AWS::DynamoDB::Table` and ~10.4 min on
@@ -14388,7 +14438,10 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 */
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
-	for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+	const budgetWait = opts.budgetWait;
+	let attempt = 0;
+	while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+		attempt += 1;
 		try {
 			if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
 		} catch (err) {
@@ -14410,7 +14463,8 @@ async function waitForIndexesSettled(opts) {
 		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
-	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~${pollSeconds}s apart, so a little over ${maxAttempts * pollSeconds}s of wall clock); ${proceedNote}`);
+	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${pollsRun} DescribeTable polls (~${pollSeconds}s apart, so a little over ${pollsRun * pollSeconds}s of wall clock).${budgetWait?.note() ?? ""} ${proceedNote}`);
 }
 /**
 * The ONE line the retry prints at default verbosity, for both providers.
@@ -14525,12 +14579,486 @@ async function deleteTableWithIndexBusyRetry(opts) {
 		await opts.deleteTable();
 	}, opts.logicalId, {
 		maxRetries: opts.maxRetries,
-		isRetryable: (message) => isIndexBusyDeleteError(message),
+		isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
 		logger: opts.logger,
 		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
 	});
 }
 
+//#endregion
+//#region src/utils/elapsed-budget.ts
+/**
+* ONE wall-clock allowance shared by a sequence of independently capped waits.
+*
+* **The problem it exists for.** A provider operation is run under a
+* per-resource deadline (`withResourceDeadline`, applied by
+* `src/cli/commands/destroy-runner.ts` and the deploy engine). Inside that
+* deadline a single `delete()` can stack several polling waits, each with its
+* own justified cap. Every cap is defensible on its own and the SUM is not:
+* three ~12-18 minute waits inside one 30-minute deadline overshoot it, and
+* `withResourceDeadline` does NOT cancel what it wraps — it rejects with a
+* generic timeout while the polling loop keeps running behind the run that has
+* already reported failure (issue #1955).
+*
+* A shared budget converts "each wait is capped" into "the PATH is capped": a
+* wait asks how many polls still fit rather than how many its own constant
+* allows, so the path spends the allowance ONCE and stops itself while the
+* deadline still has margin. Stopping ourselves is what preserves the
+* operation's own actionable error (AWS's "Cannot delete table while indexes
+* are being ..." rather than `ResourceTimeoutError`) and what stops work from
+* outliving the run.
+*
+* Deliberately NOT an `AbortController`: nothing here interrupts an in-flight
+* SDK call. It bounds how many MORE polls a loop will start, which is the whole
+* of the cost for a wait built out of `describe`-then-sleep — and it needs no
+* plumbing through every provider call.
+*
+* The clock is injectable so a test can drive elapsed time without faking
+* timers globally (the polling loops under test are real `async` loops; a
+* global fake clock would freeze them too).
+*/
+/**
+* The default clock: MONOTONIC, not `Date.now()`.
+*
+* `Date.now()` follows wall clock, so an NTP correction moves it in either
+* direction mid-operation — and the two directions fail differently. Backwards
+* would hand the path MORE than its total (guarded below by clamping elapsed at
+* zero); FORWARDS instantly drains the allowance, which cuts every remaining
+* wait to its one-poll floor and makes the whole path report "cdkd's allowance
+* ran out" for something that never happened. A 30-minute delete is long enough
+* to sit across a correction.
+*
+* `performance.now()` is monotonic and millisecond-denominated (a float, which
+* only matters to a consumer dividing by a poll cost — flooring already handles
+* it). Guarded rather than assumed present, so a runtime without it degrades to
+* the old behaviour instead of throwing.
+*/
+const monotonicNowMs = typeof globalThis.performance?.now === "function" ? () => globalThis.performance.now() : () => Date.now();
+/** A monotonic wall-clock allowance, started when the object is created. */
+var ElapsedBudget = class {
+	/** Total wall clock this budget may spend, in milliseconds. */
+	totalMs;
+	clock;
+	startedAt;
+	constructor(totalMs, clock = monotonicNowMs) {
+		if (!Number.isFinite(totalMs) || totalMs <= 0) throw new RangeError(`ElapsedBudget: totalMs must be a positive finite number (got ${totalMs})`);
+		this.totalMs = totalMs;
+		this.clock = clock;
+		this.startedAt = clock();
+	}
+	/** Wall clock spent since the budget started. */
+	elapsedMs() {
+		return Math.max(0, this.clock() - this.startedAt);
+	}
+	/** Wall clock still available, never negative. */
+	remainingMs() {
+		return Math.max(0, this.totalMs - this.elapsedMs());
+	}
+	isExhausted() {
+		return this.remainingMs() <= 0;
+	}
+	/**
+	* How many polls of `perAttemptMs` still fit, clamped into
+	* `[minAttempts, cap]`.
+	*
+	* `minAttempts` defaults to 1 rather than 0 on purpose: every caller here is
+	* a `describe`-then-decide loop, and a loop granted ZERO attempts reports
+	* "did not settle" without ever having looked — a verdict it did not earn,
+	* and one that reads as a bug in the wait rather than as a spent budget. One
+	* poll costs ~1s and is the difference between a guess and an observation.
+	* The overshoot it can add is therefore bounded by one poll per wait, which
+	* the caller's margin against its deadline absorbs.
+	*/
+	attemptsWithin(cap, perAttemptMs, minAttempts = 1) {
+		if (!Number.isFinite(cap) || cap <= 0) return 0;
+		if (!Number.isFinite(perAttemptMs) || perAttemptMs <= 0) return Math.min(minAttempts, cap);
+		const affordable = Math.floor(this.remainingMs() / perAttemptMs);
+		return Math.max(Math.min(minAttempts, cap), Math.min(cap, affordable));
+	}
+};
+/**
+* Budgets keyed by the thing they bound, so an operation that is RE-ENTERED
+* inside one deadline keeps spending the same allowance.
+*
+* That re-entry is the case a per-call budget silently misses. `destroy-runner`
+* wraps its whole outer retry loop — up to four `delete()` calls — in ONE
+* deadline, so a `delete()` that fails on something the outer loop classes as
+* retryable (a throttle) starts again from the top. A budget created per call
+* would reset there and the same path could be paid twice inside one deadline;
+* a budget looked up by key does not.
+*
+* Entries are RETAINED on failure (that is the point) and released by the
+* caller on a terminal outcome, so the map holds at most one entry per
+* in-flight resource.
+*
+* **The key must identify the resource, not just name it.** A registry holding
+* bare names collides whenever two distinct resources share one — for AWS that
+* is any name-scoped-by-region identifier — and the collision is silent: the
+* second resource inherits the first's spent allowance. Callers are expected to
+* qualify the key themselves (see `providers/dynamodb-delete-budget.ts`'s
+* `deleteBudgetKey`), because only the caller knows what the name is scoped by.
+*/
+var ElapsedBudgetRegistry = class {
+	budgets = /* @__PURE__ */ new Map();
+	/**
+	* The budget for `key`, creating it on first use and REUSING it on re-entry.
+	* `totalMs` and `clock` are only read when the entry is CREATED — a re-entry
+	* must not be able to grant itself a fresh allowance, nor a fresh clock.
+	*
+	* `reuseWithinMs` bounds how long an entry may be reused for, and exists
+	* because entries are deliberately RETAINED on failure: without it, a spent
+	* allowance would be inherited by any later operation that happens to reach
+	* the same key in the same process. The caller passes the wall clock of the
+	* DEADLINE the allowance is sized against — past that, the deadline has
+	* certainly fired and whoever is calling now belongs to a new operation with
+	* a new deadline, so reuse would be wrong rather than conservative.
+	*/
+	acquire(key, totalMs, clock = monotonicNowMs, reuseWithinMs) {
+		const existing = this.budgets.get(key);
+		if (existing) {
+			if (!(reuseWithinMs !== void 0 && existing.elapsedMs() > reuseWithinMs)) return existing;
+			this.budgets.delete(key);
+		}
+		const created = new ElapsedBudget(totalMs, clock);
+		this.budgets.set(key, created);
+		return created;
+	}
+	/** Drop `key`'s budget — call on a TERMINAL outcome, never between retries. */
+	release(key) {
+		this.budgets.delete(key);
+	}
+	/** Live entries; exists so a test can prove release actually released. */
+	get size() {
+		return this.budgets.size;
+	}
+	clear() {
+		this.budgets.clear();
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/dynamodb-delete-budget.ts
+/**
+* The ONE wall-clock allowance the DynamoDB DELETE path spends, for both
+* `AWS::DynamoDB::Table` and `AWS::DynamoDB::GlobalTable` (issue #1955).
+*
+* **What was wrong.** Every wait on that path is individually capped and
+* individually justified, and the caps do not know about each other:
+*
+* ```
+*   --remove-protection     600 polls  ~12 min   GlobalTable, ACTIVE wait, FIRST
+*   ACTIVE wait              60 polls   ~72s     Table, ACTIVE wait, FIRST
+*   auto-scaling teardown   see below            GlobalTable, table + per GSI,
+*                                                per replica, BEFORE the first poll
+*   waitForReplicaGone      600 polls  ~12 min   per NON-LOCAL replica
+*   #1521 pre-delete gate   900 polls  ~18 min   (issue #1521)
+*   index-busy retry loop   ~10.4 min at 8 retries / ~18.4 at 14 (#1830/#1931/#1950)
+*   waitForTableGone        600 polls  ~12 min   (only on a late SUCCESS)
+* ```
+*
+* Every poll figure is `polls x ~1.2s`, the MEASURED cost of a sleep plus a
+* `DescribeTable` round trip — so a 600-poll wait is ~12 min, not the ~10 min
+* its `1 poll = 1s` era comments used to say.
+*
+* The `--remove-protection` term is the sharpest of the ones a first pass at
+* this fix missed: it runs FIRST, its predicate is `ACTIVE` *and* no
+* transitional index — the very condition the rest of the path is about — so on
+* a `cdkd destroy --remove-protection` against a table with a building GSI it
+* spends its full ~12 min at t=0 and leaves the gate and the loop the
+* remainder.
+*
+* The auto-scaling teardown is not poll-shaped at all, and its story changed in
+* review. It was believed to inherit `withRetry`'s default schedule; it did
+* not — the two `withRetry` sites in that method are both in the REGISTER
+* branch, and every delete-path caller passes `newSettings: undefined`, which
+* takes the bare-`send` teardown branch. So the term was single-attempt and
+* fast, and a budget clamp on it was inert. What the correction exposed is a
+* half-applied twin: the register branch retries throttles because an
+* un-retried `ThrottlingException` leaves a target silently UNregistered, and
+* the teardown has the exact symmetric hazard — a silently RETAINED target that
+* a future table of the same name inherits (PR #403) — with no retry at all.
+* The teardown is now wrapped in the same throttle-only retry, bounded by
+* {@link autoScalingRetriesWithinDeleteBudget}, so the term is real, bounded,
+* and no longer asymmetric.
+*
+* `destroy-runner.ts` runs the whole thing under ONE per-resource deadline
+* (`DEFAULT_RESOURCE_TIMEOUT_MS`, 30 min). A replicated GlobalTable whose index
+* is transitioning reached ~40 min, a single-region one reached ~40.4 min on
+* the late-success path, and a single-region `--remove-protection` destroy
+* reached 12 + 18 + 10.4 ~= ~40.4 min on the EXHAUSTED-budget path — all over
+* it. Three consequences, all of them the
+* issue's:
+*
+*  1. **Stacked waits.** The deadline was spent three or four times over,
+*     because each cap was sized as though it were the only one.
+*  2. **A non-cancelling overshoot.** `withResourceDeadline` rejects but does
+*     not cancel, so the run reported a generic `ResourceTimeoutError` that
+*     never mentions indexes — replacing AWS's own actionable sentence, which
+*     the bounded re-arm exists to surface — WHILE the polling loop kept
+*     running behind the failed run.
+*  3. **Throttle compounding.** `deleteTableWithIndexBusyRetry`'s inner
+*     `isRetryable` is index-busy-only by design, so a THROTTLED `DeleteTable`
+*     escapes to `destroy-runner.ts`'s outer loop, which DOES class throttles
+*     as retryable and re-enters `delete()` from the top — paying the whole
+*     settle-and-retry sequence again inside the SAME deadline (2 x ~19.6 min
+*     ~= ~39 min on the `Table` path after issue #1950).
+*
+* **What replaces it.** A budget acquired once per physical table and shared by
+* every wait on the path. Each wait asks how many polls still fit rather than
+* how many its own constant allows, so the path spends the allowance ONCE
+* ((1)), stops itself while the deadline still has minutes of margin — leaving
+* AWS's own error as the failure and nothing polling behind it ((2)) — and,
+* because the budget is keyed by physical id in a registry rather than created
+* per call, a re-entry from the outer retry loop CONTINUES the same allowance
+* instead of restarting it ((3)).
+*
+* The per-type retry budgets (`TABLE_DELETE_INDEX_BUSY_MAX_RETRIES` /
+* `GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`) are unchanged and still
+* meaningful: they shape HOW the allowance is spent — how many fresh
+* `DeleteTable` probes it buys — while this bounds how much there is. What
+* changes is that neither of them, nor any wait cap, is load-bearing for
+* staying under the deadline any more.
+*/
+/**
+* The `DescribeTable` round trip each poll pays ON TOP of its sleep.
+*
+* MEASURED, not assumed: the live issue-#1950 run's 60-poll re-arm took ~72s
+* and its per-attempt gaps were 73 / 74 / 77 / 80 / 80 / 80s once `withRetry`'s
+* backoff is subtracted, i.e. ~1.2s per poll against a 1s sleep. Pricing a poll
+* at the bare sleep interval is what once let a ~10.4 min loop be quoted as
+* ~8.8 min.
+*/
+const DYNAMODB_DELETE_POLL_RTT_MS = 200;
+/**
+* What ONE poll of a delete-path wait costs in wall clock. Every budget->polls
+* conversion below goes through this, and it READS
+* {@link INDEX_SETTLE_POLL_INTERVAL_MS} rather than restating 1000 so the two
+* cannot drift while this arithmetic claims they agree.
+*/
+const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
+/**
+* The allowance the WHOLE delete path gets, however many waits it contains.
+*
+* **Why 26 minutes.** It has to sit under the per-resource deadline with enough
+* margin that the deadline never fires first — because the whole point is to
+* fail with the operation's own error rather than with a generic timeout — and
+* it has to be large enough that no shape which completes TODAY starts failing:
+*
+* ```
+*   Table, single pass          ACTIVE wait ~72s + loop(14) ~18.4 min = ~19.6 min   fits
+*   GlobalTable, single-region  #1521 gate ~18 min + loop(8) ~10.4 min = ~28.4 min  clamped by ~2.4 min
+* ```
+*
+* The one shape it shortens is the GlobalTable single-region EXHAUSTED-budget
+* case, and shortening it costs nothing: that path ends by throwing AWS's own
+* index-busy sentence either way, ~2.4 min sooner now.
+*
+* **Every OTHER shape was already past the 30-minute deadline before this
+* change**, which is why counting the two newly-added terms does not move the
+* number. `--remove-protection` on a single-region GlobalTable is
+* 12 + 18 + 10.4 ~= ~40.4 min; on a one-replica table 12 + 12 + 18 + 10.4 ~=
+* ~52.4 min; the late-success gone-wait adds ~12 min to whichever of those it
+* follows; the auto-scaling teardown is unbounded. All of them previously ended
+* in the generic `ResourceTimeoutError` with work still running, so a bounded
+* stop is a strict improvement there rather than a trade — there is no shape
+* between 26 and 30 minutes that this budget takes away except the ~2.4 min
+* above, because 30 minutes was already the ceiling and everything past it
+* failed.
+*
+* It is deliberately ONE number for both types rather than a per-type pair. The
+* two per-type RETRY budgets exist because the two types arrive at the loop
+* having spent different amounts; this is the ceiling on the total, and a total
+* does not need to know which terms produced it.
+*/
+const DYNAMODB_DELETE_BUDGET_MS = 26 * 6e4;
+/**
+* What both DynamoDB providers self-report through `getMinResourceTimeoutMs()`.
+*
+* The engine resolves the per-resource deadline as
+* `perTypeCliOverride ?? max(getMinResourceTimeoutMs(), slowTypeFloor,
+* globalCliDefault)`, so declaring this makes "the budget fits inside the
+* deadline" a GUARANTEE rather than an assumption about the CLI default: a user
+* who lowers `--resource-timeout` globally can no longer re-create the crossing
+* this module exists to remove. It equals today's `DEFAULT_RESOURCE_TIMEOUT_MS`
+* (30 min), so at default settings nothing moves — `max(30m, 30m)` is 30m.
+*
+* A per-type override (`--resource-timeout AWS::DynamoDB::Table=5m`) still
+* wins; that is the documented escape hatch, and it is the only way to make
+* this type abort sooner than its self-report.
+*/
+const DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS = 18e5;
+/**
+* Test seam for the budget, mirroring the providers' `deleteTableRetryDelays`
+* sleep seams. Production leaves BOTH fields unset, so
+* {@link DYNAMODB_DELETE_BUDGET_MS} and the real wall clock apply.
+*
+* `clock` is here rather than only `totalMs` because the behaviour worth
+* testing is what happens as the budget DRAINS, and a test cannot drain a
+* 26-minute allowance by waiting. Shrinking `totalMs` alone reaches the
+* clamped-poll-count arm but never the EXHAUSTED one, which is the arm that
+* stops the retry loop and preserves AWS's own message — the whole point of
+* issue #1955. A controllable clock reaches both, deterministically, without
+* `vi.useFakeTimers()` freezing the provider's own polling loops.
+*/
+const dynamoDbDeleteBudgetOverride = {};
+function resolveDynamoDbDeleteBudgetMs() {
+	const override = dynamoDbDeleteBudgetOverride.totalMs;
+	return override !== void 0 && override > 0 ? override : DYNAMODB_DELETE_BUDGET_MS;
+}
+function resolveDynamoDbDeleteBudgetClock() {
+	return dynamoDbDeleteBudgetOverride.clock ?? monotonicNowMs;
+}
+/**
+* The registry key for one table's delete allowance.
+*
+* A DynamoDB table NAME is unique per region, not globally, so a bare
+* `physicalId` collides across regions and the second table silently inherits
+* the first's spent allowance. In practice `destroy-runner.ts` builds a fresh
+* provider (and therefore a fresh registry) per region, so the collision is not
+* reachable today — but that is an invariant of the CALLER, enforced nowhere,
+* and the fix costs one string concat. `\0` cannot appear in either component.
+*
+* `region` is the STATE's region (`DeleteContext.expectedRegion`), which is
+* available synchronously at the top of `delete()` — unlike the client's own
+* region, which needs an await and would push the acquire past the
+* `--remove-protection` flip. Pre-region state records leave it undefined,
+* which degrades to the old bare-name key rather than failing.
+*/
+function deleteBudgetKey(physicalId, region) {
+	return `${region ?? ""}\u0000${physicalId}`;
+}
+/**
+* The poll cap a wait may actually use: its own constant, or what the shared
+* budget can still afford, whichever is smaller.
+*
+* `budget` is optional and an absent one means "unbounded by this mechanism" —
+* the CREATE / UPDATE callers of these same waits keep their original caps
+* verbatim, since the deadline arithmetic this fixes is the delete path's.
+*/
+function pollsWithinDeleteBudget(cap, budget) {
+	if (!budget) return {
+		attempts: cap,
+		cap,
+		clampedByBudget: false
+	};
+	const attempts = budget.attemptsWithin(cap, DYNAMODB_DELETE_POLL_COST_MS);
+	return {
+		attempts,
+		cap,
+		clampedByBudget: attempts < cap
+	};
+}
+/**
+* Polls below which a wait is not EVIDENCE about AWS, only evidence that cdkd
+* stopped asking.
+*
+* The warn-versus-throw split on `waitForTableGone`, and the strong wording of
+* the exhaustion note, both hang off this, and before it existed both hung off
+* `attempts < cap` — which is arithmetic, not evidence. With ~14 min of the
+* allowance already spent a 600-poll wait is still granted ~500 polls, i.e.
+* ten real minutes of `DescribeTable`; calling that "cdkd's allowance ran out,
+* AWS was not given a real wait" is false, and downgrading its failure to a
+* warning is a decision made by two minutes of wall clock rather than by
+* anything the user can act on.
+*
+* 60 polls (~72s) because the provider's own gone-wait note records that a
+* typical small-table delete completes in 5-30s: past roughly twice the top of
+* that range, cdkd HAS given AWS a real wait and a table still present is a
+* signal about AWS. Below it, cdkd barely looked, and the honest report is
+* about cdkd rather than about the table.
+*/
+const DELETE_SHORT_WAIT_POLLS = 60;
+var DeleteWaitImpl = class {
+	cap;
+	grantedPolls;
+	ran = 0;
+	brokeEarly = false;
+	entryClamped;
+	budget;
+	constructor(cap, budget) {
+		const polls = pollsWithinDeleteBudget(cap, budget);
+		this.cap = polls.cap;
+		this.grantedPolls = polls.attempts;
+		this.entryClamped = polls.clampedByBudget;
+		this.budget = budget;
+	}
+	nextPoll() {
+		if (this.ran >= this.grantedPolls) return false;
+		if (this.ran >= 1 && this.budget?.isExhausted() === true) {
+			this.brokeEarly = true;
+			return false;
+		}
+		this.ran += 1;
+		return true;
+	}
+	get pollsRun() {
+		return this.ran;
+	}
+	get endedByBudget() {
+		return this.brokeEarly || this.entryClamped;
+	}
+	get cutShort() {
+		return this.endedByBudget && this.ran < 60;
+	}
+	note() {
+		if (!this.endedByBudget) return "";
+		const minutes = Math.max(1, Math.round((this.budget?.totalMs ?? 0) / 6e4));
+		if (this.cutShort) return ` — cdkd's shared ~${minutes}-minute delete allowance was already spent, so this wait made only ${this.ran} of its ${this.cap} polls and AWS was not given a real wait. Nothing is necessarily wrong with the table; re-run the destroy.`;
+		return ` (cdkd's shared ~${minutes}-minute delete allowance capped this wait at ${this.ran} of its ${this.cap} polls.)`;
+	}
+};
+/** Begin a delete-path wait that draws on the shared allowance. */
+function beginDeleteWait(cap, budget) {
+	return new DeleteWaitImpl(cap, budget);
+}
+/**
+* `withRetry` retries the delete-path auto-scaling teardown may still fund.
+*
+* The teardown runs BEFORE the first budgeted poll — table-level plus one call
+* per GSI, per non-local replica, then again locally — and until this change it
+* had NO retry at all: the two `withRetry` sites in `applyAutoScalingDiff` are
+* both in the REGISTER branch, and every delete-path caller passes
+* `newSettings: undefined`, which takes the bare-`send` teardown branch. (An
+* earlier revision of this file claimed the teardown inherited `withRetry`'s
+* default schedule and would therefore spend ~47s per call under account-wide
+* throttling; that was false, and the clamp built on it was inert. The claim is
+* recorded here because it is the kind of arithmetic a later reader would
+* otherwise trust.)
+*
+* The teardown is now wrapped in the same throttle-only retry the register
+* branch uses, for the symmetric reason: that branch retries because an
+* un-retried `ThrottlingException` leaves a target silently UNregistered, and
+* an un-retried throttle here leaves one silently REGISTERED — the PR #403 leak
+* a future table of the same name inherits. Retrying is what makes a bound
+* necessary, and the bound is what makes retrying safe on a path that shares
+* one deadline with everything after it.
+*
+* Retries are bounded rather than the CALL being skipped, deliberately. The
+* teardown exists because a surviving scalable target is silently inherited by
+* a future table of the same name (PR #403), and skipping re-introduces that
+* leak. So a drained allowance still issues every call once —
+* `withRetry` with `maxRetries: 0` runs the operation exactly once — and still
+* warns actionably on each failure; it just stops paying to retry them.
+*/
+function autoScalingRetriesWithinDeleteBudget(budget, defaultMaxRetries) {
+	if (!budget) return defaultMaxRetries;
+	const surplusMs = budget.remainingMs() - AUTO_SCALING_TEARDOWN_RESERVE_MS;
+	if (surplusMs <= 0) return 0;
+	return Math.max(0, Math.min(defaultMaxRetries, Math.floor(surplusMs / AUTO_SCALING_RETRY_STEP_MS)));
+}
+/**
+* The part of the allowance the auto-scaling teardown may NOT spend on retries.
+*
+* Sized so the terms that actually delete the table — the #1521 gate, the
+* index-busy loop and the gone-wait — keep the bulk of the allowance no matter
+* how throttled the teardown is. 20 of the 26 minutes, leaving the teardown up
+* to ~6 min of retry backoff, which at ~8s a retry is ~45 retries spread across
+* however many calls the table's index and replica count produce.
+*/
+const AUTO_SCALING_TEARDOWN_RESERVE_MS = 20 * 6e4;
+/** `withRetry`'s capped backoff step (`maxDelayMs`), the cost of one retry. */
+const AUTO_SCALING_RETRY_STEP_MS = 8e3;
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -15097,11 +15625,47 @@ var DynamoDBTableProvider = class {
 		"ContributorInsightsSpecification"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])]]);
+	/**
+	* The ONE wall-clock allowance each `delete()` spends, keyed by physical id
+	* (issue #1955). Keyed rather than per-call because `destroy-runner.ts` can
+	* RE-ENTER `delete()` from the top: a THROTTLED `DeleteTable` is not retried
+	* by the index-busy loop below — that classifier is message-scoped by design
+	* — so it escapes to the outer loop, which DOES class throttles as retryable
+	* and pays the whole settle-and-retry sequence a second time inside the same
+	* per-resource deadline (2 x ~19.6 min ~= ~39 min after issue #1950 raised
+	* this type's retry budget to 14). A per-call budget would hand that second
+	* pass a fresh allowance; this one does not. Keyed rather than per-instance
+	* because a destroy level deletes its resources CONCURRENTLY through one
+	* provider instance.
+	*/
+	deleteBudgets = new ElapsedBudgetRegistry();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
 	}
 	/**
+	* Self-reported minimum per-resource deadline (issue #1955).
+	*
+	* The engine resolves the deadline as
+	* `perTypeCliOverride ?? max(getMinResourceTimeoutMs(), globalCliDefault)`,
+	* so declaring this is what turns "the shared delete budget fits inside the
+	* deadline" from an assumption about the CLI default into a guarantee. It
+	* equals today's `DEFAULT_RESOURCE_TIMEOUT_MS`, so at default settings this
+	* changes nothing.
+	*
+	* **It is TYPE-level, not operation-level**, and that is a real consequence
+	* rather than a detail: `deploy-engine.ts` and `destroy-runner.ts` both fold
+	* it in through the same `Math.max(...)`, so a user running
+	* `--resource-timeout 5m` for fail-fast CI gets 30 minutes for this type's
+	* CREATE and UPDATE too, not only for the DELETE the budget is about. The
+	* interface has no per-operation form, and the escape hatch for anyone who
+	* wants the shorter deadline back is the per-type override
+	* (`--resource-timeout AWS::DynamoDB::Table=5m`), which still wins.
+	*/
+	getMinResourceTimeoutMs() {
+		return DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS;
+	}
+	/**
 	* Create a DynamoDB table
 	*/
 	async create(logicalId, resourceType, properties, context) {
@@ -15391,6 +15955,7 @@ var DynamoDBTableProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting DynamoDB table ${logicalId}: ${physicalId}`);
+		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -15398,7 +15963,7 @@ var DynamoDBTableProvider = class {
 			}));
 			this.logger.debug(`Disabled DeletionProtectionEnabled on DynamoDB table ${logicalId}, waiting for ACTIVE`);
 			try {
-				await this.waitForTableActiveAfterUpdate(physicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, 60, budget);
 			} catch (waitErr) {
 				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after disabling protection: ${waitErr instanceof Error ? waitErr.message : String(waitErr)}`);
 			}
@@ -15406,6 +15971,13 @@ var DynamoDBTableProvider = class {
 			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
 		}
 		try {
+			const reArmPolls = () => {
+				const wait = beginDeleteWait(60, budget);
+				return {
+					maxAttempts: wait.grantedPolls,
+					budgetWait: wait
+				};
+			};
 			await deleteTableWithIndexBusyRetry({
 				logicalId,
 				physicalId,
@@ -15420,16 +15992,23 @@ var DynamoDBTableProvider = class {
 					logicalId,
 					logger: this.logger,
 					describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId })),
-					maxAttempts: 60,
+					...reArmPolls(),
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
 				}),
+				shouldKeepRetrying: () => {
+					if (!budget.isExhausted()) return true;
+					this.logger.warn(`DynamoDB table ${logicalId}: giving up the index-busy DeleteTable retry on ${physicalId} — the delete path has spent its whole ${Math.round(budget.totalMs / 6e4)}-minute budget. AWS's own message follows; re-running the destroy succeeds once the index is ACTIVE.`);
+					return false;
+				},
 				sleepSeam: deleteTableRetryDelays$1
 			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
+			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
+				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -15770,12 +16349,13 @@ var DynamoDBTableProvider = class {
 	* blanket raise would turn every genuinely wedged capacity edit into a
 	* 10-minute hang.
 	*/
-	async waitForTableActiveAfterUpdate(tableName, maxAttempts = 60) {
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+	async waitForTableActiveAfterUpdate(tableName, maxAttempts = 60, budget) {
+		const wait = beginDeleteWait(maxAttempts, budget);
+		while (wait.nextPoll()) {
 			if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
 			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
-		throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`);
+		throw new Error(`Table ${tableName} did not reach ACTIVE status within ${wait.pollsRun} seconds after UpdateTable${wait.note()}`);
 	}
 	/**
 	* Poll DescribeTable until the table is ACTIVE AND every Global Secondary
@@ -16581,6 +17161,19 @@ var DynamoDBGlobalTableProvider = class {
 	* UpdateTable success.
 	*/
 	attributeCache = /* @__PURE__ */ new Map();
+	/**
+	* The ONE wall-clock allowance each `delete()` spends, keyed by physical id
+	* (issue #1955). Keyed rather than per-call because `destroy-runner.ts` can
+	* RE-ENTER `delete()` from the top — its outer retry loop classes a throttled
+	* `DeleteTable` as retryable — inside the SAME per-resource deadline, and a
+	* per-call budget would hand that second pass a fresh allowance. Keyed rather
+	* than per-instance because a destroy level deletes its resources
+	* CONCURRENTLY through this one provider instance.
+	*
+	* See `./dynamodb-delete-budget.ts` for the sizing and for the three failure
+	* terms it closes.
+	*/
+	deleteBudgets = new ElapsedBudgetRegistry();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
@@ -16602,6 +17195,29 @@ var DynamoDBGlobalTableProvider = class {
 		this.dynamoDBClient = awsClients.dynamoDB;
 	}
 	/**
+	* Self-reported minimum per-resource deadline (issue #1955).
+	*
+	* The engine resolves the deadline as
+	* `perTypeCliOverride ?? max(getMinResourceTimeoutMs(), globalCliDefault)`,
+	* so declaring this is what turns "the shared delete budget fits inside the
+	* deadline" from an assumption about the CLI default into a guarantee: a user
+	* who lowers `--resource-timeout` globally can no longer re-create the
+	* crossing the budget exists to remove. It equals today's
+	* `DEFAULT_RESOURCE_TIMEOUT_MS`, so at default settings this changes nothing.
+	*
+	* **It is TYPE-level, not operation-level**, and that is a real consequence
+	* rather than a detail: `deploy-engine.ts` and `destroy-runner.ts` both fold
+	* it in through the same `Math.max(...)`, so a user running
+	* `--resource-timeout 5m` for fail-fast CI gets 30 minutes for this type's
+	* CREATE and UPDATE too, not only for the DELETE the budget is about. The
+	* interface has no per-operation form, and the escape hatch for anyone who
+	* wants the shorter deadline back is the per-type override
+	* (`--resource-timeout AWS::DynamoDB::GlobalTable=5m`), which still wins.
+	*/
+	getMinResourceTimeoutMs() {
+		return DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS;
+	}
+	/**
 	* Return a `DynamoDBClient` pinned to the given region, caching per
 	* region for the lifetime of this provider instance. Uses the default
 	* credential chain (env / shared config / IAM role) — no explicit
@@ -17561,7 +18177,8 @@ var DynamoDBGlobalTableProvider = class {
 	* create-only field with no corresponding `RegisterScalableTarget`
 	* surface; `readAutoScalingSettings` also explicitly skips it.
 	*/
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName) {
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget) {
+		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		const policyName = `${metricType}:${resourceId}`;
@@ -17585,6 +18202,7 @@ var DynamoDBGlobalTableProvider = class {
 					MaxCapacity: maxCapacity
 				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
+					maxRetries: asMaxRetries,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 			} catch (err) {
@@ -17614,6 +18232,7 @@ var DynamoDBGlobalTableProvider = class {
 					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
 				})), `${policyName}`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
+					maxRetries: asMaxRetries,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
@@ -17629,21 +18248,29 @@ var DynamoDBGlobalTableProvider = class {
 			return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
 		};
 		try {
-			await asClient.send(new DeleteScalingPolicyCommand({
+			await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
 				PolicyName: policyName,
 				ServiceNamespace: "dynamodb",
 				ResourceId: resourceId,
 				ScalableDimension: dimension
-			}));
+			})), `${resourceId} (${dimension})`, {
+				isRetryable: (_message, error) => isThrottlingError(error),
+				maxRetries: asMaxRetries,
+				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+			});
 		} catch (err) {
 			if (!isObjectNotFound(err)) this.logger.warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 		}
 		try {
-			await asClient.send(new DeregisterScalableTargetCommand({
+			await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 				ServiceNamespace: "dynamodb",
 				ResourceId: resourceId,
 				ScalableDimension: dimension
-			}));
+			})), `${resourceId} (${dimension})`, {
+				isRetryable: (_message, error) => isThrottlingError(error),
+				maxRetries: asMaxRetries,
+				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+			});
 			this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 		} catch (err) {
 			if (!isObjectNotFound(err)) this.logger.warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
@@ -17792,6 +18419,7 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting DynamoDB GlobalTable ${logicalId}: ${physicalId}`);
+		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -17799,7 +18427,7 @@ var DynamoDBGlobalTableProvider = class {
 			}));
 			this.logger.debug(`Disabled DeletionProtectionEnabled on ${logicalId}, waiting for ACTIVE`);
 			try {
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget);
 			} catch (waitErr) {
 				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after protection flip: ${waitErr instanceof Error ? waitErr.message : String(waitErr)}`);
 			}
@@ -17823,25 +18451,26 @@ var DynamoDBGlobalTableProvider = class {
 				const region = replica.RegionName;
 				if (!region || region === currentRegion) continue;
 				try {
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region));
-					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget);
+					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
 					}));
-					await this.waitForReplicaGone(physicalId, region, logicalId);
+					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget);
 				} catch (replicaErr) {
 					if (!(replicaErr instanceof ResourceNotFoundException$1)) throw replicaErr;
 				}
 			}
 			const localAsClient = await this.getLocalAutoScalingClient();
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient);
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient, void 0, budget);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient, void 0, budget);
 			for (const indexName of tableIndexNames) {
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName);
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName, budget);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName, budget);
 			}
 		} catch (describeErr) {
+			if (describeErr instanceof ProvisioningError) throw describeErr;
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
 				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeErr instanceof Error ? describeErr.message : String(describeErr)}`, resourceType, logicalId, physicalId, cause);
@@ -17850,7 +18479,10 @@ var DynamoDBGlobalTableProvider = class {
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
 				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
-				await this.waitForIndexesActive(physicalId, logicalId, { proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE });
+				await this.waitForIndexesActive(physicalId, logicalId, {
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
+					budget
+				});
 			}
 			await deleteTableWithIndexBusyRetry({
 				logicalId,
@@ -17863,16 +18495,24 @@ var DynamoDBGlobalTableProvider = class {
 				},
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
 					maxAttempts: 60,
-					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
+					budget
 				}),
+				shouldKeepRetrying: () => {
+					if (!budget.isExhausted()) return true;
+					this.logger.warn(`DynamoDB GlobalTable ${logicalId}: giving up the index-busy DeleteTable retry on ${physicalId} — the delete path has spent its whole ${Math.round(budget.totalMs / 6e4)}-minute budget. AWS's own message follows; re-running the destroy succeeds once the index is ACTIVE.`);
+					return false;
+				},
 				sleepSeam: deleteTableRetryDelays
 			});
-			await this.waitForTableGone(physicalId, logicalId);
+			await this.waitForTableGone(physicalId, logicalId, 600, budget);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
+			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
+				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -18444,9 +19084,10 @@ var DynamoDBGlobalTableProvider = class {
 	* rejection as the backstop, which is the behavior it had before #1521 for
 	* every case except the one the wait exists to fix.
 	*/
-	async waitForTableActiveAfterUpdate(tableName, logicalId, maxAttempts = 600) {
+	async waitForTableActiveAfterUpdate(tableName, logicalId, maxAttempts = 600, budget) {
+		const wait = beginDeleteWait(maxAttempts, budget);
 		let tableReachedActive = false;
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+		while (wait.nextPoll()) {
 			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			if (response.Table?.TableStatus === "ACTIVE") {
 				tableReachedActive = true;
@@ -18454,11 +19095,12 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
+		const budgetNote = wait.note();
 		if (tableReachedActive) {
-			this.logger.warn(`Indexes on ${tableName} (${logicalId}) were still transitioning after ${maxAttempts}s — a large index backfill can outlive this wait. Proceeding; AWS rejects the next call if it is still too early.`);
+			this.logger.warn(`Indexes on ${tableName} (${logicalId}) were still transitioning after ${wait.pollsRun}s — a large index backfill can outlive this wait. Proceeding; AWS rejects the next call if it is still too early.${budgetNote}`);
 			return;
 		}
-		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${maxAttempts}s after UpdateTable`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(`Table ${tableName} did not reach ACTIVE within ${wait.pollsRun}s after UpdateTable${budgetNote}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
 	* Wait until every GSI reports `IndexStatus: ACTIVE` (Issue #1419).
@@ -18503,18 +19145,25 @@ var DynamoDBGlobalTableProvider = class {
 	* passes {@link DELETE_INDEX_WAIT_PROCEED_NOTE}.
 	*/
 	async waitForIndexesActive(tableName, logicalId, opts) {
+		const gateWait = beginDeleteWait(opts?.maxAttempts ?? 900, opts?.budget);
 		await waitForIndexesSettled({
 			tableName,
 			logicalId,
 			logger: this.logger,
 			describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
-			maxAttempts: opts?.maxAttempts ?? 900,
+			maxAttempts: gateWait.grantedPolls,
+			budgetWait: gateWait,
 			proceedNote: opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it."
 		});
 	}
 	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
-	* Replica provisioning typically takes 1–5 min; cap at 10 min.
+	* Replica provisioning typically takes 1–5 min; capped at
+	* {@link REPLICA_GONE_WAIT_ATTEMPTS} polls — ~12 min at the MEASURED ~1.2s
+	* per poll (a sleep plus a `DescribeTable` round trip), not the ~10 min the
+	* `1 poll = 1s` reading gives. The delete-path arithmetic in
+	* `./dynamodb-delete-budget.ts` prices it at the measured figure, so the two
+	* have to agree.
 	*/
 	async waitForReplicaActive(tableName, region, logicalId, maxAttempts = 600) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -18528,17 +19177,19 @@ var DynamoDBGlobalTableProvider = class {
 	/**
 	* Wait until a specific replica disappears from `Replicas[]` after a
 	* Delete replica update. Replica deletion typically takes 1–5 min;
-	* cap at 10 min.
+	* capped at {@link REPLICA_GONE_WAIT_ATTEMPTS} polls (~12 min at the
+	* measured ~1.2s per poll).
 	*/
-	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS) {
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS, budget) {
+		const wait = beginDeleteWait(maxAttempts, budget);
+		while (wait.nextPoll()) try {
 			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
 			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
 		}
-		throw new ProvisioningError(`Replica ${region} for table ${tableName} did not disappear within ${maxAttempts}s`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(`Replica ${region} for table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	/**
 	* Wait for `DescribeTable` to return `ResourceNotFoundException`,
@@ -18548,18 +19199,26 @@ var DynamoDBGlobalTableProvider = class {
 	* wait, downstream observers (siblings deleted in the same destroy
 	* run, integ scripts that re-check via `aws dynamodb describe-table`)
 	* see "destroy succeeded" but the table is still listed by AWS.
-	* Typical small-table delete completes in 5–30s; cap at 10 min for
-	* worst-case large-table / replica-cascade scenarios.
-	*/
-	async waitForTableGone(tableName, logicalId, maxAttempts = 600) {
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+	* Typical small-table delete completes in 5–30s; capped at
+	* {@link TABLE_GONE_WAIT_ATTEMPTS} polls (~12 min at the measured ~1.2s per
+	* poll) for worst-case large-table / replica-cascade scenarios. That 5-30s
+	* figure is what {@link DELETE_SHORT_WAIT_POLLS} is calibrated against: past
+	* roughly twice the top of it, cdkd HAS given AWS a real wait.
+	*/
+	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget) {
+		const wait = beginDeleteWait(maxAttempts, budget);
+		while (wait.nextPoll()) try {
 			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
 		}
-		throw new ProvisioningError(`Table ${tableName} did not disappear within ${maxAttempts}s`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		if (wait.cutShort) {
+			this.logger.warn(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${tableName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`);
+			return;
+		}
+		throw new ProvisioningError(`Table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 };
 /**
@@ -18660,6 +19319,19 @@ const autoScalingRetryDelays = {};
 */
 const REPLICA_GONE_WAIT_ATTEMPTS = 600;
 /**
+* Polls the `--remove-protection` flip's ACTIVE wait spends
+* (`waitForTableActiveAfterUpdate`).
+*
+* EXPORTED and named rather than left as an inline default argument because it
+* is a TERM of the delete-path deadline arithmetic (see
+* `./dynamodb-delete-budget.ts`): on `cdkd destroy --remove-protection` it runs
+* FIRST, ahead of the #1521 gate, and the wait it performs is the same
+* indexes-settled one the rest of the path is about. The budget fence in the
+* unit suite reads THIS rather than a copied literal, after the sibling
+* arithmetic was twice found asserting a cap the provider no longer had.
+*/
+const GLOBAL_TABLE_ACTIVE_WAIT_ATTEMPTS = 600;
+/**
 * Polls `waitForTableGone` spends confirming the table is actually gone.
 *
 * EXPORTED, unlike its replica sibling, because the delete-path budget fence
@@ -57586,6 +58258,8 @@ async function deployCommand(stacks, options) {
 		const summary = workGraph.summary();
 		logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
 		const bufferStackOutput = targetStacks.length > 1;
+		let totalUnaddressed = 0;
+		let cancelledStacks = 0;
 		const runStack = async (stackInfo) => {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
@@ -57718,6 +58392,8 @@ async function deployCommand(stacks, options) {
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
 				if (deployResult.updatePartial > 0) logger.info(`    of which left an orphaned predecessor: ${yellow(deployResult.updatePartial)}`);
+				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial;
+				if (!options.dryRun) totalUnaddressed += stackUnaddressed;
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -57726,15 +58402,20 @@ async function deployCommand(stacks, options) {
 					for (const [key, value] of Object.entries(deployResult.outputs)) logger.info(`  ${deployResult.stackName}.${key} = ${String(value)}`);
 				}
 				if (options.dryRun) logger.info(`\n${green("✓")} ${bold("Dry run completed")} - no actual changes made`);
+				else if (stackUnaddressed > 0) logger.warn(`\n⚠ ${bold(`Stack ${deployResult.stackName} deployed, but ${stackUnaddressed} resource(s) were left unaddressed`)} — they may still exist in AWS. ` + (options.allowUnaddressed ? `Exiting 0 because --allow-unaddressed was passed.` : "This counts toward a non-zero exit (2 unless something else fails; pass --allow-unaddressed to exit 0)."));
 				else logger.info(`\n${green("✓")} ${bold("Deployment completed successfully")}`);
-				recordRunSucceeded(eventRecorder, stackInfo.stackName, {
+				if (!options.dryRun && stackUnaddressed > 0) runResult = "FAILED";
+				recordRunOutcome(eventRecorder, stackInfo.stackName, runResult, {
 					created: deployResult.created,
 					updated: deployResult.updated + deployResult.updatePartial,
 					deleted: deployResult.deleted,
 					...deployResult.deleteSkipped + deployResult.updatePartial > 0 && { skipped: deployResult.deleteSkipped + deployResult.updatePartial }
 				}, deployResult.durationMs);
 			} catch (deployError) {
-				if (deployError instanceof DeployCancelledError) return;
+				if (deployError instanceof DeployCancelledError) {
+					cancelledStacks++;
+					return;
+				}
 				runResult = "FAILED";
 				recordRunFailed(eventRecorder, stackInfo.stackName, deployError);
 				throw deployError;
@@ -57763,6 +58444,7 @@ async function deployCommand(stacks, options) {
 				if (!outcome.ok) throw outcome.error;
 			}
 		});
+		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. ` + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
 	} finally {
 		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
@@ -81373,7 +82055,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;