@go-to-k/cdkd 0.284.49 → 0.284.50

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-D-NZ_16N.js";
+import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-tBUjmzHn.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Bd0gnMR0.js → program-CMiO_i__.js}

@@ -1,7 +1,7 @@
-import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-D-NZ_16N.js";
+import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-tBUjmzHn.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-DZ6zMwCR.js";
-import { t as ASGProvider } from "./asg-provider-BBqefiXQ.js";
+import { t as getCdkdVersion } from "./version-pYF8nPNw.js";
+import { t as ASGProvider } from "./asg-provider-tVXU-L28.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15887,6 +15887,155 @@ function autoScalingRetriesWithinDeleteBudget(budget, defaultMaxRetries) {
 const AUTO_SCALING_TEARDOWN_RESERVE_MS = 20 * 6e4;
 /** `withRetry`'s capped backoff step (`maxDelayMs`), the cost of one retry. */
 const AUTO_SCALING_RETRY_STEP_MS = 8e3;
+/**
+* {@link ProtectionFlipRecord}s keyed by the resource they describe, so a
+* `delete()` that is RE-ENTERED remembers what an earlier attempt did.
+*
+* Shaped after `ElapsedBudgetRegistry` in `../../utils/elapsed-budget.ts` and
+* keyed with the same {@link deleteBudgetKey}, because it is the same re-entry:
+* `destroy-runner.ts` wraps its outer retry loop — up to four `delete()` calls
+* — in ONE deadline, and re-invokes `delete()` for anything it classes as
+* retryable. A record created per call cannot see that. Attempt 1 observes the
+* guard ON, flips it off and fails on a throttle; attempt 2's pre-flip
+* `DescribeTable` now reports the guard OFF (attempt 1 is why), so a per-call
+* record starts and stays `false` and a TERMINAL failure on attempt 2
+* compensates nothing. That is precisely the issue's retry-then-fail case
+* (#1978).
+*
+* A provider INSTANCE FIELD would be wrong for the same reason the budget is
+* not one: providers are singletons serving concurrent resources, so one field
+* would carry another table's flip. The key qualifies the physical id by
+* region, exactly as the budget's does.
+*
+* Entries are RETAINED on a throw — that is the point — and released by the
+* caller on a terminal outcome (a completed delete, or a NotFound), so the map
+* holds at most one entry per in-flight resource.
+*/
+var ProtectionFlipRegistry = class {
+	records = /* @__PURE__ */ new Map();
+	/**
+	* The record for `key`, creating it on first use and REUSING it on re-entry.
+	*
+	* `reuseWithinMs` bounds how long an entry may be reused for and is passed
+	* the same `DELETE_BUDGET_REUSE_WINDOW_MS` the allowance uses: past the
+	* deadline the whole path is sized against, that deadline has certainly
+	* fired, so a caller arriving now belongs to a NEW operation and must not
+	* inherit a previous one's flip. Without it a retained record would make a
+	* much later destroy of the same table re-enable a guard it never touched.
+	*/
+	acquire(key, reuseWithinMs, clock = monotonicNowMs) {
+		const existing = this.records.get(key);
+		if (existing) {
+			if (existing.age.elapsedMs() <= reuseWithinMs) return existing.record;
+			this.records.delete(key);
+		}
+		const created = {
+			record: {
+				flippedOffByThisRun: false,
+				deleteAccepted: false
+			},
+			age: new ElapsedBudget(reuseWithinMs, clock)
+		};
+		this.records.set(key, created);
+		return created.record;
+	}
+	/** Drop `key`'s record — call on a TERMINAL outcome, never between retries. */
+	release(key) {
+		this.records.delete(key);
+	}
+	/** Live entries; exists so a test can prove release actually released. */
+	get size() {
+		return this.records.size;
+	}
+	clear() {
+		this.records.clear();
+	}
+};
+/**
+* Whether `error` ends the delete for good, i.e. whether `destroy-runner.ts`'s
+* outer loop will NOT re-enter `delete()` for it.
+*
+* This is the gate on the compensation, and it is the issue's own point:
+* re-enabling the guard after a RETRYABLE failure would flip the flag back and
+* forth across a retry sequence, since the next `delete()` immediately turns it
+* off again. Compensation belongs on the terminal failure only.
+*
+* The predicate MIRRORS `destroy-runner.ts`'s re-entry condition
+* (`!isMarkedNonRetryable && (isRetryableTransientError || 'Too Many
+* Requests')`) rather than inventing a second classification, and it is applied
+* to the error the provider is about to THROW — the same wrapped
+* `ProvisioningError` message the outer loop will classify — so the two cannot
+* disagree about who gets re-entered.
+*
+* A user abort is terminal here even though nothing classifies it: the run is
+* being torn down, so no re-entry is coming and the guard would otherwise stay
+* down. That is the Ctrl-C route recorded on the issue.
+*
+* KNOWN NARROWINGS, all deliberate. Each leaves the guard off in a case this
+* mechanism does not reach; none of them is silent about it here.
+*
+*  1. **Attempt-cap exhaustion.** A genuinely retryable failure that exhausts
+*     the outer loop's attempt cap ends the run with the guard still off,
+*     because the provider cannot see which attempt is the last one.
+*     Compensating on every attempt instead would trade that residue for an
+*     `UpdateTable` pair per retry against a table AWS is already throttling.
+*  2. **The per-resource DEADLINE route.** `src/deployment/resource-deadline.ts`
+*     rejects the OUTER promise on its timer and does NOT cancel what it
+*     wraps — the provider's own `await` never settles as a rejection, so no
+*     `ResourceTimeoutError` ever enters `delete()`'s `catch` and nothing here
+*     runs for it. The provider keeps polling behind a run that has already
+*     reported failure (the same non-cancelling shape issue #1955 documents),
+*     and if that poll eventually succeeds the table is gone anyway. Closing
+*     this would mean making the deadline cancel — a change to a mechanism
+*     every provider shares — so it is recorded, not fixed here.
+*  3. **The compensation itself is unbounded.** `reEnable` is one `UpdateTable`
+*     with no timeout of its own, so on Ctrl-C it adds one SDK call per flipped
+*     table to a teardown the user has already asked to end. Left unbounded on
+*     purpose: an `UpdateTable` is a single control-plane round trip (no
+*     polling, no wait for ACTIVE), the SDK's own retry/timeout config already
+*     applies to it, and it is the ONLY thing standing between a Ctrl-C and a
+*     live table with its guard stripped — a timeout short enough to be felt
+*     during teardown would mostly convert successful restores into the "could
+*     NOT re-enable" line. Revisit if the compensation ever grows a WAIT.
+*/
+function isTerminalDeleteFailure(error) {
+	if (isInterruptedWaitError(error)) return true;
+	if (isMarkedNonRetryable(error)) return true;
+	const message = error instanceof Error ? error.message : String(error);
+	return !(isRetryableTransientError(error, message) || message.includes("Too Many Requests"));
+}
+/**
+* Put `DeletionProtectionEnabled` back after a `--remove-protection` flip whose
+* delete then failed terminally (issue #1978).
+*
+* BEST-EFFORT, and it says so. Three properties, each of which the issue names:
+*
+*  - **It never masks the original error.** This function does not throw —
+*    including when the re-enable itself fails — because it runs inside the
+*    `catch` that is about to re-throw the delete failure, and a secondary
+*    write that throws would REPLACE the reported outcome with its own. The
+*    delete failure stays the outcome; this is a secondary line.
+*  - **It never edits the primary message either.** Splicing the re-enable's
+*    text into the thrown error would change what `isRetryableTransientError`
+*    substring-matches on, so a compensation failure carrying a throttle phrase
+*    could flip a terminal delete failure into a retryable one and re-run the
+*    whole path. The narration goes to the logger, not into the throw.
+*  - **It names the table when it fails.** A silent failure here leaves a LIVE
+*    table with its guard down, which is the exact residue this mechanism
+*    exists to remove, so the message carries the physical id and the one
+*    command that fixes it.
+*/
+async function compensateRemovedDeletionProtection(opts) {
+	if (!opts.flip.flippedOffByThisRun) return;
+	if (opts.flip.deleteAccepted) return;
+	if (!isTerminalDeleteFailure(opts.error)) return;
+	try {
+		await opts.reEnable();
+		opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: the delete failed after --remove-protection had turned DeletionProtectionEnabled off, so it was re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
+	} catch (reEnableError) {
+		opts.logger.error(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could NOT re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — that table is LIVE with its deletion protection still off. Restore it with: aws dynamodb update-table --table-name ${opts.physicalId} --deletion-protection-enabled. (${reEnableError instanceof Error ? reEnableError.message : String(reEnableError)})`);
+	}
+}
 
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
@@ -16488,6 +16637,17 @@ var DynamoDBTableProvider = class {
 	* provider instance.
 	*/
 	deleteBudgets = new ElapsedBudgetRegistry();
+	/**
+	* What each in-flight delete did to `DeletionProtectionEnabled` (issue
+	* #1978), keyed exactly as the allowance above and for exactly the same
+	* reason: `destroy-runner.ts` re-enters `delete()` after a retryable failure,
+	* and the second attempt's pre-flip `DescribeTable` sees the guard already
+	* off BECAUSE the first attempt turned it off. A record created per call
+	* would therefore read "nothing to undo" on precisely the retry-then-fail
+	* case the issue names. Keyed rather than a plain field for the budget's
+	* reason too — one provider instance serves a whole level's tables at once.
+	*/
+	protectionFlips = new ProtectionFlipRegistry();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
@@ -16807,15 +16967,60 @@ var DynamoDBTableProvider = class {
 	}
 	/**
 	* Delete a DynamoDB table
+	*
+	* A thin wrapper around {@link deleteTableResource} whose only job is the
+	* `--remove-protection` compensation (issue #1978): if this run turned
+	* `DeletionProtectionEnabled` off and the delete then ended for good — a
+	* terminal AWS refusal, or a Ctrl-C landing anywhere after the flip — the
+	* guard goes back on before the failure is re-thrown. Without it the run ends
+	* with a LIVE table whose protection cdkd silently stripped: the failure is
+	* loud, the side effect is not.
+	*
+	* It is a WRAPPER rather than a `catch` inside the body because the window is
+	* not one `try`. Between the flip and a successful delete this provider can
+	* throw from the index-settled re-arm, from the retry loop, and from an
+	* interrupted wait, and the same shape on the sibling `GlobalTable` provider
+	* spans a replica teardown as well. Catching at the boundary covers every
+	* exit; the {@link ProtectionFlipRecord} — not the position of the catch — is
+	* what decides whether there is anything to undo.
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		try {
+			await this.deleteTableResource(logicalId, physicalId, resourceType, context, flip);
+		} catch (error) {
+			await compensateRemovedDeletionProtection({
+				flip,
+				error,
+				logicalId,
+				physicalId,
+				typeLabel: "table",
+				logger: this.logger,
+				reEnable: async () => {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						DeletionProtectionEnabled: true
+					}));
+				}
+			});
+			throw error;
+		}
+	}
+	async deleteTableResource(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting DynamoDB table ${logicalId}: ${physicalId}`);
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
+			let observedProtectionOn = false;
+			try {
+				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
+			} catch (observeError) {
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
 				DeletionProtectionEnabled: false
 			}));
+			if (observedProtectionOn) flip.flippedOffByThisRun = true;
 			this.logger.debug(`Disabled DeletionProtectionEnabled on DynamoDB table ${logicalId}, waiting for ACTIVE`);
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, 60, budget);
@@ -16841,6 +17046,7 @@ var DynamoDBTableProvider = class {
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+					flip.deleteAccepted = true;
 				},
 				reArm: () => waitForIndexesSettled({
 					tableName: physicalId,
@@ -16859,11 +17065,13 @@ var DynamoDBTableProvider = class {
 			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -18064,6 +18272,17 @@ var DynamoDBGlobalTableProvider = class {
 	* terms it closes.
 	*/
 	deleteBudgets = new ElapsedBudgetRegistry();
+	/**
+	* What each in-flight delete did to `DeletionProtectionEnabled` (issue
+	* #1978), keyed exactly as the allowance above and for exactly the same
+	* reason: `destroy-runner.ts` re-enters `delete()` after a retryable failure,
+	* and the second attempt's pre-flip `DescribeTable` sees the guard already
+	* off BECAUSE the first attempt turned it off. A record created per call
+	* would therefore read "nothing to undo" on precisely the retry-then-fail
+	* case the issue names. Keyed rather than a plain field for the budget's
+	* reason too — one provider instance serves a whole level's tables at once.
+	*/
+	protectionFlips = new ProtectionFlipRegistry();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
@@ -19332,13 +19551,42 @@ var DynamoDBGlobalTableProvider = class {
 	* strip a still-existing resource from state.
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		try {
+			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip);
+		} catch (error) {
+			await compensateRemovedDeletionProtection({
+				flip,
+				error,
+				logicalId,
+				physicalId,
+				typeLabel: "GlobalTable",
+				logger: this.logger,
+				reEnable: async () => {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						DeletionProtectionEnabled: true
+					}));
+				}
+			});
+			throw error;
+		}
+	}
+	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting DynamoDB GlobalTable ${logicalId}: ${physicalId}`);
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
+			let observedProtectionOn = false;
+			try {
+				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
+			} catch (observeError) {
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
 				DeletionProtectionEnabled: false
 			}));
+			if (observedProtectionOn) flip.flippedOffByThisRun = true;
 			this.logger.debug(`Disabled DeletionProtectionEnabled on ${logicalId}, waiting for ACTIVE`);
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget);
@@ -19407,6 +19655,7 @@ var DynamoDBGlobalTableProvider = class {
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+					flip.deleteAccepted = true;
 				},
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
 					maxAttempts: 60,
@@ -19423,11 +19672,13 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableGone(physicalId, logicalId, 600, budget);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -86808,4 +87059,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Bd0gnMR0.js.map
+//# sourceMappingURL=program-CMiO_i__.js.map