@go-to-k/cdkd 0.284.54 → 0.284.56

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $n as clearBucketRegionCache, Dr as isCdkdError, Er as formatError, Ht as DiffCalculator, Jt as LockManager, Kt as DagBuilder, Or as normalizeAwsError, Tr as SynthesisError, W as IAMRoleProvider, Xt as S3StateBackend, Zn as AssemblyReader, ar as AssetError, er as resolveBucketRegion, hr as LockError, ir as setAwsClients, kn as Synthesizer, lr as DependencyError, nn as AssetPublisher, nr as getAwsClients, nt as CloudControlProvider, or as CdkdError, q as ProviderRegistry, qt as TemplateParser, r as DeployEngine, rr as resetAwsClients, sr as ConfigError, tr as AwsClients, wr as StateError, yr as ProvisioningError } from "./deploy-engine-B9SrF2-R.js";
+import { An as Synthesizer, Dr as formatError, Er as SynthesisError, Jt as TemplateParser, Or as isCdkdError, Qn as AssemblyReader, Tr as StateError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as setAwsClients, br as ProvisioningError, cr as ConfigError, er as clearBucketRegionCache, gr as LockError, ir as resetAwsClients, kr as normalizeAwsError, nr as AwsClients, or as AssetError, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, sr as CdkdError, tr as resolveBucketRegion, ur as DependencyError } from "./deploy-engine-CNYFUw4D.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Bpz-tAA5.js → program-BsvNn8Y3.js}

@@ -1,7 +1,7 @@
-import { $ as endCommandInterruptScope, $t as importableOutputKeys, A as renderStatefulReason, An as synthesisStatusMessage, Ar as isMarkedNonRetryable, At as maskSecretsInError, B as exportAliasCollisionScrubWarning, Bn as stateBucketExistenceConfirmed, Bt as s3BucketWebsiteUrl, C as isFinalSnapshotError, Cn as getDockerCmd, Cr as StackTerminationProtectionError, Ct as STATE_SOURCED_CROSS_GENERATION_RULES, D as extractDeploymentEventError, Dn as AssetManifestLoader, Dt as dynamicReferenceTokens, E as makeCanonicalizePropertiesFn, En as runDockerStreaming, Et as createSecretMasker, F as green, Fn as resolveCaptureObservedState, Ft as producerRegionsFromState, G as collectInlinePolicyNamesManagedBySiblings, Gn as findLargeInlineResources, Gt as withRetry, H as secretBearingStateKeyWarning, Hn as CFN_TEMPLATE_BODY_LIMIT, Ht as DiffCalculator, I as red, In as resolveSkipPrefix, It as s3BucketArn, J as findActionableSilentDrops, Jn as PARTITION_TABLE, Jt as LockManager, K as clearOnUpdateRemoval, Kn as uploadCfnTemplate, Kt as DagBuilder, L as yellow, Ln as resolveStateBucketWithDefault, Lt as s3BucketDomainName, M as bold, Mn as getLegacyStateBucketName, Mr as isThrottlingError, Mt as redactSecretsForState, N as cyan, Nn as resolveApp, Nr as markNonRetryable, Nt as scrubResourceRecord, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerImageBySourceHash, Or as normalizeAwsError, Ot as errorCauseChain, P as gray, Pn as resolveAutoAssetStorage, Pt as classifyReplaySecretRegion, Q as beginCommandInterruptScope, Qn as processStackMessages, Qt as exportNamesCarriedFrom, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefaultAndSource, Rt as s3BucketDualStackDomainName, S as createPreDeleteFinalSnapshot, Sn as formatDockerLoginError, Sr as StackHasActiveImportsError, St as requireConfigString, T as unsupportedFinalSnapshotError, Tn as runDockerForeground, Tt as TEMPLATE_SOURCED_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_URL_LIMIT, Ut as INTRINSIC_KEYS, V as isExportAliasCollision, Vn as warnDeprecatedNoPrefixCliFlag, Vt as applyRoleArnIfSet, W as IAMRoleProvider, Wn as MIGRATE_TMP_PREFIX, Wt as describeTypeWithThrottleRetry, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as derivePartitionAndUrlSuffix, Xt as S3StateBackend, Y as findSilentDropProperties, Yn as canonicalizeRegion, Yt as displaySafe, Z as DEFAULT_STATE_PREFIX, Zn as AssemblyReader, Zt as rebuildClientForBucketRegion, _ as computeImplicitDeleteEdges, _n as validateAssetBucketName, _r as NestedStackChildDirectDestroyError, _t as configStringRefusal, a as DeploymentEventsStore, an as buildAssetRedirectMap, at as isTerminationProtectionPropagationError, b as buildFinalSnapshotIdentifier, bn as buildDockerImage, br as ResourceTimeoutError, bt as requireConfigArray, c as replayFailedOperations, cn as rewriteTemplateAssetReferences, cr as CrossAccountSecretRefusalError, ct as cfnRefValueFromPhysicalId, d as updatePartialReason, dn as AssetModeResolver, dr as DynamicReferenceRegionAmbiguousError, dt as WAFv2WebACLProvider, en as importableOutputs, er as resolveBucketRegion, et as isInterruptedWaitError, f as UNSPECIFIED_SKIP_REASON, fn as BOOTSTRAP_MARKER_PREFIX, fr as LocalInvokeBuildError$1, ft as normalizeAwsTagsToCfn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as readBootstrapMarkerBody, gr as MissingCdkCliError, gt as configBooleanRefusal, h as maskingRetryLogger, hn as parseBootstrapMarker, ht as coerceCfnBoolean, i as DeploymentEventsReader, in as WorkGraph, ir as setAwsClients, it as disableInstanceApiTermination, j as formatResourceLine, jn as getDefaultStateBucketName, jr as isRetryableTransientError, jt as maskSecretsInText, k as isStatefulRecreateTargetSync, kn as Synthesizer, kr as withErrorHandling, kt as isSingleDynamicReferenceToken, l as replayRollback, ln as escapeRegExp, lt as getAccountInfo, m as withResourceDeadline, mn as getBootstrapMarkerKey, mr as LocalStartServiceError, mt as assertRegionMatch, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssetPublisher, nr as getAwsClients, nt as CloudControlProvider, o as planFailedOps, on as createAssetRedirectResolver, or as CdkdError, ot as IntrinsicFunctionResolver, p as deleteSkipReason, pn as ensureAssetStorage, pr as LocalMigrateError, pt as resolveExplicitPhysicalId, q as ProviderRegistry, qn as expectedOwnerParam, qt as TemplateParser, r as DeployEngine, rn as stringifyValue, rr as resetAwsClients, rt as slowCcOperationTimeoutMs, s as planRollback, sn as loadPublishableAssetManifest, st as carriesDynamicReference, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as shouldRetainResource, tr as AwsClients, tt as startInterruptWatch, u as updatePartialMessage, un as stripControlChars, ur as DeployCancelledError, ut as refStateLookupFromResource, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateContainerRepoName, vr as PartialFailureError, vt as readConfigString, w as refusesFinalSnapshot, wn as partitionSensitiveEnv, wt as STATE_SOURCED_READBACK_RULES, x as ccRoutedFinalSnapshotError, xn as dockerSpawnEnvWithSensitive, xr as ResourceUpdateNotSupportedError, xt as requireConfigObject, y as PRE_DELETE_SNAPSHOT_TYPES, yn as buildDenyExternalAccessPolicy, yr as ProvisioningError, yt as replayWarn, z as collectPublishedOutputNames, zn as resolveUseCdkBootstrapAssets, zt as s3BucketRegionalDomainName } from "./deploy-engine-B9SrF2-R.js";
+import { $ as endCommandInterruptScope, $n as processStackMessages, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as Synthesizer, Ar as withErrorHandling, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveUseCdkBootstrapAssets, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as formatDockerLoginError, Cr as StackHasActiveImportsError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as runDockerStreaming, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as runDockerForeground, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as resolveAutoAssetStorage, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as MIGRATE_TMP_PREFIX, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as warnDeprecatedNoPrefixCliFlag, Ht as applyRoleArnIfSet, I as red, In as resolveCaptureObservedState, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as expectedOwnerParam, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as findLargeInlineResources, Kt as withRetry, L as yellow, Ln as resolveSkipPrefix, Lt as s3BucketArn, M as bold, Mn as getDefaultStateBucketName, Mr as isRetryableTransientError, Mt as maskSecretsInText, N as cyan, Nn as getLegacyStateBucketName, Nr as isThrottlingError, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as AssetManifestLoader, Ot as dynamicReferenceTokens, P as gray, Pn as resolveApp, Pr as markNonRetryable, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as AssemblyReader, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefault, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as dockerSpawnEnvWithSensitive, Sr as ResourceUpdateNotSupportedError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as partitionSensitiveEnv, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_BODY_LIMIT, Ut as DiffCalculator, V as isExportAliasCollision, Vn as stateBucketExistenceConfirmed, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as CFN_TEMPLATE_URL_LIMIT, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as canonicalizeRegion, Xt as displaySafe, Y as findSilentDropProperties, Yn as PARTITION_TABLE, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as derivePartitionAndUrlSuffix, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as readBootstrapMarkerBody, _r as MissingCdkCliError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as setAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as buildDenyExternalAccessPolicy, br as ProvisioningError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as DeployCancelledError, dt as refStateLookupFromResource, en as importableOutputKeys, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, fr as DynamicReferenceRegionAmbiguousError, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as parseBootstrapMarker, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as getBootstrapMarkerKey, hr as LocalStartServiceError, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as resetAwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as synthesisStatusMessage, jr as isMarkedNonRetryable, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as getDockerImageBySourceHash, kr as normalizeAwsError, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CrossAccountSecretRefusalError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as ensureAssetStorage, mr as LocalMigrateError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nr as AwsClients, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as LocalInvokeBuildError$1, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as uploadCfnTemplate, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as CdkdError, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as resolveBucketRegion, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateAssetBucketName, vr as NestedStackChildDirectDestroyError, vt as configStringRefusal, w as refusesFinalSnapshot, wn as getDockerCmd, wr as StackTerminationProtectionError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as buildDockerImage, xr as ResourceTimeoutError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as validateContainerRepoName, yr as PartialFailureError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveStateBucketWithDefaultAndSource, zt as s3BucketDualStackDomainName } from "./deploy-engine-CNYFUw4D.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-DLRgymoe.js";
-import { t as ASGProvider } from "./asg-provider-BaNTIjU4.js";
+import { t as getCdkdVersion } from "./version-oF2rSNET.js";
+import { t as ASGProvider } from "./asg-provider-DoiQARH6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2055,6 +2055,15 @@ function createListCommand() {
 */
 function forwardSigtermToSigint() {
 	beginCommandInterruptScope();
+	try {
+		return installSigtermForwarder();
+	} catch (error) {
+		endCommandInterruptScope();
+		throw error;
+	}
+}
+/** The registration half of {@link forwardSigtermToSigint}, after its scope is open. */
+function installSigtermForwarder() {
 	const handler = () => {
 		if (process.listenerCount("SIGINT") === 0) process.exit(143);
 		process.emit("SIGINT", "SIGINT");
@@ -2065,6 +2074,117 @@ function forwardSigtermToSigint() {
 		endCommandInterruptScope();
 	};
 }
+/**
+* Register a command-scoped SIGINT handler for the destroy commands
+* (issue #2117).
+*
+* `cdkd deploy` has had one of these since issue #1348 (`deploy.ts`'s
+* `topLevelSigintHandler`). The destroy side had none, so the ONLY channel
+* carrying "the user interrupted" from `runDestroyForStack` back to the
+* `--all` loop was `DestroyRunResult.interrupted` — a boolean assigned ONCE,
+* inside the runner's `try`, after its level loop. Every instant where the
+* runner's `draining` flag flips AFTER that assignment is an instant where
+* `cdkd destroy --all` went on to delete the NEXT stack after the user asked
+* it to stop.
+*
+* The runner's outer `finally` re-syncs `result.interrupted ||= draining` to
+* cover the widest such window (renderer teardown, state flush, lock release),
+* and that line is marked TACTICAL in its own comment: it narrows the window
+* rather than removing it. Two gaps survive it, and neither is reachable from
+* inside the runner at all:
+*
+* 1. The runner removes its SIGINT listener in its inner `finally`, BEFORE the
+*    re-sync line and its `return`, so from there on nothing of the runner's is
+*    armed. This watch covers that stretch — by RECORDING once a graceful owner
+*    is gone and the stack is done, and by QUITTING in the mirror-image window
+*    at the START of a stack, where the runner has not armed yet and could not
+*    act on a recorded flag (see `gracefulOwnerArmed` below).
+* 2. Everything the `--all` loop itself does between two stacks — the
+*    `RUN_FINISHED` event, `eventRecorder.finalize`, `purgeEventsAfterDestroy`
+*    — runs with no runner handler armed at all.
+*
+* A handler that lives for the whole command closes both, because it is armed
+* in every window rather than in the ones the runner happens to span. The two
+* flags answer different questions and both are kept: `result.interrupted` is
+* the PER-STACK outcome (it decides that stack's state preservation, its
+* summary line and its `--purge-events` skip), while this one is the
+* COMMAND-level "stop" the loop wants.
+*
+* Note on the counterpart contract: `deploy-engine.ts` removes its own SIGINT
+* handler before releasing its lock, which is safe only because `deploy.ts`'s
+* top-level handler outlives it. The destroy side now has the same property
+* for the same reason — `destroy-runner.ts`'s `process.removeListener('SIGINT',
+* sigintHandler)` is no longer the last handler standing, because this one is
+* disposed only in the command's outermost `finally`.
+*
+* @param opts.command the user-facing command name used in the force-quit
+*   notice (`cdkd destroy` / `cdkd state destroy`).
+*/
+function watchCommandInterrupt(opts) {
+	let interrupted = false;
+	let stacksInFlight = 0;
+	/**
+	* Is some OTHER listener going to handle this signal gracefully?
+	*
+	* Being inside `runStack` is NOT the same question, and assuming it was is a
+	* regression this fix already shipped once: `runDestroyForStack` registers
+	* its own handler about two hundred lines in, AFTER the strong-reference
+	* pre-flight scan (an S3 LIST plus a GET per stack) and the per-stack
+	* confirm prompt. Staying silent across that window swallowed the signal
+	* outright — no notice, no exit, no escalation on a repeat — and because
+	* this watch IS a listener, `interrupt-watch.ts`'s last-listener force-quit
+	* could no longer fire there either. The runner then began with `draining`
+	* false and destroyed the whole stack the user had just asked to stop, which
+	* is issue #2117's own defect one window further in.
+	*
+	* Counting listeners answers the real question, and the two exclusions are
+	* what make the count mean "graceful owner":
+	*
+	*  - our own handler, which is not an answer to itself;
+	*  - `interrupt-watch.ts`'s shared handler, which is a LATCH rather than a
+	*    graceful owner — deferring to it is exactly the swallow above.
+	*
+	* A provider's transient wait listener (CustomResource / ACM / CloudFront /
+	* Route53) does count, and that is correct rather than a false positive:
+	* those exist only DURING a provider wait, which is strictly inside the
+	* runner handler's own lifetime, so one cannot be present while the runner's
+	* is absent.
+	*/
+	function gracefulOwnerArmed() {
+		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
+	}
+	const handler = () => {
+		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
+			interrupted = true;
+			return;
+		}
+		if (interrupted) {
+			process.stderr.write("\nForce-quit.\n");
+			process.exit(130);
+		}
+		interrupted = true;
+		if (stacksInFlight > 0) {
+			process.stderr.write(`\nInterrupted before ${opts.command} armed its per-stack teardown — quitting now. Nothing was deleted and no stack lock is held.\n`);
+			process.exit(130);
+		}
+		process.stderr.write(`\nInterrupted — ${opts.command} will stop before starting another stack (press Ctrl-C again to force-quit)...\n`);
+	};
+	process.on("SIGINT", handler);
+	return {
+		interrupted: () => interrupted,
+		async runStack(fn) {
+			stacksInFlight += 1;
+			try {
+				return await fn();
+			} finally {
+				stacksInFlight -= 1;
+			}
+		},
+		dispose: () => {
+			process.removeListener("SIGINT", handler);
+		}
+	};
+}
 
 //#endregion
 //#region src/deployment/recreate-targets.ts
@@ -15927,17 +16047,60 @@ var ProtectionFlipRegistry = class {
 	/**
 	* The record for `key`, creating it on first use and REUSING it on re-entry.
 	*
-	* `reuseWithinMs` bounds how long an entry may be reused for and is passed
-	* the same `DELETE_BUDGET_REUSE_WINDOW_MS` the allowance uses: past the
-	* deadline the whole path is sized against, that deadline has certainly
-	* fired, so a caller arriving now belongs to a NEW operation and must not
-	* inherit a previous one's flip. Without it a retained record would make a
-	* much later destroy of the same table re-enable a guard it never touched.
+	* `reuseWithinMs` bounds how long an entry may sit UNUSED, and the window
+	* SLIDES: every reuse restarts the stopwatch, so what is bounded is the idle
+	* time since the last `acquire` rather than the entry's total lifetime. It is
+	* passed the same `DELETE_BUDGET_REUSE_WINDOW_MS` the allowance uses, and it
+	* is still needed for the reason it was introduced: entries are RETAINED on a
+	* throw, so without any bound a retained record would let a much LATER
+	* destroy of the same table re-enable a guard it never touched — the inverse
+	* hazard of the one this record exists for.
+	*
+	* Measuring from FIRST acquisition instead is what issue #2211 reported, and
+	* it re-creates issue #1978's residue through this very mechanism. The retry
+	* sequence is unbounded while the window is a wall clock, so a
+	* `--resource-timeout` overshoot past `DELETE_BUDGET_REUSE_WINDOW_MS` lets a
+	* LIVE sequence age out MID-flight: `acquire` drops the entry and hands the
+	* next attempt a fresh `{ flippedOffByThisRun: false }`, whose pre-flip
+	* `DescribeTable` then observes the guard already OFF — because attempt 1
+	* turned it off — so the latch stays `false` and a terminal failure
+	* compensates nothing.
+	*
+	* KNOWN BOUND, stated because the obvious reading overclaims it. `acquire` is
+	* called ONCE per `delete()`, at the top, and nothing touches the entry's
+	* idle STOPWATCH again (the record's fields are mutated throughout, and
+	* `release` drops it) — so the interval this measures is not a gap BETWEEN
+	* operations, it is the previous ATTEMPT's own duration plus the outer loop's
+	* backoff.
+	*
+	* That is normally comfortable, and the arithmetic is worth having right.
+	* `DELETE_BUDGET_REUSE_WINDOW_MS` is `DYNAMODB_DELETE_BUDGET_MS` (26 min)
+	* plus `DYNAMODB_DELETE_DEADLINE_MARGIN_MS` (4 min). The 26 minutes is the
+	* allowance for the WHOLE retry sequence, not for one attempt —
+	* `ElapsedBudgetRegistry.acquire` hands back the SAME budget on re-entry — so
+	* a budget-conforming attempt plus one backoff is at most ~26m20s against a
+	* 30-minute window, and the margin exists precisely to price that backoff.
+	*
+	* What can still age out a successor is therefore an attempt that OVERRUNS
+	* the allowance rather than one that merely spends it: `attemptsWithin` keeps
+	* a `minAttempts` floor poll even at zero remaining, and the auto-scaling
+	* teardown is unpriced (see `src/utils/elapsed-budget.ts`). The slide removes
+	* the ACCUMULATION case — many attempts summing past the window, the common
+	* shape and the one issue #2211 reported — not the overrun one.
+	*
+	* Closing the remainder means sliding at attempt END too (a `touch(key)` in
+	* `delete()`'s catch, making the measured gap the loop backoff rather than
+	* the attempt), or sizing this window independently of the delete budget.
+	* Both are behaviour changes to the delete path and belong in their own
+	* change rather than riding this one.
 	*/
 	acquire(key, reuseWithinMs, clock = monotonicNowMs) {
 		const existing = this.records.get(key);
 		if (existing) {
-			if (existing.age.elapsedMs() <= reuseWithinMs) return existing.record;
+			if (existing.idle.elapsedMs() <= reuseWithinMs) {
+				existing.idle = new ElapsedBudget(reuseWithinMs, clock);
+				return existing.record;
+			}
 			this.records.delete(key);
 		}
 		const created = {
@@ -15945,7 +16108,7 @@ var ProtectionFlipRegistry = class {
 				flippedOffByThisRun: false,
 				deleteAccepted: false
 			},
-			age: new ElapsedBudget(reuseWithinMs, clock)
+			idle: new ElapsedBudget(reuseWithinMs, clock)
 		};
 		this.records.set(key, created);
 		return created.record;
@@ -16044,9 +16207,30 @@ async function compensateRemovedDeletionProtection(opts) {
 		await opts.reEnable();
 		opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: the delete failed after --remove-protection had turned DeletionProtectionEnabled off, so it was re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
 	} catch (reEnableError) {
-		opts.logger.error(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could NOT re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — that table is LIVE with its deletion protection still off. Restore it with: aws dynamodb update-table --table-name ${opts.physicalId} --deletion-protection-enabled. (${reEnableError instanceof Error ? reEnableError.message : String(reEnableError)})`);
+		const detail = reEnableError instanceof Error ? reEnableError.message : String(reEnableError);
+		if (isResourceNotFoundError(reEnableError)) {
+			const regionArg = opts.region ? ` --region ${opts.region}` : "";
+			opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could not re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — DynamoDB answered ResourceNotFound. That most commonly means the table is gone or its status is not ACTIVE, and it can also mean the table is not in this region or account. If it still exists, its deletion protection is OFF. Check with: aws dynamodb describe-table --table-name ${opts.physicalId}${regionArg} and if it is there, restore it with: aws dynamodb update-table --table-name ${opts.physicalId}${regionArg} --deletion-protection-enabled. (${detail})`);
+			return;
+		}
+		opts.logger.error(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could NOT re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — that table is LIVE with its deletion protection still off. Restore it with: aws dynamodb update-table --table-name ${opts.physicalId} --deletion-protection-enabled. (${detail})`);
 	}
 }
+/**
+* Whether `error` is DynamoDB's `ResourceNotFoundException`.
+*
+* Keyed on the SDK's `name` rather than on `instanceof`, so this module keeps
+* its (deliberate) freedom from an `@aws-sdk/client-dynamodb` import and so a
+* second client instance of the class still matches.
+*
+* Deliberately NOT a `cause`-chain walk: every `reEnable` callback handed to
+* {@link compensateRemovedDeletionProtection} is a bare `UpdateTable` send, so
+* the SDK error arrives unwrapped. If one ever wraps its call, this answers
+* `false` and the compensation keeps the LOUD error line — the safe direction.
+*/
+function isResourceNotFoundError(error) {
+	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
+}
 
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
@@ -17007,6 +17191,7 @@ var DynamoDBTableProvider = class {
 				physicalId,
 				typeLabel: "table",
 				logger: this.logger,
+				...context?.expectedRegion ? { region: context.expectedRegion } : {},
 				reEnable: async () => {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
@@ -19573,6 +19758,7 @@ var DynamoDBGlobalTableProvider = class {
 				physicalId,
 				typeLabel: "GlobalTable",
 				logger: this.logger,
+				...context?.expectedRegion ? { region: context.expectedRegion } : {},
 				reEnable: async () => {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
@@ -68211,7 +68397,14 @@ async function destroyCommand(stackArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const unforwardSigterm = forwardSigtermToSigint();
+	const interruptWatch = watchCommandInterrupt({ command: "cdkd destroy" });
+	let unforwardSigterm;
+	try {
+		unforwardSigterm = forwardSigtermToSigint();
+	} catch (error) {
+		interruptWatch.dispose();
+		throw error;
+	}
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -68271,6 +68464,7 @@ async function destroyCommand(stackArgs, options) {
 		let totalErrors = 0;
 		let totalSkipped = 0;
 		let interrupted = false;
+		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stackNames;
 		if (options.all) stackNames = candidateStacks.map((s) => s.stackName);
 		else if (stackPatterns.length > 0) stackNames = matchStacks(candidateStacks, stackPatterns).map((s) => s.stackName);
@@ -68347,6 +68541,7 @@ async function destroyCommand(stackArgs, options) {
 				totalErrors++;
 				continue;
 			}
+			if (runInterrupted()) break;
 			const eventRecorder = startRunRecorder({
 				backend: stateBackend,
 				stackName,
@@ -68355,7 +68550,7 @@ async function destroyCommand(stackArgs, options) {
 			});
 			let destroyRunResult = "SUCCEEDED";
 			try {
-				const result = await withNestedStackContext({
+				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend,
 					lockManager,
 					providerRegistry,
@@ -68394,7 +68589,7 @@ async function destroyCommand(stackArgs, options) {
 					...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs },
 					eventRecorder
-				}));
+				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
@@ -68421,15 +68616,16 @@ async function destroyCommand(stackArgs, options) {
 			await purgeEventsAfterDestroy(new DeploymentEventsReader(stateBackend), stackName, stackTargetRegion, {
 				purgeEvents: options.purgeEvents,
 				runResult: destroyRunResult,
-				interrupted
+				interrupted: runInterrupted()
 			}, logger);
-			if (interrupted) break;
+			if (runInterrupted()) break;
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
+		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
+		interruptWatch.dispose();
 		awsClients.destroy();
 	}
 }
@@ -72997,7 +73193,14 @@ async function stateDestroyCommand(stackArgs, options) {
 	registerAllProviders(providerRegistry);
 	providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 	if (options.allowUnsupportedTypes?.length) providerRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
-	const unforwardSigterm = forwardSigtermToSigint();
+	const interruptWatch = watchCommandInterrupt({ command: "cdkd state destroy" });
+	let unforwardSigterm;
+	try {
+		unforwardSigterm = forwardSigtermToSigint();
+	} catch (error) {
+		interruptWatch.dispose();
+		throw error;
+	}
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -73033,6 +73236,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		let totalErrors = 0;
 		let totalSkipped = 0;
 		let interrupted = false;
+		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		for (const stackName of stackNames) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
@@ -73054,7 +73258,8 @@ async function stateDestroyCommand(stackArgs, options) {
 					logger.warn(`No state found for stack ${stackName}${ref.region ? ` in ${ref.region}` : ""}, skipping`);
 					continue;
 				}
-				const result = await withNestedStackContext({
+				if (runInterrupted()) break;
+				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend: setup.stateBackend,
 					lockManager: setup.lockManager,
 					providerRegistry,
@@ -73092,19 +73297,20 @@ async function stateDestroyCommand(stackArgs, options) {
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 					...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
-				}));
+				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
-				if (interrupted) break;
+				if (runInterrupted()) break;
 			}
-			if (interrupted) break;
+			if (runInterrupted()) break;
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
+		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd state destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
+		interruptWatch.dispose();
 		setup.dispose();
 	}
 }
@@ -87364,4 +87570,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Bpz-tAA5.js.map
+//# sourceMappingURL=program-BsvNn8Y3.js.map