@go-to-k/cdkd 0.284.70 → 0.284.72

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Cr as LockError, Dr as ProvisioningError, Fr as isCdkdError, G as IAMRoleProvider, Ht as TemplateParser, Ir as normalizeAwsError, J as ProviderRegistry, Ln as Synthesizer, Lt as DiffCalculator, Mr as StateError, Nr as SynthesisError, Pr as formatError, Vt as DagBuilder, _r as DependencyError, ar as AssemblyReader, cn as AssetPublisher, cr as resolveBucketRegion, dr as resetAwsClients, en as LockManager, fr as setAwsClients, hr as ConfigError, lr as AwsClients, mr as CdkdError, nn as S3StateBackend, pr as AssetError, r as DeployEngine, sr as clearBucketRegionCache, st as CloudControlProvider, ur as getAwsClients } from "./deploy-engine-D4VFWSQr.js";
+import { Cr as LockError, Dr as ProvisioningError, Fr as isCdkdError, G as IAMRoleProvider, Ht as TemplateParser, Ir as normalizeAwsError, J as ProviderRegistry, Ln as Synthesizer, Lt as DiffCalculator, Mr as StateError, Nr as SynthesisError, Pr as formatError, Vt as DagBuilder, _r as DependencyError, ar as AssemblyReader, cn as AssetPublisher, cr as resolveBucketRegion, dr as resetAwsClients, en as LockManager, fr as setAwsClients, hr as ConfigError, lr as AwsClients, mr as CdkdError, nn as S3StateBackend, pr as AssetError, r as DeployEngine, sr as clearBucketRegionCache, st as CloudControlProvider, ur as getAwsClients } from "./deploy-engine-Bc0FBOuJ.js";
 import { i as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-C9-E73FI.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CP4DgOV1.js → program-B2i8bJUJ.js}

@@ -1,7 +1,7 @@
-import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as scrubResourceRecord, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as producerRegionsFromState, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as withRetry, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as s3BucketWebsiteUrl, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as TEMPLATE_SOURCED_RULES, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as TemplateParser, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as applyRoleArnIfSet, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as errorCauseChain, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as createSecretMasker, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as DiffCalculator, M as bold, Mn as partitionSensitiveEnv, Mt as s3BucketDomainName, N as cyan, Nn as runDockerForeground, Nt as s3BucketDualStackDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as s3BucketRegionalDomainName, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as redactSecretsForState, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as INTRINSIC_KEYS, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as STATE_SOURCED_CROSS_GENERATION_RULES, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as DagBuilder, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as STATE_SOURCED_READBACK_RULES, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as maskSecretsInError, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as isSingleDynamicReferenceToken, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as maskSecretsInText, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as s3BucketArn, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as classifyReplaySecretRegion, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as dynamicReferenceTokens, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as describeTypeWithThrottleRetry } from "./deploy-engine-D4VFWSQr.js";
+import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as scrubResourceRecord, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as producerRegionsFromState, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as withRetry, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as s3BucketWebsiteUrl, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as TEMPLATE_SOURCED_RULES, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as TemplateParser, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as applyRoleArnIfSet, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as errorCauseChain, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as createSecretMasker, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as DiffCalculator, M as bold, Mn as partitionSensitiveEnv, Mt as s3BucketDomainName, N as cyan, Nn as runDockerForeground, Nt as s3BucketDualStackDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as s3BucketRegionalDomainName, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as redactSecretsForState, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as INTRINSIC_KEYS, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as STATE_SOURCED_CROSS_GENERATION_RULES, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as DagBuilder, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as STATE_SOURCED_READBACK_RULES, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as maskSecretsInError, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as isSingleDynamicReferenceToken, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as maskSecretsInText, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as s3BucketArn, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as classifyReplaySecretRegion, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as dynamicReferenceTokens, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as describeTypeWithThrottleRetry } from "./deploy-engine-Bc0FBOuJ.js";
 import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-AKrmxFD7.js";
-import { t as ASGProvider } from "./asg-provider-Ag8vynRR.js";
+import { t as getCdkdVersion } from "./version-DY_eLvXB.js";
+import { t as ASGProvider } from "./asg-provider-DcAqfBUo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6969,6 +6969,141 @@ function bucketLocationToRegion(constraint) {
 	if (value === "eu") return "eu-west-1";
 	return value;
 }
+/**
+* Whether an error from `GetBucketLocation` means "no bucket of that name".
+*
+* The test is the wire error CODE, which the SDK lifts onto `name`.
+*
+* An earlier revision of this comment said `GetBucketLocation` does NOT
+* deserialize its 404 into the modeled `NoSuchBucket` class "the way
+* `DeleteBucket`'s is", inferring that from `GetBucketLocationCommand.d.ts`
+* declaring only `@throws {@link S3ServiceException}`. That inference is
+* FALSE and was measured false on 2026-08-26 by feeding canned 404 XML through
+* the real client: both operations yield `ctor=NoSuchBucket`,
+* `name=NoSuchBucket`, `instanceof NoSuchBucket === true`, `status=404`.
+* `DeleteBucketCommand.d.ts` declares the same lone `S3ServiceException`, and
+* the deserializer resolves errors through a per-NAMESPACE schema registry
+* (`client-s3/dist-cjs/schemas/schemas_0.js`), not a per-operation one — so
+* the command's declared throw list never decided this. The PREDICATE was
+* right for the wrong reason; the reason is corrected rather than quietly
+* dropped, because the wrong one would have justified the wrong fixture in the
+* next provider that copied it.
+*
+* There is deliberately no `instanceof NoSuchBucket` arm. The generated class
+* assigns `name = 'NoSuchBucket'` on the instance
+* (`@aws-sdk/client-s3/dist-es/models/errors.js`), so every instance already
+* satisfies the check below: it would be an arm no case could ever make
+* decide, and a branch nothing can make decide is a branch nothing protects.
+*
+* A BARE HTTP 404 is deliberately NOT accepted, and this is the one place the
+* predicate is narrower than "the resource is missing". On the create path
+* `absent` is the answer that ENABLES the partial-create cleanup's
+* `DeleteBucket`, so anything that can 404 without S3 having said
+* `NoSuchBucket` — a corporate proxy, an `AWS_ENDPOINT_URL` override, an
+* S3-compatible gateway — would otherwise license a delete on the strength of
+* a response S3 never sent. Narrowing costs only that such a 404 becomes
+* `indeterminate`, and every caller's `indeterminate` branch is the
+* non-destructive one.
+*
+* Everything else — 403 from a bucket owned by another account, a throttle, a
+* network fault — is likewise NOT absence. Folding those into "absent"
+* is what would let a probe failure re-authorize the destructive branch each
+* caller below is guarding.
+*/
+function isNoSuchBucketError(error) {
+	return error?.name === "NoSuchBucket";
+}
+/**
+* The bucket's region as reported on an error's own `x-amz-bucket-region`
+* header, canonicalized — the free answer, requiring no second round trip.
+*
+* Shared by {@link S3BucketProvider.resolveOwnedBucketRegion} (reading the
+* `BucketAlreadyOwnedByYou` 409) and {@link S3BucketProvider.probeBucketRegion}
+* (reading a FAILED probe), so the header-then-canonicalize pair has one
+* spelling rather than two that can drift apart.
+*/
+function regionFromErrorHeader(error) {
+	const fromHeader = readBucketRegionHeader(error);
+	return fromHeader ? canonicalizeRegion(fromHeader) : void 0;
+}
+/**
+* Whether this error's `x-amz-bucket-region` describes the BUCKET rather than
+* the endpoint that answered.
+*
+* The distinction is the whole value of the header, and reading it off any
+* failure throws it away. Only two failure shapes are S3 telling you where the
+* BUCKET is: the 301 cross-region redirect (`PermanentRedirect`) and
+* `AuthorizationHeaderMalformed`, which is the SigV4 region mismatch reporting
+* the region you should have signed for. Every other failure -- a 403 for a
+* bucket the caller cannot see, a throttle, a 404 -- is answered by the
+* endpoint that was ASKED, so its header names the region the QUESTION went to.
+* That is the same property that already orders the absence check first in
+* {@link S3BucketProvider.probeBucketRegion}; this gate applies it to the rest
+* of the failure space instead of to `NoSuchBucket` alone.
+*
+* Accepting an endpoint-region header as the bucket's answer inverted both
+* guards built on top of it: on delete a 403 whose header echoed the deploy's
+* own region compared EQUAL and returned silently, which is exactly the hostile
+* bucket-policy `Deny` population {@link
+* S3BucketProvider.announceUnverifiedBucketIdentity} exists for; on create it
+* promoted an unanswerable probe to "the bucket is already there", producing a
+* false ADOPTED-and-ACLs-reset warning over a genuinely new bucket and
+* suppressing the orphan cleanup with no warning at all.
+*
+* Matched on the wire error CODE alone, never on an HTTP STATUS. An earlier
+* revision also accepted a bare `httpStatusCode === 301`, which is the same
+* defect {@link isNoSuchBucketError} was narrowed to close: a status S3 never
+* NAMED is not S3 speaking. A proxy, an `AWS_ENDPOINT_URL` override or an
+* S3-compatible gateway answering 301 with an `x-amz-bucket-region` of the
+* deploy's own region would have made `probe.region` compare EQUAL, and the
+* delete guard would have returned silently -- the same silent pass the 403
+* arm above was removed for, arriving through the status instead of the header.
+* Unreachable against real S3, since the redirect always carries the code, so
+* dropping the arm costs nothing and the shape stops being expressible.
+*
+* The `BucketAlreadyOwnedByYou` 409 is a THIRD region-bearing shape (measured
+* for issue #2227) and is deliberately absent here: `GetBucketLocation` cannot
+* return it, and the create path reads it through
+* {@link S3BucketProvider.resolveOwnedBucketRegion}'s explicit error argument,
+* which never routes through this gate.
+*/
+function carriesBucketRegionHeader(error) {
+	const candidate = error;
+	if (candidate?.name === "PermanentRedirect") return true;
+	return candidate?.name === "AuthorizationHeaderMalformed";
+}
+/** The probe was issued and could not answer. */
+function probeFailedCause(errorName) {
+	return {
+		why: `the GetBucketLocation identity check failed (${errorName})`,
+		remedy: "Re-run with --verbose for AWS's own message. Re-run the destroy once the check can succeed, or grant s3:GetBucketLocation on the bucket (a bucket policy can Deny it), to have the guard verify the target first."
+	};
+}
+/**
+* No probe was issued, because the state record names no region to check
+* against.
+*
+* `DeleteContext.expectedRegion` is absent exactly for a record written before
+* the region-keyed state layout, and `destroy-runner` omits the field rather
+* than inventing one. That cohort is the one MOST likely to predate the issue
+* #2227 create-path guard, so it is the likeliest carrier of a foreign-region
+* physical id -- and until this cause existed it was the one population that
+* got no probe, no warning and no debug line, i.e. the highest-risk shape with
+* the quietest output.
+*
+* Warn only. Refusing here would strand every legacy destroy with no IAM
+* remedy at all -- strictly worse than the stranding the guard already declines
+* to impose -- and defaulting `expectedRegion` to the client region in
+* `destroy-runner` would fabricate an expectation the record never made AND
+* change `assertRegionMatch` on the `NoSuchBucket` path, a far wider blast
+* radius than this.
+*/
+function noRecordedRegionCause() {
+	return {
+		why: `this state record carries no region, so there was nothing to check the bucket's location against`,
+		remedy: "This record predates cdkd's region-keyed state layout. Re-deploy the stack to write a record that carries its region, or confirm the bucket's location yourself, to have the guard run on the next destroy."
+	};
+}
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
@@ -8731,7 +8866,23 @@ var S3BucketProvider = class S3BucketProvider {
 		const wantRegion = canonicalizeRegion(expectedRegion);
 		const actualRegion = await this.resolveOwnedBucketRegion(bucketName, createError);
 		if (actualRegion === wantRegion) return;
-		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${bucketName} for ${logicalId} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so 'BucketAlreadyOwnedByYou' does not mean the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, createError));
+		this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, wantRegion, actualRegion, createError);
+	}
+	/**
+	* The refusal {@link assertExistingBucketRegion} raises, as its own method so
+	* the `us-east-1` pre-flight can raise the IDENTICAL one.
+	*
+	* Two callers reach the same conclusion by different evidence -- a 409's
+	* `x-amz-bucket-region` on one side, a pre-flight `GetBucketLocation` on the
+	* other -- and the user-facing consequence is the same in both, so the
+	* wording, the `markNonRetryable` marker and the deliberate avoidance of the
+	* literal `does not exist` are stated once rather than paraphrased.
+	*
+	* `never`-returning so a caller can `this.refuseForeignRegionAdopt(...)` as a
+	* statement without the compiler losing that control flow ends there.
+	*/
+	refuseForeignRegionAdopt(logicalId, resourceType, bucketName, wantRegion, actualRegion, cause) {
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${bucketName} for ${logicalId} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so owning the name (which is what 'BucketAlreadyOwnedByYou' and a successful location lookup each report) never means the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, cause));
 	}
 	/**
 	* The region an already-owned bucket actually lives in, canonicalized.
@@ -8740,13 +8891,197 @@ var S3BucketProvider = class S3BucketProvider {
 	* failure PROPAGATES rather than degrading to a guess: the caller is a
 	* fail-closed guard, and a guessed region is exactly what would make it
 	* adopt the wrong bucket.
-	*/
-	async resolveOwnedBucketRegion(bucketName, createError) {
-		const fromHeader = readBucketRegionHeader(createError);
-		if (fromHeader) return canonicalizeRegion(fromHeader);
+	*
+	* The header read here is deliberately NOT behind
+	* {@link carriesBucketRegionHeader}, and that is licensed by the CALL SITE
+	* rather than by the header being safer: the only error ever passed in is the
+	* `BucketAlreadyOwnedByYou` 409 from `CreateBucket`, which is itself a
+	* region-bearing shape (measured for issue #2227 -- a us-west-2 bucket
+	* answered it with `x-amz-bucket-region: us-west-2` to clients in three
+	* regions). The gate exists for {@link probeBucketRegion}, which catches the
+	* WHOLE failure space of `GetBucketLocation` and so must sort the two kinds
+	* apart. If this method ever takes an error from a second call site, it needs
+	* the gate too.
+	*
+	* `awsError` is optional because the two PRE-FLIGHT callers (issues #2241 /
+	* #2245) have no AWS error in hand — they ask the question BEFORE issuing
+	* the call that would produce one, so only the `GetBucketLocation` half
+	* applies. This is deliberately the same function rather than a second one
+	* that "also reads GetBucketLocation": the `EU` and empty-`LocationConstraint`
+	* folds and the `x-amz-bucket-region` header precedence are one predicate,
+	* and a paraphrase of them is a divergence waiting to happen.
+	*/
+	async resolveOwnedBucketRegion(bucketName, awsError) {
+		const fromHeader = awsError ? regionFromErrorHeader(awsError) : void 0;
+		if (fromHeader) return fromHeader;
 		return bucketLocationToRegion((await this.s3Client.send(new GetBucketLocationCommand({ Bucket: bucketName }))).LocationConstraint);
 	}
 	/**
+	* Ask S3 where a bucket NAME lives, before doing anything to it.
+	*
+	* The non-throwing pre-flight form of {@link resolveOwnedBucketRegion},
+	* used by the three sites that must confirm a bucket is the one they mean
+	* before acting on it: the `us-east-1` create (issue
+	* [#2241](https://github.com/go-to-k/cdkd/issues/2241)) and the update /
+	* delete paths (issue [#2245](https://github.com/go-to-k/cdkd/issues/2245)).
+	*
+	* Why `GetBucketLocation` and not `HeadBucket`: recorded at length on
+	* {@link S3BucketProvider.assertExistingBucketRegion} and in
+	* `src/utils/aws-region-resolver.ts`. A cross-region `HeadBucket` 301s and
+	* SDK v3's region-redirect middleware mishandles the empty-body HEAD into a
+	* synthetic `name: 'Unknown'`, so it cannot answer this question at all;
+	* `GetBucketLocation` is a GET with an XML body and is answered by ANY
+	* regional endpoint in the same partition for a bucket in any region of
+	* that partition (measured 2026-08-13, see that module).
+	*
+	* Deliberately NOT `resolveBucketRegion` from that module: it never throws
+	* and returns the caller's own `fallbackRegion` on a failed probe, which
+	* would report "same region" for every failure and silently authorize each
+	* branch below. Distinguishing `absent` from `indeterminate` is precisely
+	* what this wrapper adds over it.
+	*/
+	async probeBucketRegion(bucketName) {
+		try {
+			return {
+				kind: "region",
+				region: await this.resolveOwnedBucketRegion(bucketName)
+			};
+		} catch (probeError) {
+			if (isNoSuchBucketError(probeError)) return { kind: "absent" };
+			if (carriesBucketRegionHeader(probeError)) {
+				const fromHeader = regionFromErrorHeader(probeError);
+				if (fromHeader) return {
+					kind: "region",
+					region: fromHeader
+				};
+			}
+			return {
+				kind: "indeterminate",
+				reason: probeError instanceof Error ? probeError.message : String(probeError),
+				errorName: probeError instanceof Error ? probeError.name : typeof probeError
+			};
+		}
+	}
+	/**
+	* Refuse to act on a bucket a STATE RECORD names that does not live in
+	* `expectedRegion` (issue [#2245](https://github.com/go-to-k/cdkd/issues/2245)).
+	*
+	* {@link assertExistingBucketRegion} is on the CREATE path only, so it stops
+	* NEW poisoning and does nothing about a record already written by a build
+	* that predates it. Two paths then act on such a record, and neither noticed:
+	* `update()` had no region check at all, and `delete()`'s
+	* {@link assertRegionMatch} fires only from the `NoSuchBucket` branch — which
+	* a cross-region `DeleteBucket` never reaches, because SDK v3's
+	* region-redirect middleware FOLLOWS the 301 for body-bearing operations and
+	* the delete simply succeeds against the other region's bucket.
+	*
+	* ## Why this probes instead of reading state
+	*
+	* The cheap check would be state-vs-client region, and it cannot answer this
+	* question: in the poisoned record the region field is the STACK's region and
+	* MATCHES, while the physical id denotes a bucket somewhere else. The bucket's
+	* own location is knowable only from S3, so one `GetBucketLocation` per
+	* bucket update / delete is the floor. It is a rounding error next to what
+	* those paths already spend — an S3 update issues a dozen or more Put/Get
+	* round trips, and a delete may enumerate and remove every object version.
+	*
+	* ## Refuse rather than heal
+	*
+	* On update, healing would mean rewriting the recorded physical id, i.e. a
+	* state mutation whose blast radius (every `Fn::GetAtt` consumer, the next
+	* diff, the next destroy) is larger than the misconfiguration it repairs.
+	* On delete, refusing strands the destroy and needs a human — a foot-gun, and
+	* a smaller one than deleting a live bucket in another region, which nothing
+	* can undo. Both refusals are `markNonRetryable` for the same reason the
+	* create-side one is: they are deterministic, so letting `withRetry` re-run
+	* the operation for its full budget only delays the same message.
+	*
+	* ## What an unanswered probe does, and the IAM dependency that creates
+	*
+	* `absent` and `indeterminate` both PROCEED, a deliberate asymmetry with the
+	* create-side guard. `absent` is the ordinary already-gone destroy, which the
+	* existing `NoSuchBucket` path handles idempotently one call later.
+	* `indeterminate` is the load-bearing one, and the honest description of it
+	* is NOT that the affected population is unrelated to the defect — an
+	* earlier revision of this comment said exactly that and it is false. It is
+	* the SAME population, merely unprobeable: a principal without
+	* `s3:GetBucketLocation` can hold a poisoned record just as easily as any
+	* other, and for that principal this guard is INERT on every call,
+	* permanently. So this change introduces a new IAM dependency — the guard is
+	* only as good as `s3:GetBucketLocation` on the target bucket, which a bucket
+	* POLICY can also `Deny`.
+	*
+	* Proceeding anyway is still the right trade, for a reason about escape
+	* hatches rather than about who is affected. Failing closed would strand
+	* every update and destroy for a least-privilege role with no way out except
+	* widening IAM — cdkd offers no per-resource override to force one through —
+	* while the reachable hazard needs a bucket that EXISTS and is owned by this
+	* account, for which `GetBucketLocation` answers from any endpoint in the
+	* partition (see {@link probeBucketRegion}). Three fixes that look better and
+	* are worse, recorded so they are not retried: refusing on `indeterminate` is
+	* the stranding above; refusing only on 403 cannot work, because a missing
+	* IAM grant and a hostile `Deny` are the same wire response; and folding 403
+	* into `absent` is the precise collapse {@link BucketRegionProbe}'s third
+	* state exists to prevent.
+	*
+	* What proceeding obliges instead is that it is never SILENT on the
+	* irreversible path — see {@link announceUnverifiedBucketIdentity}.
+	*/
+	async assertStateBucketRegion(operation, logicalId, resourceType, physicalId, expectedRegion) {
+		const wantRegion = canonicalizeRegion(expectedRegion);
+		const probe = await this.probeBucketRegion(physicalId);
+		if (probe.kind === "absent") return;
+		if (probe.kind === "indeterminate") {
+			this.logger.debug(`GetBucketLocation failed for S3 bucket ${physicalId} (${logicalId}) before ${operation}: ${probe.reason}`);
+			this.announceUnverifiedBucketIdentity(operation, logicalId, physicalId, probeFailedCause(probe.errorName));
+			return;
+		}
+		if (probe.region === wantRegion) return;
+		const consequence = operation === "update" ? `Applying this stack's bucket configuration would reconfigure a bucket in ${probe.region} that this stack does not own the definition of.` : `Deleting it would destroy a bucket in ${probe.region} that this stack's region does not contain, and that deletion cannot be undone.`;
+		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop cdkd's record with 'cdkd state orphan <stack>', which removes the record without touching any AWS resource, and deploy again.` : `Confirm which bucket you mean. If ${physicalId} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack>', which removes cdkd's record without touching any AWS resource, and the destroy will then have nothing to do for this resource.`;
+		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${physicalId} for ${logicalId} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
+	}
+	/**
+	* Say out loud that the identity guard did not run.
+	*
+	* `delete` gets a WARN and `update` a debug, and the asymmetry is the whole
+	* point rather than a stylistic choice. Both proceed, but only one of them
+	* proceeds into something irreversible, and cdkd's default log level is
+	* `info` -- so a debug line here meant that on the one path where the guard
+	* failing open destroys data, the operator's output was byte-identical to a
+	* normal destroy.
+	*
+	* That is not merely a misconfiguration story. `GetBucketLocation` is
+	* DENIABLE on the target bucket by anyone holding `s3:PutBucketPolicy` on it,
+	* and a `Deny` there is indistinguishable on the wire from a missing IAM
+	* grant. A 403 leaves the probe `indeterminate` -- deliberately, since a 403
+	* is answered by the endpoint that was asked and
+	* {@link carriesBucketRegionHeader} therefore refuses to read its header as
+	* the bucket's region -- so a poisoned record naming a bucket in another
+	* region PROCEEDS: the auto-empty and `DeleteBucket` follow the SDK's 301 and
+	* the bucket is gone. A throttled probe during a wide destroy reaches the
+	* same place by accident, and a state record with no region at all never gets
+	* a probe to begin with. None of the three can be refused -- see the caller's
+	* note on why failing closed is the wrong trade -- so the remaining
+	* obligation is that it never happens QUIETLY.
+	*
+	* Deliberately NOT retried on `isThrottlingError`. It would not touch the
+	* hostile-`Deny` path at all (a 403 carries neither a throttling name nor a
+	* retryable status), the provider has no injected sleep seam here so a
+	* bounded retry either adds real wall-clock to every throttled destroy or
+	* needs a new timer seam plus fixtures to control it, and with this warning
+	* in place a throttled probe is now visible and re-runnable -- which was the
+	* actual defect.
+	*/
+	announceUnverifiedBucketIdentity(operation, logicalId, physicalId, cause) {
+		const message = `Could not confirm which bucket ${physicalId} for ${logicalId} is before ${operation}: ${cause.why}, so the cross-region guard did NOT run and cdkd is proceeding on the recorded physical id alone.`;
+		if (operation === "delete") {
+			this.logger.warn(`${message} If this state record names a bucket in another region, this destroy will delete THAT bucket. ${cause.remedy}`);
+			return;
+		}
+		this.logger.debug(`${message} Proceeding.`);
+	}
+	/**
 	* Create an S3 bucket
 	*/
 	async create(logicalId, resourceType, properties, context) {
@@ -8761,12 +9096,16 @@ var S3BucketProvider = class S3BucketProvider {
 			const region = await this.getRegion();
 			if (region !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: region };
 			if (properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true") createParams.ObjectLockEnabledForBucket = true;
+			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
 			try {
 				await this.s3Client.send(new CreateBucketCommand(createParams));
-				createdNewBucket = true;
+				createdNewBucket = preflight.kind === "absent";
+				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
+				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${bucketName} for ${logicalId} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${bucketName} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
 				this.logger.debug(`Created S3 bucket: ${bucketName}`);
 			} catch (createError) {
+				if (createError instanceof ProvisioningError) throw createError;
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) {
 					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
 					this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
@@ -8781,7 +9120,12 @@ var S3BucketProvider = class S3BucketProvider {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+					this.logger.warn(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. Manual deletion may be required before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+				}
+				else if (preflight.kind === "indeterminate") {
+					this.logger.debug(`GetBucketLocation failed for S3 bucket ${bucketName} (${logicalId}) during create: ${preflight.reason}`);
+					this.logger.warn(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, delete it manually before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
 				}
 				throw innerError;
 			}
@@ -8811,6 +9155,7 @@ var S3BucketProvider = class S3BucketProvider {
 				wasReplaced: true
 			};
 		}
+		await this.assertStateBucketRegion("update", logicalId, resourceType, physicalId, await this.getRegion());
 		try {
 			const effectiveOverrides = await this.applyConfiguration(physicalId, properties, {
 				skipTags: true,
@@ -8840,6 +9185,8 @@ var S3BucketProvider = class S3BucketProvider {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting S3 bucket ${logicalId}: ${physicalId}`);
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
+		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion);
+		else this.announceUnverifiedBucketIdentity("delete", logicalId, physicalId, noRecordedRegionCause());
 		try {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
@@ -16259,22 +16606,30 @@ function isTerminalDeleteFailure(error) {
 *    table with its guard down, which is the exact residue this mechanism
 *    exists to remove, so the message carries the physical id and the one
 *    command that fixes it.
+*
+* It REPORTS what it did rather than only doing it (see
+* {@link ProtectionCompensationOutcome}), because the caller's decision to drop
+* the flip record is not the same decision as whether to compensate: dropping
+* it after a re-enable that FAILED discards the only record that cdkd still
+* owes this table its guard back.
 */
 async function compensateRemovedDeletionProtection(opts) {
-	if (!opts.flip.flippedOffByThisRun) return;
-	if (opts.flip.deleteAccepted) return;
-	if (!isTerminalDeleteFailure(opts.error)) return;
+	if (!opts.flip.flippedOffByThisRun) return "not-applicable";
+	if (opts.flip.deleteAccepted) return "not-applicable";
+	if (!isTerminalDeleteFailure(opts.error)) return "not-applicable";
 	try {
 		await opts.reEnable();
 		opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: the delete failed after --remove-protection had turned DeletionProtectionEnabled off, so it was re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
+		return "restored";
 	} catch (reEnableError) {
 		const detail = reEnableError instanceof Error ? reEnableError.message : String(reEnableError);
 		if (isResourceNotFoundError(reEnableError)) {
 			const regionArg = opts.region ? ` --region ${opts.region}` : "";
 			opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could not re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — DynamoDB answered ResourceNotFound. That most commonly means the table is gone or its status is not ACTIVE, and it can also mean the table is not in this region or account. If it still exists, its deletion protection is OFF. Check with: aws dynamodb describe-table --table-name ${opts.physicalId}${regionArg} and if it is there, restore it with: aws dynamodb update-table --table-name ${opts.physicalId}${regionArg} --deletion-protection-enabled. (${detail})`);
-			return;
+			return "failed";
 		}
 		opts.logger.error(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could NOT re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — that table is LIVE with its deletion protection still off. Restore it with: aws dynamodb update-table --table-name ${opts.physicalId} --deletion-protection-enabled. (${detail})`);
+		return "failed";
 	}
 }
 /**
@@ -17245,21 +17600,25 @@ var DynamoDBTableProvider = class {
 		try {
 			await this.deleteTableResource(logicalId, physicalId, resourceType, context, flip);
 		} catch (error) {
-			await compensateRemovedDeletionProtection({
-				flip,
-				error,
-				logicalId,
-				physicalId,
-				typeLabel: "table",
-				logger: this.logger,
-				...context?.expectedRegion ? { region: context.expectedRegion } : {},
-				reEnable: async () => {
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						DeletionProtectionEnabled: true
-					}));
-				}
-			});
+			let outcome = "failed";
+			try {
+				outcome = await compensateRemovedDeletionProtection({
+					flip,
+					error,
+					logicalId,
+					physicalId,
+					typeLabel: "table",
+					logger: this.logger,
+					...context?.expectedRegion ? { region: context.expectedRegion } : {},
+					reEnable: async () => {
+						await this.dynamoDBClient.send(new UpdateTableCommand({
+							TableName: physicalId,
+							DeletionProtectionEnabled: true
+						}));
+					}
+				});
+			} catch {}
+			if (isTerminalDeleteFailure(error) && outcome !== "failed") this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			throw error;
 		}
 	}
@@ -19812,21 +20171,25 @@ var DynamoDBGlobalTableProvider = class {
 		try {
 			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip);
 		} catch (error) {
-			await compensateRemovedDeletionProtection({
-				flip,
-				error,
-				logicalId,
-				physicalId,
-				typeLabel: "GlobalTable",
-				logger: this.logger,
-				...context?.expectedRegion ? { region: context.expectedRegion } : {},
-				reEnable: async () => {
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						DeletionProtectionEnabled: true
-					}));
-				}
-			});
+			let outcome = "failed";
+			try {
+				outcome = await compensateRemovedDeletionProtection({
+					flip,
+					error,
+					logicalId,
+					physicalId,
+					typeLabel: "GlobalTable",
+					logger: this.logger,
+					...context?.expectedRegion ? { region: context.expectedRegion } : {},
+					reEnable: async () => {
+						await this.dynamoDBClient.send(new UpdateTableCommand({
+							TableName: physicalId,
+							DeletionProtectionEnabled: true
+						}));
+					}
+				});
+			} catch {}
+			if (isTerminalDeleteFailure(error) && outcome !== "failed") this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			throw error;
 		}
 	}
@@ -88060,4 +88423,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CP4DgOV1.js.map
+//# sourceMappingURL=program-B2i8bJUJ.js.map