@go-to-k/cdkd 0.284.49 → 0.284.51

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-D-NZ_16N.js";
+import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-Dnp730rc.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Bd0gnMR0.js → program-DjH_cfVU.js}

@@ -1,7 +1,7 @@
-import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-D-NZ_16N.js";
+import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-Dnp730rc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-DZ6zMwCR.js";
-import { t as ASGProvider } from "./asg-provider-BBqefiXQ.js";
+import { t as getCdkdVersion } from "./version-CJG_PFNb.js";
+import { t as ASGProvider } from "./asg-provider-CynKJdi4.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15887,6 +15887,155 @@ function autoScalingRetriesWithinDeleteBudget(budget, defaultMaxRetries) {
 const AUTO_SCALING_TEARDOWN_RESERVE_MS = 20 * 6e4;
 /** `withRetry`'s capped backoff step (`maxDelayMs`), the cost of one retry. */
 const AUTO_SCALING_RETRY_STEP_MS = 8e3;
+/**
+* {@link ProtectionFlipRecord}s keyed by the resource they describe, so a
+* `delete()` that is RE-ENTERED remembers what an earlier attempt did.
+*
+* Shaped after `ElapsedBudgetRegistry` in `../../utils/elapsed-budget.ts` and
+* keyed with the same {@link deleteBudgetKey}, because it is the same re-entry:
+* `destroy-runner.ts` wraps its outer retry loop — up to four `delete()` calls
+* — in ONE deadline, and re-invokes `delete()` for anything it classes as
+* retryable. A record created per call cannot see that. Attempt 1 observes the
+* guard ON, flips it off and fails on a throttle; attempt 2's pre-flip
+* `DescribeTable` now reports the guard OFF (attempt 1 is why), so a per-call
+* record starts and stays `false` and a TERMINAL failure on attempt 2
+* compensates nothing. That is precisely the issue's retry-then-fail case
+* (#1978).
+*
+* A provider INSTANCE FIELD would be wrong for the same reason the budget is
+* not one: providers are singletons serving concurrent resources, so one field
+* would carry another table's flip. The key qualifies the physical id by
+* region, exactly as the budget's does.
+*
+* Entries are RETAINED on a throw — that is the point — and released by the
+* caller on a terminal outcome (a completed delete, or a NotFound), so the map
+* holds at most one entry per in-flight resource.
+*/
+var ProtectionFlipRegistry = class {
+	records = /* @__PURE__ */ new Map();
+	/**
+	* The record for `key`, creating it on first use and REUSING it on re-entry.
+	*
+	* `reuseWithinMs` bounds how long an entry may be reused for and is passed
+	* the same `DELETE_BUDGET_REUSE_WINDOW_MS` the allowance uses: past the
+	* deadline the whole path is sized against, that deadline has certainly
+	* fired, so a caller arriving now belongs to a NEW operation and must not
+	* inherit a previous one's flip. Without it a retained record would make a
+	* much later destroy of the same table re-enable a guard it never touched.
+	*/
+	acquire(key, reuseWithinMs, clock = monotonicNowMs) {
+		const existing = this.records.get(key);
+		if (existing) {
+			if (existing.age.elapsedMs() <= reuseWithinMs) return existing.record;
+			this.records.delete(key);
+		}
+		const created = {
+			record: {
+				flippedOffByThisRun: false,
+				deleteAccepted: false
+			},
+			age: new ElapsedBudget(reuseWithinMs, clock)
+		};
+		this.records.set(key, created);
+		return created.record;
+	}
+	/** Drop `key`'s record — call on a TERMINAL outcome, never between retries. */
+	release(key) {
+		this.records.delete(key);
+	}
+	/** Live entries; exists so a test can prove release actually released. */
+	get size() {
+		return this.records.size;
+	}
+	clear() {
+		this.records.clear();
+	}
+};
+/**
+* Whether `error` ends the delete for good, i.e. whether `destroy-runner.ts`'s
+* outer loop will NOT re-enter `delete()` for it.
+*
+* This is the gate on the compensation, and it is the issue's own point:
+* re-enabling the guard after a RETRYABLE failure would flip the flag back and
+* forth across a retry sequence, since the next `delete()` immediately turns it
+* off again. Compensation belongs on the terminal failure only.
+*
+* The predicate MIRRORS `destroy-runner.ts`'s re-entry condition
+* (`!isMarkedNonRetryable && (isRetryableTransientError || 'Too Many
+* Requests')`) rather than inventing a second classification, and it is applied
+* to the error the provider is about to THROW — the same wrapped
+* `ProvisioningError` message the outer loop will classify — so the two cannot
+* disagree about who gets re-entered.
+*
+* A user abort is terminal here even though nothing classifies it: the run is
+* being torn down, so no re-entry is coming and the guard would otherwise stay
+* down. That is the Ctrl-C route recorded on the issue.
+*
+* KNOWN NARROWINGS, all deliberate. Each leaves the guard off in a case this
+* mechanism does not reach; none of them is silent about it here.
+*
+*  1. **Attempt-cap exhaustion.** A genuinely retryable failure that exhausts
+*     the outer loop's attempt cap ends the run with the guard still off,
+*     because the provider cannot see which attempt is the last one.
+*     Compensating on every attempt instead would trade that residue for an
+*     `UpdateTable` pair per retry against a table AWS is already throttling.
+*  2. **The per-resource DEADLINE route.** `src/deployment/resource-deadline.ts`
+*     rejects the OUTER promise on its timer and does NOT cancel what it
+*     wraps — the provider's own `await` never settles as a rejection, so no
+*     `ResourceTimeoutError` ever enters `delete()`'s `catch` and nothing here
+*     runs for it. The provider keeps polling behind a run that has already
+*     reported failure (the same non-cancelling shape issue #1955 documents),
+*     and if that poll eventually succeeds the table is gone anyway. Closing
+*     this would mean making the deadline cancel — a change to a mechanism
+*     every provider shares — so it is recorded, not fixed here.
+*  3. **The compensation itself is unbounded.** `reEnable` is one `UpdateTable`
+*     with no timeout of its own, so on Ctrl-C it adds one SDK call per flipped
+*     table to a teardown the user has already asked to end. Left unbounded on
+*     purpose: an `UpdateTable` is a single control-plane round trip (no
+*     polling, no wait for ACTIVE), the SDK's own retry/timeout config already
+*     applies to it, and it is the ONLY thing standing between a Ctrl-C and a
+*     live table with its guard stripped — a timeout short enough to be felt
+*     during teardown would mostly convert successful restores into the "could
+*     NOT re-enable" line. Revisit if the compensation ever grows a WAIT.
+*/
+function isTerminalDeleteFailure(error) {
+	if (isInterruptedWaitError(error)) return true;
+	if (isMarkedNonRetryable(error)) return true;
+	const message = error instanceof Error ? error.message : String(error);
+	return !(isRetryableTransientError(error, message) || message.includes("Too Many Requests"));
+}
+/**
+* Put `DeletionProtectionEnabled` back after a `--remove-protection` flip whose
+* delete then failed terminally (issue #1978).
+*
+* BEST-EFFORT, and it says so. Three properties, each of which the issue names:
+*
+*  - **It never masks the original error.** This function does not throw —
+*    including when the re-enable itself fails — because it runs inside the
+*    `catch` that is about to re-throw the delete failure, and a secondary
+*    write that throws would REPLACE the reported outcome with its own. The
+*    delete failure stays the outcome; this is a secondary line.
+*  - **It never edits the primary message either.** Splicing the re-enable's
+*    text into the thrown error would change what `isRetryableTransientError`
+*    substring-matches on, so a compensation failure carrying a throttle phrase
+*    could flip a terminal delete failure into a retryable one and re-run the
+*    whole path. The narration goes to the logger, not into the throw.
+*  - **It names the table when it fails.** A silent failure here leaves a LIVE
+*    table with its guard down, which is the exact residue this mechanism
+*    exists to remove, so the message carries the physical id and the one
+*    command that fixes it.
+*/
+async function compensateRemovedDeletionProtection(opts) {
+	if (!opts.flip.flippedOffByThisRun) return;
+	if (opts.flip.deleteAccepted) return;
+	if (!isTerminalDeleteFailure(opts.error)) return;
+	try {
+		await opts.reEnable();
+		opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: the delete failed after --remove-protection had turned DeletionProtectionEnabled off, so it was re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
+	} catch (reEnableError) {
+		opts.logger.error(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could NOT re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — that table is LIVE with its deletion protection still off. Restore it with: aws dynamodb update-table --table-name ${opts.physicalId} --deletion-protection-enabled. (${reEnableError instanceof Error ? reEnableError.message : String(reEnableError)})`);
+	}
+}
 
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
@@ -16488,6 +16637,17 @@ var DynamoDBTableProvider = class {
 	* provider instance.
 	*/
 	deleteBudgets = new ElapsedBudgetRegistry();
+	/**
+	* What each in-flight delete did to `DeletionProtectionEnabled` (issue
+	* #1978), keyed exactly as the allowance above and for exactly the same
+	* reason: `destroy-runner.ts` re-enters `delete()` after a retryable failure,
+	* and the second attempt's pre-flip `DescribeTable` sees the guard already
+	* off BECAUSE the first attempt turned it off. A record created per call
+	* would therefore read "nothing to undo" on precisely the retry-then-fail
+	* case the issue names. Keyed rather than a plain field for the budget's
+	* reason too — one provider instance serves a whole level's tables at once.
+	*/
+	protectionFlips = new ProtectionFlipRegistry();
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
@@ -16807,15 +16967,60 @@ var DynamoDBTableProvider = class {
 	}
 	/**
 	* Delete a DynamoDB table
+	*
+	* A thin wrapper around {@link deleteTableResource} whose only job is the
+	* `--remove-protection` compensation (issue #1978): if this run turned
+	* `DeletionProtectionEnabled` off and the delete then ended for good — a
+	* terminal AWS refusal, or a Ctrl-C landing anywhere after the flip — the
+	* guard goes back on before the failure is re-thrown. Without it the run ends
+	* with a LIVE table whose protection cdkd silently stripped: the failure is
+	* loud, the side effect is not.
+	*
+	* It is a WRAPPER rather than a `catch` inside the body because the window is
+	* not one `try`. Between the flip and a successful delete this provider can
+	* throw from the index-settled re-arm, from the retry loop, and from an
+	* interrupted wait, and the same shape on the sibling `GlobalTable` provider
+	* spans a replica teardown as well. Catching at the boundary covers every
+	* exit; the {@link ProtectionFlipRecord} — not the position of the catch — is
+	* what decides whether there is anything to undo.
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		try {
+			await this.deleteTableResource(logicalId, physicalId, resourceType, context, flip);
+		} catch (error) {
+			await compensateRemovedDeletionProtection({
+				flip,
+				error,
+				logicalId,
+				physicalId,
+				typeLabel: "table",
+				logger: this.logger,
+				reEnable: async () => {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						DeletionProtectionEnabled: true
+					}));
+				}
+			});
+			throw error;
+		}
+	}
+	async deleteTableResource(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting DynamoDB table ${logicalId}: ${physicalId}`);
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
+			let observedProtectionOn = false;
+			try {
+				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
+			} catch (observeError) {
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
 				DeletionProtectionEnabled: false
 			}));
+			if (observedProtectionOn) flip.flippedOffByThisRun = true;
 			this.logger.debug(`Disabled DeletionProtectionEnabled on DynamoDB table ${logicalId}, waiting for ACTIVE`);
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, 60, budget);
@@ -16841,6 +17046,7 @@ var DynamoDBTableProvider = class {
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+					flip.deleteAccepted = true;
 				},
 				reArm: () => waitForIndexesSettled({
 					tableName: physicalId,
@@ -16859,11 +17065,13 @@ var DynamoDBTableProvider = class {
 			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -18064,6 +18272,17 @@ var DynamoDBGlobalTableProvider = class {
 	* terms it closes.
 	*/
 	deleteBudgets = new ElapsedBudgetRegistry();
+	/**
+	* What each in-flight delete did to `DeletionProtectionEnabled` (issue
+	* #1978), keyed exactly as the allowance above and for exactly the same
+	* reason: `destroy-runner.ts` re-enters `delete()` after a retryable failure,
+	* and the second attempt's pre-flip `DescribeTable` sees the guard already
+	* off BECAUSE the first attempt turned it off. A record created per call
+	* would therefore read "nothing to undo" on precisely the retry-then-fail
+	* case the issue names. Keyed rather than a plain field for the budget's
+	* reason too — one provider instance serves a whole level's tables at once.
+	*/
+	protectionFlips = new ProtectionFlipRegistry();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
@@ -19332,13 +19551,42 @@ var DynamoDBGlobalTableProvider = class {
 	* strip a still-existing resource from state.
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		try {
+			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip);
+		} catch (error) {
+			await compensateRemovedDeletionProtection({
+				flip,
+				error,
+				logicalId,
+				physicalId,
+				typeLabel: "GlobalTable",
+				logger: this.logger,
+				reEnable: async () => {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						DeletionProtectionEnabled: true
+					}));
+				}
+			});
+			throw error;
+		}
+	}
+	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting DynamoDB GlobalTable ${logicalId}: ${physicalId}`);
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
+			let observedProtectionOn = false;
+			try {
+				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
+			} catch (observeError) {
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
 				DeletionProtectionEnabled: false
 			}));
+			if (observedProtectionOn) flip.flippedOffByThisRun = true;
 			this.logger.debug(`Disabled DeletionProtectionEnabled on ${logicalId}, waiting for ACTIVE`);
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget);
@@ -19407,6 +19655,7 @@ var DynamoDBGlobalTableProvider = class {
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+					flip.deleteAccepted = true;
 				},
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
 					maxAttempts: 60,
@@ -19423,11 +19672,13 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableGone(physicalId, logicalId, 600, budget);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -65558,6 +65809,10 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * a partially-failed `--revert` still exits 2 through `PartialFailureError`) --
 * those modes report per-resource refusals on their own paths, and changing them
 * would alter what a remediation run means, which is not what this closes.
+* Issue [#2208](https://github.com/go-to-k/cdkd/issues/2208) re-examined that
+* scoping and KEPT it: what those modes owed was not this exit code but an
+* honest SENTENCE, since their no-drift line claimed a clean bill of health for
+* a stack they had not read. See {@link incompleteRemediationMessage}.
 *
 * WHAT DOES NOT TRIGGER IT: a stack whose properties reference
 * `{{resolve:ssm-secure:...}}` still exits 0. Those properties genuinely are not
@@ -65652,6 +65907,171 @@ function outcomeExitSignal(outcome) {
 	});
 }
 /**
+* What {@link incompleteRemediationMessage} says about each reason, and WHICH
+* CLAIM it is allowed to make about it.
+*
+* An exhaustive `Record`, for the same reason {@link notComparedReason} is one:
+* adding a cause must be a COMPILE ERROR here rather than falling into an
+* `else` that describes it as something it is not. The first cut of this
+* function had that `else`, and it was worse than a wrong default -- it
+* described any unknown cause as a dynamic-reference problem, while
+* {@link outcomeExitSignal} deliberately routes every NEW cause to the
+* incomplete side. The two together meant the next cause added would be
+* reported, at once, to the widest audience and under the wrong name. Carrying
+* `kind` in the SAME record rather than a second one beside it means a new
+* reason cannot be given a phrase while quietly inheriting a claim.
+*
+* `kind` exists because one blanket tail overclaimed. The line used to end
+* `..., so cdkd does not know whether they drifted`, which is true of a
+* throttled read and FALSE of a `Custom::*` resource -- for that one, issue
+* [#323](https://github.com/go-to-k/cdkd/issues/323)'s position is that drift is
+* not APPLICABLE, not that cdkd is uncertain. A stack with one throttle and five
+* `Custom::S3AutoDeleteObjects` would have claimed uncertainty about all six.
+*
+* The insertion ORDER is the order the phrases are emitted in, so the line is
+* deterministic without a second list to keep in sync: "not compared at all"
+* first, then the partial ones, then the two structural reasons.
+*
+* The wording splits on "was ANY of it compared", which is the same split the
+* human report's `NOT fully compared` heading makes -- a `readFailed` resource
+* is not "partially" anything.
+*/
+const UNCOMPARED_REASONS = {
+	readFailed: {
+		kind: "unknown",
+		phrase: "not compared AT ALL: the read or comparison failed"
+	},
+	refused: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: cdkd refused to resolve a dynamic reference their state records"
+	},
+	unresolvedToken: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: their state records a `{{resolve:...}}` spelling cdkd resolves for nobody, which no re-run can clear"
+	},
+	unsupported: {
+		kind: "byDesign",
+		phrase: "not compared AT ALL: their provider does not support drift detection yet"
+	},
+	skipped: {
+		kind: "byDesign",
+		phrase: "not compared AT ALL: cdkd does not drift-check the type"
+	}
+};
+/**
+* The sentence lead each {@link UncomparedKind} group is reported under.
+*
+* Exhaustive for the same reason the record above is, and SEPARATE from it
+* because the lead is per GROUP while the phrase is per reason: writing the
+* claim into each phrase would put five copies of two sentences in the file,
+* and five copies is how two of them come to disagree.
+*
+* Insertion order is emit order, and `unknown` comes first deliberately: it is
+* the half the user can do something about.
+*/
+const UNCOMPARED_KIND_LEADS = {
+	unknown: "cdkd does not know whether these drifted",
+	byDesign: "Not drift-checked by cdkd at all, which is a coverage limit rather than uncertainty"
+};
+/**
+* How many resources across every report ended UNCOMPARED, per reason.
+*
+* The `notCompared` population is read through {@link notComparedOutcomes} --
+* the single spelling both renderings already share -- and the other two come
+* from an exhaustive `matchOutcome`, so a new outcome variant cannot join the
+* "nothing to say about it" side by omission. That is the same guarantee
+* {@link outcomeExitSignal} carries at the exit code, applied to the count.
+*/
+function uncomparedTally(reports) {
+	const tally = /* @__PURE__ */ new Map();
+	const bump = (reason) => {
+		tally.set(reason, (tally.get(reason) ?? 0) + 1);
+	};
+	for (const report of reports) {
+		for (const { cause } of notComparedOutcomes(report)) bump(cause);
+		for (const outcome of report.outcomes) matchOutcome(outcome, {
+			drifted: () => {},
+			clean: () => {},
+			notCompared: () => {},
+			unsupported: () => bump("unsupported"),
+			skipped: () => bump("skipped")
+		});
+	}
+	return tally;
+}
+/**
+* The lines `--accept` / `--revert` print INSTEAD of `No drift detected --
+* nothing to accept.` when the run found no drift but did not manage to compare
+* everything ([issue #2208](https://github.com/go-to-k/cdkd/issues/2208)).
+*
+* MESSAGE-ONLY, and the EXIT CODE deliberately stays `0`. The remediation
+* modes' exit codes are a documented user contract -- #2108 scoped its `2` to
+* detection-only mode on purpose, and {@link DriftComparisonIncompleteError}'s
+* note says why: "changing them would alter what a remediation run means".
+* Nothing about that reasoning expired. The defect this closes is entirely in
+* what the run REPORTS: `--accept` / `--revert` already correctly leave an
+* uncompared resource alone (both iterate the drifted outcomes only, asserted
+* in `tests/unit/cli/drift-per-resource-failure.test.ts`), so the state and AWS
+* are right and only the sentence is wrong. Making the remediation path exit
+* non-zero would break the CI of everyone running `cdkd drift --accept` over a
+* stack that hits a throttle, to fix a wording problem.
+*
+* What the lines have to carry, since the exit code will not carry it: that the
+* comparison was INCOMPLETE (never that no drift was detected), HOW MANY
+* resources were not compared and WHY, WHICH of those cdkd is actually
+* uncertain about, and the pointer to the detection-only run, which is the mode
+* whose exit code does report it (`2`).
+*
+* THE TRIGGER AND THE COUNT ARE DIFFERENT POPULATIONS, deliberately, and
+* collapsing them is the defect review round 1 found here.
+*
+*   - The TRIGGER is `anyIncomplete`, i.e. {@link outcomeExitSignal}'s
+*     `incomplete`. It is narrow on purpose: a stack whose ONLY uncompared
+*     resource holds a `{{resolve:ssm-secure:...}}` token must not start
+*     shouting on every run about a comparison no action of the user's can ever
+*     complete -- the same CI-forever hazard that cause is kept out of the exit
+*     code on.
+*   - The COUNT and the LABELS, once the line is triggered, cover EVERY
+*     uncompared resource, each named by its own reason (see
+*     {@link uncomparedTally}). A resource that was not compared was not
+*     compared, whatever the reason, and counting only the clearable ones
+*     printed `1 of 3` on a stack the report a few lines above called
+*     `2 resource(s) NOT fully compared` -- two lines disagreeing about one
+*     run, with the newer and quieter one being the one written to stop a
+*     command from being quietly reassuring.
+*
+* WHAT `N` AND `M` ARE, stated because the alternatives are all defensible and
+* silence about the choice is what made the first cut wrong. `M` is the total
+* number of resource outcomes, and `N` is every one of them that was not
+* compared -- so `unsupported` and `skipped` land in `N`, WITH their own
+* phrase, rather than sitting only in the denominator where they would inflate
+* `M` and go unnamed. On a remediation path, erring LOUD is the correct
+* direction. Note this makes `N` deliberately WIDER than the report's
+* `NOT fully compared` heading, which counts the reference / read population
+* only and reports `drift unknown` separately: the question this line answers
+* is #2154's, "was everything actually compared", not "how many entries are in
+* that block". What being in `N` does NOT buy is a uniform claim about the
+* resource -- see {@link UNCOMPARED_REASONS}'s `kind`, and see
+* {@link UncomparedReason} for why counting a `skipped` resource here is not a
+* reversal of #323's silence.
+*/
+function incompleteRemediationMessage(reports, mode) {
+	const tally = uncomparedTally(reports);
+	const total = reports.reduce((n, report) => n + report.outcomes.length, 0);
+	const uncompared = [...tally.values()].reduce((a, b) => a + b, 0);
+	const kinds = Object.keys(UNCOMPARED_KIND_LEADS);
+	const reasons = Object.keys(UNCOMPARED_REASONS);
+	const groups = kinds.flatMap((kind) => {
+		const parts = reasons.filter((reason) => UNCOMPARED_REASONS[reason].kind === kind && (tally.get(reason) ?? 0) > 0).map((reason) => `${tally.get(reason)} ${UNCOMPARED_REASONS[reason].phrase}`);
+		return parts.length === 0 ? [] : [`${UNCOMPARED_KIND_LEADS[kind]} — ${parts.join("; ")}.`];
+	});
+	return [
+		`Comparison INCOMPLETE — nothing to ${mode}, and that is NOT a clean bill of health: ${uncompared} of ${total} resource(s) could not be compared.`,
+		...groups,
+		`Re-run 'cdkd drift' without --${mode} to see which resources and why — a detection-only run exits 2 while a comparison is incomplete.`
+	];
+}
+/**
 * `cdkd drift [<stack>...]` command implementation.
 *
 * Three operating modes (mutually exclusive):
@@ -65728,6 +66148,10 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		if (!drifted) {
+			if (anyIncomplete) {
+				for (const line of incompleteRemediationMessage(reports, options.accept ? "accept" : "revert")) logger.info(line);
+				return;
+			}
 			logger.info(options.accept ? "No drift detected — nothing to accept." : "No drift detected — nothing to revert.");
 			return;
 		}
@@ -86808,4 +87232,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Bd0gnMR0.js.map
+//# sourceMappingURL=program-DjH_cfVU.js.map