@go-to-k/cdkd 0.284.24 → 0.284.25

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as disableInstanceApiTermination, $n as NestedStackChildDirectDestroyError, $t as ensureAssetStorage, A as isStatefulRecreateTargetSync, An as uploadCfnTemplate, At as s3BucketWebsiteUrl, B as collectPublishedOutputNames, Bn as getAwsClients, Bt as rebuildClientForBucketRegion, C as createPreDeleteFinalSnapshot, Cn as resolveUseCdkBootstrapAssets, Ct as maskSecretsInText, D as makeCanonicalizePropertiesFn, Dn as CFN_TEMPLATE_URL_LIMIT, Dt as s3BucketDomainName, E as unsupportedFinalSnapshotError, En as CFN_TEMPLATE_BODY_LIMIT, Et as s3BucketArn, F as gray, Fn as AssemblyReader, Ft as withRetry, G as IAMRoleProvider, Gt as buildAssetRedirectMap, H as isExportAliasCollision, Hn as setAwsClients, Ht as AssetPublisher, I as green, In as processStackMessages, It as DagBuilder, J as ProviderRegistry, Jn as LocalInvokeBuildError$1, Jt as rewriteTemplateAssetReferences, K as collectInlinePolicyNamesManagedBySiblings, Kt as createAssetRedirectResolver, L as red, Lt as TemplateParser, M as formatResourceLine, Mn as PARTITION_TABLE, Mt as DiffCalculator, N as bold, Nn as canonicalizeRegion, Nt as INTRINSIC_KEYS, O as extractDeploymentEventError, On as MIGRATE_TMP_PREFIX, Ot as s3BucketDualStackDomainName, P as cyan, Pn as derivePartitionAndUrlSuffix, Pt as describeTypeWithThrottleRetry, Q as slowCcOperationTimeoutMs, Qn as MissingCdkCliError, Qt as BOOTSTRAP_MARKER_PREFIX, R as yellow, Rn as resolveBucketRegion, Rt as LockManager, S as ccRoutedFinalSnapshotError, Sn as resolveStateBucketWithDefaultAndSource, St as isSingleDynamicReferenceToken, T as refusesFinalSnapshot, Tn as warnDeprecatedNoPrefixCliFlag, Tt as scrubResourceRecord, U as secretBearingStateKeyWarning, Ut as stringifyValue, V as exportAliasCollisionScrubWarning, Vn as resetAwsClients, Vt as shouldRetainResource, W as stateKeySecretExposure, Wn as CdkdError, Wt as WorkGraph, X as findSilentDropProperties, Xn as LocalStartServiceError, Xt as stripControlChars, Y as findActionableSilentDrops, Yn as LocalMigrateError, Yt as escapeRegExp, Z as CloudControlProvider, Zt as AssetModeResolver, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as resolveApp, _t as STATE_SOURCED_CROSS_GENERATION_RULES, a as DeploymentEventsStore, an as buildDenyExternalAccessPolicy, ar as StackTerminationProtectionError, at as WAFv2WebACLProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bn as resolveSkipPrefix, bt as createSecretMasker, c as producerRegionsFromState, cn as getDockerCmd, ct as assertRegionMatch, d as updatePartialMessage, dn as AssetManifestLoader, dr as withErrorHandling, dt as configStringRefusal, en as getBootstrapMarkerKey, er as PartialFailureError, et as isTerminationProtectionPropagationError, f as updatePartialReason, fn as getDockerImageBySourceHash, fr as isMarkedNonRetryable, ft as readConfigString, g as maskingRetryLogger, gn as getLegacyStateBucketName, gt as requireConfigString, h as withResourceDeadline, hn as getDefaultStateBucketName, hr as markNonRetryable, ht as requireConfigObject, i as DeploymentEventsReader, in as validateContainerRepoName, ir as StackHasActiveImportsError, it as refStateLookupFromResource, j as renderStatefulReason, jn as expectedOwnerParam, jt as applyRoleArnIfSet, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as findLargeInlineResources, kt as s3BucketRegionalDomainName, l as replayFailedOperations, ln as runDockerForeground, lt as coerceCfnBoolean, m as deleteSkipReason, mn as synthesisStatusMessage, mr as isThrottlingError, mt as requireConfigArray, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as readBootstrapMarkerBody, nr as ResourceTimeoutError, nt as cfnRefValueFromPhysicalId, o as planFailedOps, on as buildDockerImage, ot as normalizeAwsTagsToCfn, p as UNSPECIFIED_SKIP_REASON, pn as Synthesizer, pr as isRetryableTransientError, pt as replayWarn, q as clearOnUpdateRemoval, qn as DeployCancelledError, qt as loadPublishableAssetManifest, r as DeployEngine, rn as validateAssetBucketName, rr as ResourceUpdateNotSupportedError, rt as getAccountInfo, s as planRollback, sn as formatDockerLoginError, st as resolveExplicitPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as parseBootstrapMarker, tr as ProvisioningError, tt as IntrinsicFunctionResolver, u as replayRollback, un as runDockerStreaming, ur as normalizeAwsError, ut as configBooleanRefusal, v as computeImplicitDeleteEdges, vn as resolveAutoAssetStorage, vt as STATE_SOURCED_READBACK_RULES, w as isFinalSnapshotError, wn as stateBucketExistenceConfirmed, wt as redactSecretsForState, x as buildFinalSnapshotIdentifier, xn as resolveStateBucketWithDefault, xt as dynamicReferenceTokens, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as resolveCaptureObservedState, yt as TEMPLATE_SOURCED_RULES, z as collectDeclaredOutputNames, zn as AwsClients, zt as S3StateBackend } from "./deploy-engine-BJQbni1s.js";
+import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-BpZWPiaL.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Bh0odlSk.js";
+import { t as ASGProvider } from "./asg-provider-B2lPfJBN.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1774,6 +1774,7 @@ function createListCommand() {
 * handler of its own).
 */
 function forwardSigtermToSigint() {
+	beginCommandInterruptScope();
 	const handler = () => {
 		if (process.listenerCount("SIGINT") === 0) process.exit(143);
 		process.emit("SIGINT", "SIGINT");
@@ -1781,6 +1782,7 @@ function forwardSigtermToSigint() {
 	process.on("SIGTERM", handler);
 	return () => {
 		process.removeListener("SIGTERM", handler);
+		endCommandInterruptScope();
 	};
 }
 
@@ -14839,28 +14841,37 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
 	const budgetWait = opts.budgetWait;
+	const watch = startInterruptWatch(`index settle wait on ${tableName}`);
 	let attempt = 0;
-	while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
-		attempt += 1;
-		try {
-			if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isThrottlingError(err)) {
-				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-				await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-				continue;
+	try {
+		while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+			attempt += 1;
+			if (watch.isInterrupted()) {
+				logger.debug(`Interrupted while waiting for indexes on ${tableName} (${logicalId}) after ${attempt - 1} DescribeTable polls; ${proceedNote}`);
+				return;
 			}
-			if (err instanceof ResourceNotFoundException$1) {
-				logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+			try {
+				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				if (isThrottlingError(err)) {
+					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+					continue;
+				}
+				if (err instanceof ResourceNotFoundException$1) {
+					logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+					return;
+				}
+				const errorName = err instanceof Error ? err.name : typeof err;
+				logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
+				logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
 				return;
 			}
-			const errorName = err instanceof Error ? err.name : typeof err;
-			logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
-			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
-			return;
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
-		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+	} finally {
+		watch.dispose();
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
 	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
@@ -14965,24 +14976,31 @@ function indexBusyRetryWarning(opts) {
 */
 async function deleteTableWithIndexBusyRetry(opts) {
 	let deleteAttempts = 0;
-	await withRetry(async () => {
-		if (deleteAttempts++ > 0) {
-			if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
-				typeLabel: opts.typeLabel,
-				logicalId: opts.logicalId,
-				physicalId: opts.physicalId,
-				attemptNumber: deleteAttempts,
-				maxRetries: opts.maxRetries
-			}));
-			await opts.reArm();
-		}
-		await opts.deleteTable();
-	}, opts.logicalId, {
-		maxRetries: opts.maxRetries,
-		isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
-		logger: opts.logger,
-		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
-	});
+	const watch = startInterruptWatch(`DynamoDB ${opts.typeLabel} ${opts.logicalId} delete`);
+	try {
+		await withRetry(async () => {
+			if (deleteAttempts++ > 0) {
+				if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+					typeLabel: opts.typeLabel,
+					logicalId: opts.logicalId,
+					physicalId: opts.physicalId,
+					attemptNumber: deleteAttempts,
+					maxRetries: opts.maxRetries
+				}));
+				await opts.reArm();
+			}
+			await opts.deleteTable();
+		}, opts.logicalId, {
+			maxRetries: opts.maxRetries,
+			isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
+			logger: opts.logger,
+			isInterrupted: watch.isInterrupted,
+			onInterrupted: watch.onInterrupted,
+			sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+		});
+	} finally {
+		watch.dispose();
+	}
 }
 
 //#endregion
@@ -18658,94 +18676,111 @@ var DynamoDBGlobalTableProvider = class {
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
 		if (!oldEnabled && !newEnabled) return;
-		if (newEnabled) {
-			const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
-			const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
-			if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-				warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
+		try {
+			if (newEnabled) {
+				const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
+				const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
+				if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
+					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+					return;
+				}
+				try {
+					await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						MinCapacity: minCapacity,
+						MaxCapacity: maxCapacity
+					})), `${resourceId} (${dimension})`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
+					return;
+				}
+				const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
+				const targetValue = Number(tttCfg["TargetValue"]);
+				if (!Number.isFinite(targetValue)) {
+					warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
+					return;
+				}
+				const targetTrackingConfig = {
+					PredefinedMetricSpecification: { PredefinedMetricType: metricType },
+					TargetValue: targetValue
+				};
+				if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
+				if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
+				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
+				try {
+					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
+						PolicyName: policyName,
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						PolicyType: "TargetTrackingScaling",
+						TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
+					})), `${policyName}`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+					this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				}
 				return;
 			}
+			const isObjectNotFound = (err) => {
+				if (!(err instanceof Error)) return false;
+				const name = err.name ?? "";
+				const msg = err.message ?? "";
+				return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
+			};
 			try {
-				await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+				await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
+					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					MinCapacity: minCapacity,
-					MaxCapacity: maxCapacity
+					ScalableDimension: dimension
 				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 			} catch (err) {
-				warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
-				return;
-			}
-			const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
-			const targetValue = Number(tttCfg["TargetValue"]);
-			if (!Number.isFinite(targetValue)) {
-				warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
-				return;
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			const targetTrackingConfig = {
-				PredefinedMetricSpecification: { PredefinedMetricType: metricType },
-				TargetValue: targetValue
-			};
-			if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
-			if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
-			if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 			try {
-				await withRetry(() => asClient.send(new PutScalingPolicyCommand({
-					PolicyName: policyName,
+				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					PolicyType: "TargetTrackingScaling",
-					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
-				})), `${policyName}`, {
+					ScalableDimension: dimension
+				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
-				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 			} catch (err) {
-				warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			return;
-		}
-		const isObjectNotFound = (err) => {
-			if (!(err instanceof Error)) return false;
-			const name = err.name ?? "";
-			const msg = err.message ?? "";
-			return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
-		};
-		try {
-			await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
-				PolicyName: policyName,
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
-		}
-		try {
-			await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-			this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+		} finally {
+			watch.dispose();
 		}
 	}
 	/**
@@ -18943,6 +18978,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		} catch (describeErr) {
 			if (describeErr instanceof ProvisioningError) throw describeErr;
+			if (isInterruptedWaitError(describeErr)) throw describeErr;
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
 				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeErr instanceof Error ? describeErr.message : String(describeErr)}`, resourceType, logicalId, physicalId, cause);
@@ -19654,12 +19690,20 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB replica ${region} teardown on ${tableName}`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				try {
+					if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		throw new ProvisioningError(`Replica ${region} for table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
@@ -19679,12 +19723,23 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB table ${tableName} deletion wait`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) {
+					this.logger.warn(`DynamoDB GlobalTable ${logicalId}: interrupted while waiting for ${tableName} to disappear. AWS ACCEPTED the DeleteTable and will finish it; cdkd stopped watching.`);
+					return;
+				}
+				try {
+					await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		if (wait.cutShort) {
 			this.logger.warn(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${tableName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`);
@@ -35399,13 +35454,23 @@ var ELBv2Provider = class {
 			try {
 				const listenerAttributes = this.normalizeAttributes(properties["ListenerAttributes"]);
 				if (listenerAttributes.length > 0) {
-					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-						ListenerArn: listenerArn,
-						Attributes: listenerAttributes
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+					try {
+						await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+							ListenerArn: listenerArn,
+							Attributes: listenerAttributes
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and neither rollback nor destroy could reach it. If that delete does not complete, remove it manually: aws elbv2 delete-listener --listener-arn ${listenerArn}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
@@ -35442,10 +35507,19 @@ var ELBv2Provider = class {
 			}));
 			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
-				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-					ListenerArn: physicalId,
-					Attributes: submittedAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+				const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+				try {
+					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+						ListenerArn: physicalId,
+						Attributes: submittedAttrs
+					})), logicalId, {
+						logger: this.maskedRetryLogger(maskSecrets),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
 				this.logger.debug(`Applied ${submittedAttrs.length} ListenerAttributes change(s) for ${logicalId}`);
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -42539,16 +42613,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
-			await withRetry(async () => {
-				const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			}, logicalId, {
-				maxRetries: 24,
-				initialDelayMs: 3e3,
-				maxDelayMs: 15e3,
-				isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
-				logger: this.logger
-			});
+			const watch = startInterruptWatch(`Cloud Map namespace ${logicalId}`);
+			try {
+				await withRetry(async () => {
+					const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
+					if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				}, logicalId, {
+					maxRetries: 24,
+					initialDelayMs: 3e3,
+					maxDelayMs: 15e3,
+					isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
+					logger: this.logger,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted
+				});
+			} finally {
+				watch.dispose();
+			}
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
@@ -42748,13 +42829,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 				if (Object.keys(attrs).length > 0) {
-					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-						ServiceId: serviceId,
-						Attributes: attrs
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+					try {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: serviceId,
+							Attributes: attrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete does not complete, remove it manually: aws servicediscovery delete-service --id ${serviceId}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
@@ -42824,19 +42915,34 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}))).OperationId;
 				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
-			if (hasAttrUpsert) {
-				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: upsertAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
-			}
-			if (hasAttrRemove) {
-				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: removedAttrKeys
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+			if (hasAttrUpsert || hasAttrRemove) {
+				const attrWatch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+				try {
+					if (hasAttrUpsert) {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: upsertAttrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
+					}
+					if (hasAttrRemove) {
+						await withRetry(() => client.send(new DeleteServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: removedAttrKeys
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+					}
+				} finally {
+					attrWatch.dispose();
+				}
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
 			return {
@@ -58198,7 +58304,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (!isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
+					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -58282,11 +58388,19 @@ async function runDestroyForStack(stackName, state, ctx) {
 			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, ${orphanHint} is the last resort: it removes the state record without deleting AWS resources.` + skippedClause);
 		}
 	} finally {
-		process.removeListener("SIGINT", sigintHandler);
-		renderer.stop();
-		await saveChain;
-		logger.debug("Releasing lock...");
-		await ctx.lockManager.releaseLock(stackName, regionForState);
+		try {
+			try {
+				renderer.stop();
+			} catch (rendererError) {
+				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${rendererError instanceof Error ? rendererError.message : String(rendererError)}`);
+			}
+			await saveChain;
+			logger.debug("Releasing lock...");
+			await ctx.lockManager.releaseLock(stackName, regionForState);
+		} finally {
+			process.removeListener("SIGINT", sigintHandler);
+		}
+		result.interrupted ||= draining;
 		if (destroyAwsClients) {
 			destroyAwsClients.destroy();
 			process.env["AWS_REGION"] = ctx.baseRegion;
@@ -83914,7 +84028,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.25");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;