@go-to-k/cdkd 0.284.23 → 0.284.25

package/dist/{deploy-engine-HfFU96oJ.js → deploy-engine-BpZWPiaL.js}

@@ -16860,7 +16860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cucl2K22.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B2lPfJBN.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -17531,6 +17531,280 @@ var CloudControlProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/interrupt-watch.ts
+/**
+* The ONE interrupt watch every bounded wait under `src/provisioning/**` uses
+* (issues #2053 / #1952, consolidating the per-invocation shape PR #2033
+* introduced in `providers/custom-resource-provider.ts`).
+*
+* WHY A WAIT NEEDS ONE AT ALL
+* ---------------------------
+* `withRetry` (`src/deployment/retry.ts`) is the only wait in cdkd that
+* consults an interrupt DURING a backoff — it probes once a second while
+* sleeping. The deploy engine, `destroy-runner.ts` and `rollback-executor.ts`
+* all poll only BETWEEN operations. So a retry that threads nothing is dead to
+* Ctrl-C for its whole schedule, and on the destroy path `withResourceTimeout`
+* has by then abandoned the promise WITHOUT cancelling it, so the loop keeps
+* issuing writes behind a run the user was told had ended.
+* `docs/provider-development.md` states the requirement; `vp run
+* audit:withretry-interrupt:check` enforces it.
+*
+* WHY IT IS SHARED RATHER THAN PER MODULE
+* ---------------------------------------
+* Four modules carried a copy before issue #2104, and the copies could not
+* agree about the one thing that matters: a single `delete()` traverses more
+* than one of them, so a SIGINT marked only whichever module happened to hold a
+* live watch. One module means one latch, one error type, and ONE process
+* listener rather than four.
+*
+* FOUR PROPERTIES, EACH LOAD-BEARING
+* ----------------------------------
+*
+* 1. **The flag is per WAIT, never on a provider.** Providers are registered as
+*    SINGLETONS serving concurrent resources, so provider-level state is some
+*    other resource's.
+*
+* 2. **The latch is STICKY.** A watch STARTED after the signal begins is
+*    already interrupted. Clearing it when the last watch is disposed — the
+*    first cut — is wrong for exactly the case issue #1952 is about: a
+*    `GlobalTable` delete runs the #1521 gate, then the index-busy retry loop,
+*    then the gone-wait, each disposing before the next begins, so a SIGINT
+*    during the gate left the two multi-minute waits after it DEAF. Only a
+*    COMMAND clears it. The listener is likewise never torn down BETWEEN two
+*    waits: one removed in that gap cannot record a signal landing in it, which
+*    is the same bug one layer down. {@link endCommandInterruptScope} removes it
+*    at command END, where there is no next wait to miss.
+*
+* 3. **It arms only inside a command that OWNS interrupt handling.** Registering
+*    any SIGINT listener disables Node's default terminate, so a command with no
+*    graceful shutdown of its own must not gain one here: `cdkd drift --revert`
+*    reaches `provider.update` and installs nothing, and an armed watch there
+*    would leave Ctrl-C setting flags nobody reads while the command carried on
+*    writing to AWS — needing a SIGKILL.
+*
+*    The gate is an explicit flag raised by
+*    {@link beginCommandInterruptScope}, which `forwardSigtermToSigint()` calls
+*    at command start. It is deliberately NOT
+*    `process.listenerCount('SIGINT') > 0`, which was the first cut and is
+*    defeated by the very case it was meant to catch: `cdkd drift` runs
+*    `provider.update` at concurrency 4, and a concurrent CloudFront / ACM /
+*    Route53 wait installs a TRANSIENT SIGINT listener of its own — so an ELBv2
+*    update starting inside that window saw a non-zero count, armed, and then
+*    kept the listener for the rest of the command after the transient one was
+*    removed. A count answers "is anyone listening right now"; the question is
+*    "does this COMMAND have a shutdown path", and only the command can say.
+*    (`forwardSigtermToSigint` itself registers on SIGTERM only, so it never
+*    satisfied the count either — a detail an earlier version of this comment
+*    got wrong, which is how the gap survived a review.)
+*
+*    Arming is re-attempted on every watch, so a wait that runs before the
+*    command opens its scope does not poison later ones.
+*
+* 4. **The handler force-quits when it is the LAST listener.** Property 3 gets
+*    the watch armed only under a command with a shutdown path, but that path
+*    is not live for the command's whole duration: `destroy.ts` registers no
+*    SIGINT handler of its own, and `destroy-runner.ts` removes its one in a
+*    `finally` — so between two stacks of a multi-stack destroy the shared
+*    handler is the ONLY listener. Merely latching there SWALLOWS the Ctrl-C:
+*    the process does not exit, `draining` is never set, `result.interrupted`
+*    stays false, and the loop proceeds to delete the NEXT stack after the user
+*    asked to stop — this file's own headline failure, one layer out.
+*
+*    So when no other listener remains, the handler restores exactly what Node
+*    would have done with no listener at all. That is deliberately not a second
+*    graceful path: inventing one would duplicate `destroy-runner.ts`'s drain
+*    and have to be kept in sync with it, whereas "there is no graceful owner
+*    right now, so terminate" is true by construction and needs no upkeep.
+*/
+/**
+* Thrown by {@link InterruptWatch.onInterrupted}, and the ONE type the whole
+* codebase uses to mean "a wait stopped because the user asked us to stop".
+*
+* It has to be a distinct class rather than a bare `Error` because
+* `deploy-engine.ts` decides whether to ROLL BACK by asking what the failure
+* was. Its own `InterruptedError` is module-private, so a provider cannot
+* produce one; a bare `Error` from a provider therefore read as a genuine
+* resource failure and triggered an automatic rollback of the whole stack on
+* Ctrl-C — strictly worse than the unresponsiveness the threading removes.
+*
+* The explicit `setPrototypeOf` is not decoration: without it a subclass of
+* `Error` loses `instanceof` under this repo's compile target, which would make
+* {@link isInterruptedWaitError} silently answer `false`.
+*/
+var InterruptedWaitError = class InterruptedWaitError extends Error {
+	constructor(what) {
+		super(`${what} interrupted by user (SIGINT)`);
+		this.name = "InterruptedWaitError";
+		Object.setPrototypeOf(this, InterruptedWaitError.prototype);
+	}
+};
+/**
+* Whether `error` IS an interrupt, or WRAPS one.
+*
+* The wrap is the normal case, not the edge case: every provider catch under
+* `src/provisioning/providers/**` re-throws AWS failures as a
+* `ProvisioningError` threading the original as `cause` (issue #2040, enforced
+* by `vp run audit:provider-error-cause:check`), so by the time the engine sees
+* an interrupt it is one or more `cause` hops down. A plain `instanceof` check
+* at the engine would therefore have been a placebo.
+*
+* **The walk is bounded by a VISITED SET, not by a depth ceiling**, and the
+* difference decides correctness rather than style. A ceiling has to be sized
+* against the deepest real chain, and that chain GROWS: the flat case is 2 (the
+* provider's own wrap, then the command's), `DagExecutor` adds none — it
+* collects rather than wraps (`dag-executor.ts:178`) — but `deploy-engine.ts`
+* adds one `ProvisioningError` PER NESTED-STACK LEVEL (`deploy-engine.ts:2932`;
+* `NestedStackProvider.create` adds none of its own). A depth-5 cap therefore
+* missed at four levels of nesting, and missing here is not a degraded answer:
+* it is a full automatic rollback on Ctrl-C. The visited set gives the
+* termination the cap was really there for — a cyclic `cause` chain, which
+* would otherwise spin on the ERROR path where nothing else is watching —
+* without a ceiling any legitimate nest can cross.
+*/
+function isInterruptedWaitError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current !== void 0 && current !== null) {
+		if (current instanceof InterruptedWaitError) return true;
+		if (!(current instanceof Error)) return false;
+		if (seen.has(current)) return false;
+		seen.add(current);
+		current = current.cause;
+	}
+	return false;
+}
+const liveWatches = /* @__PURE__ */ new Set();
+let sharedSigintHandler;
+let sigintLatched = false;
+/**
+* Test seam for the "this command owns interrupt handling" gate and for the
+* force-quit in property 4.
+*
+* Production never assigns either, and neither condition may be weakened to
+* accommodate tests: a command without a shutdown path really must keep Node's
+* default terminate, and a swallowed Ctrl-C in a multi-stack destroy really is
+* a blocker. `cdkd drift --revert` and `cdkd destroy` are the live instances.
+*
+* `commandOwnsInterrupts` exists because a provider suite never runs a COMMAND,
+* so every interrupt test would otherwise exercise the UNARMED path while
+* appearing to test the armed one — the worst of both, since it fails for a
+* reason unrelated to what the test claims. `forceQuit` exists because the real
+* one calls `process.exit`, which would take the test runner with it.
+*/
+const interruptWatchTestSeam = {};
+/**
+* How many command scopes are currently open.
+*
+* A COUNTER rather than a boolean, because a boolean is only correct while
+* scopes never overlap. The CLI runs one command per process so they do not
+* today — but this module's own contract offers itself to "a host that runs
+* more than one command", and under a boolean the inner scope's `end` would
+* remove the shared listener and clear the OUTER command's sticky latch
+* mid-run, so a signal landing in the re-arm gap goes unrecorded. That is
+* exactly what property 2 forbids, arrived at from the other direction.
+*/
+let commandInterruptScopeDepth = 0;
+function commandOwnsInterrupts() {
+	const override = interruptWatchTestSeam.commandOwnsInterrupts;
+	if (override !== void 0) return override();
+	return commandInterruptScopeDepth > 0;
+}
+/**
+* Install the ONE process listener, if and only if the running command has
+* declared that it owns interrupt handling. See property 3 for why the "if" is
+* load-bearing rather than defensive.
+*
+* Called on every `startInterruptWatch` rather than once, so a wait that runs
+* before the command opens its interrupt scope leaves the door open instead of
+* latching a permanent "unarmed".
+*/
+function armSharedSigintHandler() {
+	if (sharedSigintHandler !== void 0) return;
+	if (!commandOwnsInterrupts()) return;
+	const handler = () => {
+		sigintLatched = true;
+		for (const live of liveWatches) live.interrupted = true;
+		if (process.listeners("SIGINT").filter((l) => l !== handler).length === 0) {
+			process.stderr.write("\nInterrupted.\nIf the next run reports a stack lock, release it with: cdkd force-unlock <stack-name>\n");
+			(interruptWatchTestSeam.forceQuit ?? ((code) => process.exit(code)))(130);
+		}
+	};
+	sharedSigintHandler = handler;
+	process.on("SIGINT", handler);
+}
+/**
+* Start a watch for ONE wait. `what` names the wait in the thrown message.
+*
+* The caller MUST `dispose()` in a `finally`. A leaked watch is not merely
+* untidy: it stays in {@link liveWatches} forever, and the sticky latch means
+* every wait after a Ctrl-C would keep aborting instantly even if the run
+* somehow continued.
+*/
+function startInterruptWatch(what) {
+	armSharedSigintHandler();
+	const state = { interrupted: sigintLatched };
+	liveWatches.add(state);
+	let disposed = false;
+	return {
+		isInterrupted: () => state.interrupted,
+		onInterrupted: () => new InterruptedWaitError(what),
+		dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			liveWatches.delete(state);
+		}
+	};
+}
+/**
+* Clear the sticky latch.
+*
+* Called by {@link beginCommandInterruptScope} and
+* {@link endCommandInterruptScope}, which bracket one command. On the CLI one
+* process runs one command, so the latch starts false regardless and those
+* calls are belt-and-braces; they earn their keep for a host that runs more
+* than one command, and for unit suites, where every test shares one process
+* and a simulated Ctrl-C would otherwise leak into every test after it.
+*
+* Deliberately NOT wired into `dispose()` — see property 2. That was the first
+* cut and it is precisely the bug: sequential waits always empty the live set
+* between them, so the latch cleared in every gap that mattered.
+*/
+function resetInterruptWatchLatch() {
+	sigintLatched = false;
+	for (const live of liveWatches) live.interrupted = false;
+}
+/**
+* Declare that this command owns interrupt handling, and clear the latch.
+*
+* Called by `forwardSigtermToSigint()` (`src/utils/interrupt-signals.ts`),
+* which every command that reaches a provider wait through a lock invokes at
+* start — `deploy`, `destroy`, `rollback`, `state`. A command that does NOT
+* call it (`cdkd drift`) keeps Node's default terminate, which is the point.
+*/
+function beginCommandInterruptScope() {
+	commandInterruptScopeDepth += 1;
+	if (commandInterruptScopeDepth === 1) resetInterruptWatchLatch();
+}
+/**
+* Close the scope — the command is done.
+*
+* Removing the shared listener HERE does not weaken property 2: what must never
+* happen is a teardown between two sequential WAITS, because a signal landing
+* in that gap would go unrecorded. At command end there is no next wait, and
+* leaving the listener installed would suppress default terminate for whatever
+* runs after.
+*/
+function endCommandInterruptScope() {
+	commandInterruptScopeDepth = Math.max(0, commandInterruptScopeDepth - 1);
+	if (commandInterruptScopeDepth > 0) return;
+	if (sharedSigintHandler !== void 0) {
+		process.removeListener("SIGINT", sharedSigintHandler);
+		sharedSigintHandler = void 0;
+	}
+	resetInterruptWatchLatch();
+}
+
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
 /**
@@ -17575,6 +17849,47 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 */
 const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
 /**
+* Fourth sibling of the three above, for the arm where the handler RAN, was
+* reached, and answered `Status: 'FAILED'` (issue
+* [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* The terminal FAILED arm used to warn and fall through to `return undefined`,
+* which `deleteSkipReason` reads as DELETED — so cdkd dropped the state
+* record, printed the row as deleted and exited 0 over a resource the handler
+* had EXPLICITLY said it did not delete. It is the same silent-orphan class
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON} removed from the throw arm,
+* reached through the handler's RESPONSE instead.
+*
+* **Unconditional, with no already-gone classifier.** A handler that reports
+* FAILED because the thing it manages was already absent is a real and common
+* shape, and today's leniency lets those destroys finish green. Classifying
+* the reason to keep them green was rejected: the reason is free text a user's
+* handler writes, so any classifier is a guess, and a wrong guess
+* re-introduces exactly the orphan this arm exists to stop.
+*
+* This is therefore a COMPATIBILITY BREAK: a destroy whose delete handler
+* reports FAILED now exits 2 with the record kept, where it used to exit 0
+* with the record dropped.
+*
+* **The two callers have DIFFERENT escape hatches, and only one of them is a
+* flag.** On `cdkd deploy` the skip is forced back to exit 0 by
+* `--allow-unaddressed` (issue #1960, the flag that settled the analogous
+* exit-code question). `cdkd destroy` has no such flag — a skip raises
+* `PartialFailureError` unconditionally (`src/cli/commands/destroy.ts`) — so
+* there the remedy is the one that command's own summary names: confirm the
+* resource is gone, then drop the record with `cdkd state orphan <stack>`.
+* Messages must not offer the flag on the destroy path, which is the path this
+* arm is mostly reached from.
+*
+* **Fixed wording, no interpolation**, for the reason spelled out on
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON}: the handler's own `Reason` is a
+* user-authored string, it goes out on the `logger.warn` beside this, and a
+* `Reason` carrying `does not exist` / `not found` would make the deploy-side
+* replacement sites classify the skip as "already gone" and drop the record
+* one layer further out.
+*/
+const CR_DELETE_HANDLER_FAILED_SKIP_REASON = "Delete handler reported FAILED — resource unproven";
+/**
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
@@ -17585,6 +17900,29 @@ const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did n
 * torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
+/**
+* The bound BOTH delete-path skips in this file have to state (found in review
+* of issue [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* A skip KEEPS the state record, and the natural thing to promise is that a
+* re-run retries the handler. **On `cdkd destroy` that promise is false**, and
+* it is false in the direction that matters. `destroy-runner.ts` walks every
+* reverse-DAG level regardless of skips, so the SAME run that skipped the
+* custom resource goes on to delete its backing Lambda. The next
+* `cdkd destroy` therefore reaches the issue-#804 pre-check above, finds the
+* function gone, and treats the resource as already deleted — dropping the
+* record and exiting 0 over a resource the handler explicitly refused to
+* remove, which is the very silent orphan #2054 removed one run earlier.
+*
+* Closing it properly means making that pre-check answer `'skipped'` when the
+* teardown was never PROVEN, which needs a durable "a prior run skipped this"
+* signal. Every candidate is outside this file: a `ResourceState` field (a
+* state-schema bump), or a `DeleteContext` flag threaded from
+* `destroy-runner.ts`. So the record is described here as what it actually is
+* — a POINTER to something that has to be torn down by hand — rather than as a
+* retry that will not happen.
+*/
+const CR_SKIP_NOT_A_RETRY_CAVEAT = "NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' finds the handler gone and DROPS this record (issue 804 pre-check). Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one.";
 const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
 /**
 * Type guard to validate Lambda response payload structure
@@ -17898,25 +18236,50 @@ const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|
 */
 const SNS_SERVICE_TOKEN_ARN_RE = /^arn:aws[a-z0-9-]*:sns:/;
 /**
+* Account segment {@link syntheticStackId} falls back to when STS could not
+* answer (`AwsAccountInfo.fabricated`, issue
+* [#1730](https://github.com/go-to-k/cdkd/issues/1730)).
+*
+* The Cloud Control enrichment sites answer a fabricated account by OMITTING
+* the value they would have built. That is not available here — `StackId` is a
+* REQUIRED member of the custom-resource request payload — so the choice is
+* between two wrong strings, and the honest one is the one a handler cannot
+* mistake for real. `getAccountInfo`'s own fallback id (`123456789012`) is
+* shaped exactly like a live account; the all-zero id is not a valid AWS
+* account and reads as the placeholder it is.
+*/
+const SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT = "000000000000";
+/**
 * The synthetic `StackId` handed to a custom-resource handler in place of the
 * CloudFormation stack ARN cdkd does not have.
 *
-* **Its `arn:aws:` prefix is deliberately NOT partition-derived** (issue
-* #1815, which fixed the SNS routing predicate above). Every segment of this
-* value is fabricated — the region is a fixed `us-east-1` rather than the
-* deploy region, and the account is the all-zero placeholder — so it addresses
-* nothing and cannot be made to. Deriving ONLY the partition would produce a
-* strictly LESS coherent ARN (`arn:aws-cn:cloudformation:us-east-1:0000...`,
-* a China partition carrying a commercial region) while fixing nothing a
-* handler could rely on. The coherent fix is to synthesize the real
-* partition / region / account together, which changes what every handler
-* observes and belongs in its own change.
+* Partition / region / account are synthesized TOGETHER from the real deploy
+* context (issue [#1866](https://github.com/go-to-k/cdkd/issues/1866)). Every
+* segment used to be fabricated — `arn:aws:cloudformation:us-east-1:0000...`
+* regardless of where the deploy actually ran — and CloudFormation-authored
+* handlers DO read `event.StackId`: to re-derive the region / account they are
+* running in, to build ARNs, to name log streams, to correlate a response.
+* Each of those read a coherent-looking ARN and got an answer that addresses
+* nothing.
+*
+* Deriving only ONE segment is worse than deriving none, which is why issue
+* #1815 deliberately left the hardcoded `arn:aws:` prefix alone rather than
+* partition-deriving it in isolation: `arn:aws-cn:cloudformation:us-east-1:…`
+* is a China partition carrying a commercial region, strictly LESS coherent
+* than a uniformly-commercial fabrication. So this takes the whole
+* {@link AwsAccountInfo} — where `partition` is already derived FROM `region`
+* — rather than any one field.
+*
+* The stack-NAME segment stays synthetic (`cdkd-<logicalId>`): cdkd has no
+* CloudFormation stack, so there is no real value to put there.
 *
 * Factored into one place so the rationale cannot go stale against two other
-* copies: the create / update / delete request builders all use it.
+* copies: the create / update / delete request builders all use it, through
+* {@link CustomResourceProvider.resolveSyntheticStackId}.
 */
-function syntheticStackId(logicalId) {
-	return `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`;
+function syntheticStackId(logicalId, accountInfo) {
+	const account = accountInfo.fabricated ? SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT : accountInfo.accountId;
+	return `arn:${accountInfo.partition}:cloudformation:${accountInfo.region}:${account}:stack/cdkd-${logicalId}/cdkd`;
 }
 /**
 * `true` when the tail contains at least one line the HANDLER produced.
@@ -18109,11 +18472,29 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* the placeholder `PutObject`'s `withRetry` takes no knob either.
 	*/
 	preDeliveryAuthzMaxRetries = 26;
+	/**
+	* The region the client bag this provider was built from was EXPLICITLY
+	* configured with, or `undefined` (issue #1866).
+	*
+	* Captured in the constructor, beside the clients, rather than read per call:
+	* `cdkd deploy` builds a region-configured `AwsClients` and a fresh
+	* `ProviderRegistry` per stack, and with `--stack-concurrency` (default 4) it
+	* swaps the process-global bag while other stacks are mid-flight — so a
+	* call-time read can hand a SIBLING stack's region. Pairing it with the
+	* clients keeps the two consistent by construction.
+	*
+	* `AwsClients.configuredRegion` is deliberately the only region a client bag
+	* will answer (see its own note on why `client.config.region()` is unsound),
+	* and `undefined` means no region was pinned anywhere — which
+	* {@link getAccountInfo} then resolves from `AWS_REGION` itself.
+	*/
+	configuredRegion;
 	constructor(config) {
 		const awsClients = getAwsClients();
 		this.lambdaClient = awsClients.lambda;
 		this.snsClient = awsClients.sns;
 		this.s3Client = awsClients.s3;
+		this.configuredRegion = awsClients.configuredRegion;
 		this.responseBucket = config?.responseBucket;
 		this.responsePrefix = config?.responsePrefix ?? "custom-resource-responses";
 		this.asyncResponseTimeoutMs = config?.asyncResponseTimeoutMs ?? CustomResourceProvider.DEFAULT_ASYNC_RESPONSE_TIMEOUT_MS;
@@ -18211,6 +18592,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return this.responseClientResolveInFlight;
 	}
 	/**
+	* Resolve {@link syntheticStackId} against this deploy's REAL account /
+	* region / partition (issue #1866).
+	*
+	* `getAccountInfo` never throws — it answers a `fabricated` account when STS
+	* cannot, which {@link SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT} handles — so
+	* this cannot turn a working deploy into a failing one on the credential
+	* path. It is resolved ONCE per `create` / `update` / `delete` rather than
+	* per invocation attempt: the value does not vary between attempts, and the
+	* request builder the retry loop re-runs is synchronous.
+	*/
+	async resolveSyntheticStackId(logicalId) {
+		const accountInfo = await getAccountInfo(this.configuredRegion);
+		if (accountInfo.fabricated) this.logger.warn(`Custom resource ${logicalId}: STS did not report this deploy's account id, so the synthetic StackId handed to the handler carries the placeholder account ${SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT}. A handler that parses StackId to re-derive the account it is running in will not get a usable one — fix the credentials (or set AWS_ACCOUNT_ID) and re-run.`);
+		return syntheticStackId(logicalId, accountInfo);
+	}
+	/**
 	* Create a custom resource by invoking its Lambda handler
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -18225,7 +18622,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResponseURL: invocation.responseURL,
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
@@ -18257,7 +18654,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties),
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}));
@@ -18298,7 +18695,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		}
 		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run \`cdkd import\` or \`cdkd state orphan <stack>\` to recover.`, resourceType, logicalId, physicalId);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
-			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted`);
+			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted and DROPPING its state record. The handler can never run again, so if its teardown was never PROVEN — e.g. an earlier run reported this resource as skipped (issue 2054) — whatever it manages is still LIVE and is now untracked by cdkd. Check for leftovers before treating the stack as gone.`);
 			return;
 		}
 		try {
@@ -18309,13 +18706,19 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
-			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
-			else this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
+			if (cfnResponse.Status === "FAILED") {
+				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
+				return {
+					outcome: "skipped",
+					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
+				};
+			}
+			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record so a re-run can retry it. ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -18391,13 +18794,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* PRE-delivery throw is safe to replay at all.
 	*
 	* `buildRequest` is called once per attempt with the fresh invocation so the
-	* CFn request body always carries the matching ResponseURL / RequestId.
+	* CFn request body always carries the matching ResponseURL / RequestId. The
+	* synthetic `StackId` rides the same bag although it is stable across
+	* attempts (issue #1866), for an ORDERING reason rather than a freshness one:
+	* resolving it needs an `await`, and every await before the SIGINT watch
+	* below is installed is a window in which Ctrl-C is dead — `docs/
+	* provider-development.md` requires a new wait site to be interruptible, and
+	* the pre-delivery backoff this method owns is 47.75s long.
+	*
 	* Returns the final response; the caller decides what a terminal FAILED means
-	* (create/update throw, delete warns-and-continues).
+	* (create / update throw; delete warns and returns `'skipped'` — issue
+	* #2054, which replaced its warn-and-continue).
 	*/
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
-		const watch = this.startInterruptWatch(logicalId);
+		const watch = startInterruptWatch(`Custom resource ${logicalId}`);
 		try {
+			const stackId = await this.resolveSyntheticStackId(logicalId);
 			let preDeliveryRetries = 0;
 			let failedResponseRetries = 0;
 			for (let attempt = 0;; attempt++) {
@@ -18407,7 +18819,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 				let invocation;
 				try {
 					invocation = await this.prepareInvocation(logicalId, watch);
-					const request = buildRequest(invocation);
+					const request = buildRequest({
+						...invocation,
+						stackId
+					});
 					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
 						delivered = true;
@@ -18943,33 +19358,6 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return customResourceRetryDelays.sleep(ms);
 	}
 	/**
-	* Install a SIGINT watch for one custom-resource invocation (issue #2033).
-	*
-	* `docs/provider-development.md` requires a new `withRetry` to thread
-	* `isInterrupted` / `onInterrupted`, and a hand-rolled backoff to be
-	* interruptible for the same reason: without it Ctrl-C is dead for the whole
-	* 47.75s schedule. The provider already had the shape — `pollS3Response`
-	* installs its own handler — so this is that pattern, lifted so the two new
-	* wait sites share one flag and one disposal.
-	*
-	* The caller MUST `dispose()` in a `finally`; a leaked listener would
-	* accumulate one per resource across a deploy.
-	*/
-	startInterruptWatch(logicalId) {
-		let interrupted = false;
-		const handler = () => {
-			interrupted = true;
-		};
-		process.on("SIGINT", handler);
-		return {
-			isInterrupted: () => interrupted,
-			onInterrupted: () => /* @__PURE__ */ new Error(`Custom resource ${logicalId} interrupted by user`),
-			dispose: () => {
-				process.removeListener("SIGINT", handler);
-			}
-		};
-	}
-	/**
 	* `sleep` that checks the interrupt watch at most a second apart, mirroring
 	* `withRetry`'s own once-per-second probe. Throws the watch's error when the
 	* user has hit Ctrl-C, so the retry loop unwinds instead of sitting out the
@@ -25385,7 +25773,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.23";
+	return "0.284.25";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -26829,7 +27217,7 @@ var DeployEngine = class {
 				this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 			}
 			let autoRollbackClean = false;
-			if (error instanceof InterruptedError) {
+			if (error instanceof InterruptedError || isInterruptedWaitError(error)) {
 				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
 				throw error;
@@ -27599,7 +27987,7 @@ var DeployEngine = class {
 					}), logicalId, 3, 5e3, deleteProvider);
 				} catch (deleteError) {
 					const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+					if (!isInterruptedWaitError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
 				const deleteSkipped = deleteSkipReason(deleteResult);
@@ -28005,5 +28393,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { disableInstanceApiTermination as $, NestedStackChildDirectDestroyError as $n, ensureAssetStorage as $t, isStatefulRecreateTargetSync as A, uploadCfnTemplate as An, s3BucketWebsiteUrl as At, collectPublishedOutputNames as B, getAwsClients as Bn, rebuildClientForBucketRegion as Bt, createPreDeleteFinalSnapshot as C, resolveUseCdkBootstrapAssets as Cn, maskSecretsInText as Ct, makeCanonicalizePropertiesFn as D, CFN_TEMPLATE_URL_LIMIT as Dn, s3BucketDomainName as Dt, unsupportedFinalSnapshotError as E, CFN_TEMPLATE_BODY_LIMIT as En, s3BucketArn as Et, gray as F, AssemblyReader as Fn, withRetry as Ft, IAMRoleProvider as G, ConfigError as Gn, buildAssetRedirectMap as Gt, isExportAliasCollision as H, setAwsClients as Hn, AssetPublisher as Ht, green as I, processStackMessages as In, DagBuilder as It, ProviderRegistry as J, LocalInvokeBuildError as Jn, rewriteTemplateAssetReferences as Jt, collectInlinePolicyNamesManagedBySiblings as K, DependencyError as Kn, createAssetRedirectResolver as Kt, red as L, clearBucketRegionCache as Ln, TemplateParser as Lt, formatResourceLine as M, PARTITION_TABLE as Mn, DiffCalculator as Mt, bold as N, canonicalizeRegion as Nn, INTRINSIC_KEYS as Nt, extractDeploymentEventError as O, MIGRATE_TMP_PREFIX as On, s3BucketDualStackDomainName as Ot, cyan as P, derivePartitionAndUrlSuffix as Pn, describeTypeWithThrottleRetry as Pt, slowCcOperationTimeoutMs as Q, MissingCdkCliError as Qn, BOOTSTRAP_MARKER_PREFIX as Qt, yellow as R, resolveBucketRegion as Rn, LockManager as Rt, ccRoutedFinalSnapshotError as S, resolveStateBucketWithDefaultAndSource as Sn, isSingleDynamicReferenceToken as St, refusesFinalSnapshot as T, warnDeprecatedNoPrefixCliFlag as Tn, scrubResourceRecord as Tt, secretBearingStateKeyWarning as U, AssetError as Un, stringifyValue as Ut, exportAliasCollisionScrubWarning as V, resetAwsClients as Vn, shouldRetainResource as Vt, stateKeySecretExposure as W, CdkdError as Wn, WorkGraph as Wt, findSilentDropProperties as X, LocalStartServiceError as Xn, stripControlChars as Xt, findActionableSilentDrops as Y, LocalMigrateError as Yn, escapeRegExp$1 as Yt, CloudControlProvider as Z, LockError as Zn, AssetModeResolver as Zt, IMPLICIT_DELETE_DEPENDENCIES as _, resolveApp as _n, STATE_SOURCED_CROSS_GENERATION_RULES as _t, DeploymentEventsStore as a, buildDenyExternalAccessPolicy as an, StackTerminationProtectionError as ar, WAFv2WebACLProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, resolveSkipPrefix as bn, createSecretMasker as bt, producerRegionsFromState as c, getDockerCmd as cn, formatError as cr, assertRegionMatch as ct, updatePartialMessage as d, AssetManifestLoader as dn, withErrorHandling as dr, configStringRefusal as dt, getBootstrapMarkerKey as en, PartialFailureError as er, isTerminationProtectionPropagationError as et, updatePartialReason as f, getDockerImageBySourceHash as fn, isMarkedNonRetryable as fr, readConfigString as ft, maskingRetryLogger as g, getLegacyStateBucketName as gn, __exportAll as gr, requireConfigString as gt, withResourceDeadline as h, getDefaultStateBucketName as hn, markNonRetryable as hr, requireConfigObject as ht, DeploymentEventsReader as i, validateContainerRepoName as in, StackHasActiveImportsError as ir, refStateLookupFromResource as it, renderStatefulReason as j, expectedOwnerParam as jn, applyRoleArnIfSet as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, findLargeInlineResources as kn, s3BucketRegionalDomainName as kt, replayFailedOperations as l, runDockerForeground as ln, isCdkdError as lr, coerceCfnBoolean as lt, deleteSkipReason as m, synthesisStatusMessage as mn, isThrottlingError as mr, requireConfigArray as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, readBootstrapMarkerBody as nn, ResourceTimeoutError as nr, cfnRefValueFromPhysicalId as nt, planFailedOps as o, buildDockerImage as on, StateError as or, normalizeAwsTagsToCfn as ot, UNSPECIFIED_SKIP_REASON as p, Synthesizer as pn, isRetryableTransientError as pr, replayWarn as pt, clearOnUpdateRemoval as q, DeployCancelledError as qn, loadPublishableAssetManifest as qt, DeployEngine as r, validateAssetBucketName as rn, ResourceUpdateNotSupportedError as rr, getAccountInfo as rt, planRollback as s, formatDockerLoginError as sn, SynthesisError as sr, resolveExplicitPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, parseBootstrapMarker as tn, ProvisioningError as tr, IntrinsicFunctionResolver as tt, replayRollback as u, runDockerStreaming as un, normalizeAwsError as ur, configBooleanRefusal as ut, computeImplicitDeleteEdges as v, resolveAutoAssetStorage as vn, STATE_SOURCED_READBACK_RULES as vt, isFinalSnapshotError as w, stateBucketExistenceConfirmed as wn, redactSecretsForState as wt, buildFinalSnapshotIdentifier as x, resolveStateBucketWithDefault as xn, dynamicReferenceTokens as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, resolveCaptureObservedState as yn, TEMPLATE_SOURCED_RULES as yt, collectDeclaredOutputNames as z, AwsClients as zn, S3StateBackend as zt };
-//# sourceMappingURL=deploy-engine-HfFU96oJ.js.map
+export { isInterruptedWaitError as $, LocalMigrateError as $n, escapeRegExp$1 as $t, isStatefulRecreateTargetSync as A, CFN_TEMPLATE_BODY_LIMIT as An, s3BucketArn as At, collectPublishedOutputNames as B, processStackMessages as Bn, DagBuilder as Bt, createPreDeleteFinalSnapshot as C, resolveCaptureObservedState as Cn, TEMPLATE_SOURCED_RULES as Ct, makeCanonicalizePropertiesFn as D, resolveUseCdkBootstrapAssets as Dn, maskSecretsInText as Dt, unsupportedFinalSnapshotError as E, resolveStateBucketWithDefaultAndSource as En, isSingleDynamicReferenceToken as Et, gray as F, expectedOwnerParam as Fn, applyRoleArnIfSet as Ft, IAMRoleProvider as G, resetAwsClients as Gn, shouldRetainResource as Gt, isExportAliasCollision as H, resolveBucketRegion as Hn, LockManager as Ht, green as I, PARTITION_TABLE as In, DiffCalculator as It, ProviderRegistry as J, CdkdError as Jn, WorkGraph as Jt, collectInlinePolicyNamesManagedBySiblings as K, setAwsClients as Kn, AssetPublisher as Kt, red as L, canonicalizeRegion as Ln, INTRINSIC_KEYS as Lt, formatResourceLine as M, MIGRATE_TMP_PREFIX as Mn, s3BucketDualStackDomainName as Mt, bold as N, findLargeInlineResources as Nn, s3BucketRegionalDomainName as Nt, extractDeploymentEventError as O, stateBucketExistenceConfirmed as On, redactSecretsForState as Ot, cyan as P, uploadCfnTemplate as Pn, s3BucketWebsiteUrl as Pt, endCommandInterruptScope as Q, LocalInvokeBuildError as Qn, rewriteTemplateAssetReferences as Qt, yellow as R, derivePartitionAndUrlSuffix as Rn, describeTypeWithThrottleRetry as Rt, ccRoutedFinalSnapshotError as S, resolveAutoAssetStorage as Sn, STATE_SOURCED_READBACK_RULES as St, refusesFinalSnapshot as T, resolveStateBucketWithDefault as Tn, dynamicReferenceTokens as Tt, secretBearingStateKeyWarning as U, AwsClients as Un, S3StateBackend as Ut, exportAliasCollisionScrubWarning as V, clearBucketRegionCache as Vn, TemplateParser as Vt, stateKeySecretExposure as W, getAwsClients as Wn, rebuildClientForBucketRegion as Wt, findSilentDropProperties as X, DependencyError as Xn, createAssetRedirectResolver as Xt, findActionableSilentDrops as Y, ConfigError as Yn, buildAssetRedirectMap as Yt, beginCommandInterruptScope as Z, DeployCancelledError as Zn, loadPublishableAssetManifest as Zt, IMPLICIT_DELETE_DEPENDENCIES as _, Synthesizer as _n, isRetryableTransientError as _r, replayWarn as _t, DeploymentEventsStore as a, parseBootstrapMarker as an, ProvisioningError as ar, IntrinsicFunctionResolver as at, PRE_DELETE_SNAPSHOT_TYPES as b, getLegacyStateBucketName as bn, __exportAll as br, requireConfigString as bt, producerRegionsFromState as c, validateContainerRepoName as cn, StackHasActiveImportsError as cr, refStateLookupFromResource as ct, updatePartialMessage as d, formatDockerLoginError as dn, SynthesisError as dr, resolveExplicitPhysicalId as dt, stripControlChars as en, LocalStartServiceError as er, startInterruptWatch as et, updatePartialReason as f, getDockerCmd as fn, formatError as fr, assertRegionMatch as ft, maskingRetryLogger as g, getDockerImageBySourceHash as gn, isMarkedNonRetryable as gr, readConfigString as gt, withResourceDeadline as h, AssetManifestLoader as hn, withErrorHandling as hr, configStringRefusal as ht, DeploymentEventsReader as i, getBootstrapMarkerKey as in, PartialFailureError as ir, isTerminationProtectionPropagationError as it, renderStatefulReason as j, CFN_TEMPLATE_URL_LIMIT as jn, s3BucketDomainName as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, warnDeprecatedNoPrefixCliFlag as kn, scrubResourceRecord as kt, replayFailedOperations as l, buildDenyExternalAccessPolicy as ln, StackTerminationProtectionError as lr, WAFv2WebACLProvider as lt, deleteSkipReason as m, runDockerStreaming as mn, normalizeAwsError as mr, configBooleanRefusal as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, BOOTSTRAP_MARKER_PREFIX as nn, MissingCdkCliError as nr, slowCcOperationTimeoutMs as nt, planFailedOps as o, readBootstrapMarkerBody as on, ResourceTimeoutError as or, cfnRefValueFromPhysicalId as ot, UNSPECIFIED_SKIP_REASON as p, runDockerForeground as pn, isCdkdError as pr, coerceCfnBoolean as pt, clearOnUpdateRemoval as q, AssetError as qn, stringifyValue as qt, DeployEngine as r, ensureAssetStorage as rn, NestedStackChildDirectDestroyError as rr, disableInstanceApiTermination as rt, planRollback as s, validateAssetBucketName as sn, ResourceUpdateNotSupportedError as sr, getAccountInfo as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssetModeResolver as tn, LockError as tr, CloudControlProvider as tt, replayRollback as u, buildDockerImage as un, StateError as ur, normalizeAwsTagsToCfn as ut, computeImplicitDeleteEdges as v, synthesisStatusMessage as vn, isThrottlingError as vr, requireConfigArray as vt, isFinalSnapshotError as w, resolveSkipPrefix as wn, createSecretMasker as wt, buildFinalSnapshotIdentifier as x, resolveApp as xn, STATE_SOURCED_CROSS_GENERATION_RULES as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, getDefaultStateBucketName as yn, markNonRetryable as yr, requireConfigObject as yt, collectDeclaredOutputNames as z, AssemblyReader as zn, withRetry as zt };
+//# sourceMappingURL=deploy-engine-BpZWPiaL.js.map