@go-to-k/cdkd 0.319.0 → 0.320.0

package/dist/{program-DyYTFxF-.js → program-Dm0hn2Sn.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-DWpHZk2l.js";
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, G as cutMarker, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, Q as plainIdentOr, S as explicitNamePropertyFor, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, c as isStdoutReservedForPayload, d as runStackBuffered, et as stringifyJsonPayload, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, j as isNameGeneration, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, q as displayIdent, s as getLogger, tt as terminalSafe, w as generateResourceName, x as derivesPatternBName } from "./aws-failure-text-DiHodi76.js";
-import { $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, Bn as formatError, Dn as LocalStartServiceError, Dr as retryClassificationText, En as LocalInvokeBuildError$1, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Gn as TIMEOUT_FLAG_RESOURCE_TYPE, I as VALUE_NOT_SHOWN, In as StackHasActiveImportsError, Ln as StackTerminationProtectionError, M as RESOURCE_NOT_FOUND, Mn as PartialFailureError, N as isMarkedNotGone, Nn as ProvisioningError, Ot as resourceTypeShown, Pn as ResourceTimeoutError, Qn as pasteableCommand, Qt as forceQuitRecoveryClause, Rn as StateError, Sn as DeployCancelledError, Sr as isAmbiguousOutcomeError, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, U as remedyLogicalId, Un as normalizeAwsError, Wn as withErrorHandling, Xt as buildForceUnlockCommand, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, Zt as buildLockContentionMessage, _r as stripControlChars, _t as beginCommandInterruptScope, an as DEFAULT_STATE_PREFIX, ar as setPasteableRunFlags, bn as CrossAccountSecretRefusalError, bt as isInterruptedWaitError, c as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, cn as producerCoordinateKey, dn as withPasteableAwsProfile, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, gn as AccountIdUnavailableError, gr as escapeRegExp, hn as credentialFingerprint, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, jn as NestedStackChildDirectDestroyError, jr as markNonRetryable, kr as isMarkedNonRetryable, ln as producerRecordKey, mn as clientDefaultsFor, nr as shellBoundedDisplay, on as injectiveKey, or as setPasteableVerbFlags, p as readRecordedPrincipals, pn as ambientCredentialConfig, qn as SHELL_ACTIVE_WHY, rr as shellQuote, s as IAM_PRINCIPAL_NAME, tn as formatLockOwner, tr as quotedOrDescribed, un as setPasteableAwsProfile, ut as isAwsCliLiteral, vn as CdkdError, vr as stripForDisplay, vt as endCommandInterruptScope, wn as DynamicReferenceRegionAmbiguousError, yt as interruptWatchListenerCount, zn as SynthesisError } from "./created-resource-sink-BpB3iPvn.js";
+import { $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, Bn as formatError, Dn as LocalStartServiceError, Dr as retryClassificationText, En as LocalInvokeBuildError$1, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Gn as TIMEOUT_FLAG_RESOURCE_TYPE, I as VALUE_NOT_SHOWN, In as StackHasActiveImportsError, Ln as StackTerminationProtectionError, M as RESOURCE_NOT_FOUND, Mn as PartialFailureError, N as isMarkedNotGone, Nn as ProvisioningError, Ot as resourceTypeShown, Pn as ResourceTimeoutError, Qn as pasteableCommand, Qt as forceQuitRecoveryClause, Rn as StateError, Sn as DeployCancelledError, Sr as isAmbiguousOutcomeError, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, U as remedyLogicalId, Un as normalizeAwsError, Wn as withErrorHandling, Xt as buildForceUnlockCommand, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, Zt as buildLockContentionMessage, _r as stripControlChars, _t as beginCommandInterruptScope, an as DEFAULT_STATE_PREFIX, ar as setPasteableRunFlags, bn as CrossAccountSecretRefusalError, bt as isInterruptedWaitError, c as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, cn as producerCoordinateKey, dn as withPasteableAwsProfile, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, gn as AccountIdUnavailableError, gr as escapeRegExp, hn as credentialFingerprint, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, jn as NestedStackChildDirectDestroyError, jr as markNonRetryable, kr as isMarkedNonRetryable, ln as producerRecordKey, mn as clientDefaultsFor, nr as shellBoundedDisplay, on as injectiveKey, or as setPasteableVerbFlags, p as readRecordedPrincipals, pn as ambientCredentialConfig, qn as SHELL_ACTIVE_WHY, rr as shellQuote, s as IAM_PRINCIPAL_NAME, tn as formatLockOwner, tr as quotedOrDescribed, un as setPasteableAwsProfile, ut as isAwsCliLiteral, vn as CdkdError, vr as stripForDisplay, vt as endCommandInterruptScope, wn as DynamicReferenceRegionAmbiguousError, yt as interruptWatchListenerCount, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BLXFsfMa.js";
-import { $a as assertFlagRoleArn, $c as literalSplitDelimitersOf, $i as ccBrokenReason, $l as hasReasonlessBaselineRefusal, $n as retiredAfterRollback, $o as malformedOrphansRefusalMessage, $r as isSupersededResourceRecord, $s as MULTI_REGION_RECREATE_BLOCKED_TYPES, $t as isHandledOrphan, $u as getLegacyStateBucketName, Aa as INTRINSIC_KEYS, Ac as TemplateParser, Ad as hasPlainPrototype, Ai as refusesFinalSnapshot, Al as recordNoEchoAttributeValues, An as demoteSupersededOrphans, Ao as declaresNoEcho, Ar as movedToHint, As as refuseMalformedResourcesForDeploy, At as makeCanonicalizePropertiesFn, Au as buildDockerImage, Bl as CrossPrefixReadError, Bn as orphanNeedsIdentity, Bo as hasReadableOutputs, Br as destroyStackRecordsView, Bs as unpreviewableOrphanRecords, Bt as dropSettledNestedJournals, Bu as isMalformedEnvKey, Cd as StageLoadError, Ci as ATOMIC_FINAL_SNAPSHOT_TYPES, Cn as recordAfterRollbackUpdate, Co as isStalePlaceholderArnAttribute, Cr as DEFAULT_RESOURCE_WARN_AFTER_MS, Cs as refuseMalformedResourceEntriesForImport, Cu as getBootstrapMarkerKey, Dd as utf8ByteLength, Di as createPreDeleteFinalSnapshot, Dl as provenPublicValue, Dn as equalModuloMarkedMask, Do as withSharedDrainBudget, Dr as formatDestructiveChange, Ds as refuseMalformedResourcePropertiesForDrift, Dt as isSecretBearingReferenceString, Du as validateAssetBucketName, Ed as parseFailureDebugDetail, Ei as ccRoutedFinalSnapshotError, El as carriesSecretMask, En as calculateResourceDrift, Er as findDestructiveChanges, Es as refuseMalformedResourcePropertiesForDestroy, Et as diffSecurity, Eu as readBootstrapMarkerBody, Fa as withUnsettledProperties, Fc as maskWholeValue, Fd as displayAssemblyPath, Fi as withCreateTokenLedger, Fl as isSingleDynamicReferenceToken, Fn as recheckFailedPlan, Fo as UNREADABLE_RESOURCES_MAP_ROW, Fr as mappingPairs, Fs as repairMalformedOrphansForReadOnly, Ft as keptForRetainedRecord, Fu as dockerSpawnEnvWithSensitive, Ga as resolveDynamicReferences, Gc as liveMatchesUnresolvedTokenFrame, Gl as isNotImplemented, Go as malformedExportNamesWarning, Gr as cyan, Gs as findHandledUnwrittenCreateOnly, Gt as revertedNestedRowIds, Gu as runDockerForeground, Hc as readsNoEchoSource, Hl as applyCrossPrefixScan, Ho as isReadableOrphanRecord, Hr as withStackRecords, Hs as unreadableResourceEntries, Ht as nestedChildStackName$1, Hu as redactDockerArgvValues, Ia as withoutUnsettledProperties, Ic as maskedLeafCoordinatesOf, Id as renderAssemblyPathEscape, Il as LockManager, In as recordUnderIdIsNotOwn, Io as accountArgs, Ir as parseMappingFile, Is as repairMalformedOutputsForReadOnly, It as recordRetainedForReadoption, Iu as finchSecretArgvRefusal, Ja as keepHeldTokenProvenance, Jl as splitImportedOps, Jn as updatePartialMessage, Jo as malformedLocalResourceEntriesWarning, Jr as red, Jt as getCurrentNestedStackContext, Ju as AssetManifestLoader, Ka as producerLookupOver, Kl as stackInstanceIdOf, Ko as malformedExportSourceWarning, Kr as gray, Kt as withNestedRevertRun, Ku as runDockerStreaming, La as IntrinsicFunctionResolver, Lc as noEchoCoordinatesOf, Ld as resolveAssemblyPath, Li as DeploymentEventsReader, Ll as isLockInfoExpired, Ln as replacementNeverSwapped, Lo as deployRefusesOrphanRowsReason, Lr as proposeRenames, Ls as repairMalformedResourceEntriesForReadOnly, Lt as NESTED_PENDING_PARENT_REASON, Lu as formatDockerLoginError, Ma as unsettledItemsField, Mc as isMarkedCoordinate, Md as ownValue, Ml as recordProvenPublicExpression, Mn as isReplacementOrphan, Mo as STATE_REGION_DIVERGED, Mr as withMovedTo, Ms as refuseMalformedResourcesForExport, Mt as planOrphanAdoption, Mu as describeDockerCapturedOutput, Na as unsettledItemsOf, Nc as maskAtCoordinates, Nd as absoluteAssemblyPathEscape, Ni as ledgerForStack, Nl as wholeStringLeavesOf, Nn as planFailedOps, No as STATE_RESOURCES_MALFORMED, Nr as isPairableType, Ns as refuseMalformedState, Nt as pendingRequestCount, Nu as describeDockerExecFailure, Od as defineOwnKey, Oi as effectiveDeletionPolicy, Ol as recordMaskOnlyValue, On as equalModuloMask, Oo as parameterInputsFor, Or as findRefactorHints, Os as refuseMalformedResourcePropertiesForExport, Ot as keptWholeReasonText, Ou as validateContainerRepoName, Pa as unsettledPropertiesOf, Pc as maskReadbackAtCoordinates, Pd as describeFileReadFailure, Pl as WHOLE_DYNAMIC_REFERENCE_PATTERN, Pn as planRollback, Po as UNREADABLE_ORPHANS_CONTAINER_ROW, Pr as looselyEqual, Ps as repairMalformedOrphanRecordsForReadOnly, Pt as resolvePendingCloudControlRequests, Pu as describeDockerFailure, Qa as applyRoleArnIfSet, Qc as hasMaskableValues, Qi as ProviderRegistry, Ql as hasReadableExportSet, Qn as nameScopeOf, Qo as malformedOrphanRowsKeptWarning, Qr as holdsSupersededResources, Qs as shownType, Qt as dropFailedHint, Qu as getDefaultStateBucketName, Ra as poisonRenderedSpellingsCollidingIn, Rc as noEchoLeavesOf, Rd as injectAwsRegion, Ri as DeploymentEventsStore, Rl as S3StateBackend, Rn as resolveReplacementOldType, Ro as displayLogicalId, Rs as repairMalformedResourcePropertiesForReadOnly, Rt as displacedOpClause, Ru as getDockerCmd, Sd as AssemblyReader, Si as storedSecretNameNeedles, Sl as physicalNameCopiesOf, Sn as removeProtectionTypeList, So as cfnRefValueFromPhysicalId, Sr as DEFAULT_RESOURCE_TIMEOUT_MS, Ss as refuseMalformedResourceEntriesForDestroy, St as readRecordedConditionVerdicts, Su as ensureAssetStorage, Td as describeJsonParseFailure, Ti as buildFinalSnapshotIdentifier, Tl as splitGetAttStringForm, Tn as withUnprovenUnsettled, To as refStateLookupFromResource, Tr as constructPathOf$1, Ts as refuseMalformedResourceEntriesForOrphan, Tt as withResourceDeadline, Tu as parseBootstrapMarker, Uc as recordedNoEchoValuesOf, Ul as crossPrefixDeniedWarning, Un as inheritProducerRegions, Uo as isReadableResourceEntry, Us as withheldAccountClause, Ut as recordDisplacedSkips, Uu as redactedCause, Vc as readbackPathFor, Vd as resolveBucketRegion, Vl as CrossPrefixScanCache, Vn as findNestedStackTypeChanges, Vo as hasReadableResources, Vs as unreadableOrphanRecords, Vu as partitionSensitiveEnv, Wc as valueAtCoordinate, Wl as isAccessDenied, Wo as malformedDriftResourcePropertiesWarning, Wr as bold, Ws as findActionableSilentDrops, Wu as redactedDockerCause, Xa as recordedOutputReferenceRegions, Xc as carryLogOnlyValues, Xl as describeRegionValueKind, Xn as nameGenerationCarriedFrom, Xo as malformedOrphanRecordsRefusalMessage, Xr as addSuperseded, Xs as hasNoCloudControlHandlers, Xt as deleteJournaledOrphans, Xu as Synthesizer, Yl as acceptedCreateOnlyDropsOf, Yn as updatePartialReason, Yo as malformedLocalResourcesWarning, Yr as yellow, Ys as NO_CC_HANDLERS_REASON, Yt as withNestedStackContext, Yu as getDockerImageBySourceHash, Za as recordedReferenceRegions, Zc as createUnionSecretMasker, Zi as CC_BROKEN_REASON, Zl as exportNamesCarriedFrom, Zn as nameGenerationHighWaterOf, Zo as malformedOrphanRecordsWarning, Zr as deleteSupersededEntry, Zs as findReplacedReadersOfRecreateTargets, Zt as dropFailedCommands, Zu as synthesisStatusMessage, _a as deleteIndeterminateGuards, _d as decodeListingKey, _i as secretNamePrintingBag, _l as spelledKeysOf, _n as pendingMovesOutOf, _o as carriesDynamicReference, _r as noEchoParameterValueSeed, _s as refuseMalformedOutputs, _t as renderNestedTemplateTreeDefect, _u as loadPublishableAssetManifest, a as isProtectionValueActive, aa as isCustomResourceType$1, ad as resolveStateBucketWithDefault, ai as withoutSuperseded, al as unionOfSecretBags, ao as applyCallerIdentityCredentials, ar as reachableDivergentParameters, as as malformedResourcePropertiesWarning, au as orphansCarriedFrom, bc as describeTypeWithThrottleRetry, bd as canonicalizeRegion, bi as secretNamedRecordNeedles, bl as recordNestedStackParameterExpressions, bn as replayFailedOperations, bo as keepsSecretReferenceToken, br as isExportAliasCollision, bs as refuseMalformedResourceEntries, bt as conditionInputsFrom, bu as BOOTSTRAP_MARKER_PREFIX, ca as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, cd as stateBucketExistenceConfirmed, ci as noEchoExactEchoLeavesOf, cl as maskSecretsInError, co as classifyRecordedSecretRegion, cr as displayTextOrWithheld, cs as malformedStateRefusalMessage, ct as crossStackOutputProvenanceSource, cu as PhaseClock, da as CloudControlProvider, dd as CFN_TEMPLATE_BODY_LIMIT, di as createReadOnlyAttributeHealerFactory, dl as withPhysicalNameCopies, dn as refactorMarkerMovesOf, do as regionLessSecretName, dr as secretBearingStateKeyWarning, dt as findServiceTokenRefusals, du as AssetPublisher, ea as isCustomResource, ec as isStatefulRecreateTargetForReplace, ed as loadCdkJson, ei as removeSuperseded, el as logOnlyValueCount, en as journaledOrphanLines, eo as assertSendableRoleArn, er as retiredNameGenerationsAfter, es as malformedOrphansWarning, eu as hasUnverifiableParameterRefusal, fa as slowCcOperationTimeoutMs, fd as CFN_TEMPLATE_URL_LIMIT, fi as completedReplayEntries, fn as refactorMarkerRefusalMessage, fo as coerceParameterTypedValue, fr as secretSafeKeyDisplay, fs as refuseMalformedOrphanRecords, ft as serviceTokenBlockingReason, fu as isSensitiveAttributeName, ga as UNSPECIFIED_SKIP_REASON, gd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gi as orphanRecordsPrintingBag, gl as pathCrossesDottedKey, gn as hasPendingMovesOut, go as isImpossibleEmptyStoredAttribute, gr as isWholeDynamicReferenceValue, gs as refuseMalformedOrphansForOrphan, gt as listNestedTemplateRows, gu as createAssetRedirectResolver, ha as RollbackInlinePolicyWriters, hd as uploadCfnTemplate, hi as namingSecretsWithRecordedNoEcho, hl as isUncertifiedBaselineMaskPosition, hn as updateRefactorMarker, ho as getAccountInfo, hr as exportNameSecretExposure, hs as refuseMalformedOrphansForDestroy, ht as isAbsoluteAssetPath, hu as buildAssetRedirectMap, i as PROTECTION_PROPERTY_BY_TYPE, ia as readsNoEchoDeleteValues, id as resolveSkipPrefix, ii as supersededResourcesOf, il as shareLogOnlyValues, in as formatResourceLine, io as AWS_CREDENTIAL_ENV_KEYS, ir as namesAnyDeclaredParameter, is as malformedResourceEntriesWarning, iu as orphansAfterRollback, jc as canonicalCoordinates, jd as nullPrototypeRecord, ji as unsupportedFinalSnapshotError, jl as recordNoEchoParameterFreshValue, jn as isJournaledOrphan, jo as JSON_LISTING_HOLE_VALUE, jr as rollbackOrphanIds, js as refuseMalformedResourcesForDestroy, jt as makeSiblingClaimReader, ju as resolveDockerContextDirectory, ka as DiffCalculator, kc as DagBuilder, kd as hasOwnKey, ki as isFinalSnapshotError, kl as recordMaskOnlyValuesIn, kn as undeclaredEmptyObservedKeys, kr as hintSidesOf, ks as refuseMalformedResourcePropertiesForOrphan, kt as mergeNoChangeOutputs, ku as buildDenyExternalAccessPolicy, la as applyCustomResourceResponseExpiration, ld as warnDeprecatedNoPrefixCliFlag, li as noEchoParameterNamesOf, ll as maskSecretsInText, ln as readRefactorMarker, lo as classifyReplaySecretRegion, lr as exportAliasCollisionScrubWarning, ls as previewableOrphanRecords, lt as inheritedProvenanceForChildDiff, lu as renderPhaseTimings, md as findLargeInlineResources, mi as maskEventTextWithBoundBags, ml as dynamicReferenceTokens, mn as sameMove, mo as parameterTypeMayLoseSecretIdentity, mr as exportNameNoEchoParameters, ms as refuseMalformedOrphans, mt as findNestedTemplateTreeDefect, mu as WorkGraph, n as recordedProtectionEvidence, nc as renderStatefulReason, nd as resolveAutoAssetStorage, ni as supersededHeldByOtherTypeWarning, nl as recordLogOnlyParameterValue, nn as makeForeignHolderScan, no as isIamRoleArn, nr as withNameGenerationReached, ns as malformedOutputsWarning, nu as importableOutputs, o as perType, od as resolveStateBucketWithDefaultAndSource, oi as noEchoAttributeNamesOf, ol as createSecretMasker, oo as callerEnvCredentials, or as resourcesNamingDeclaredParameter, os as malformedResourcesWarning, ot as IMPLICIT_DELETE_DEPENDENCIES, ou as shouldRetainResource, pd as MIGRATE_TMP_PREFIX, pi as journaledOrphanPrintingBag, pl as DYNAMIC_REFERENCE_TOKEN_SCAN, pn as refuseRefactorMarker, po as isUnboundTemplateParameter, pr as carriedExportAliasExposure, ps as refuseMalformedOrphanRecordsForDestroy, pt as childTemplateLoader, pu as stringifyValue, qa as refuseUnreadableCdkCrossAccountRefs, qc as redactForState, ql as withStackInstanceIdWithheld, qo as malformedLocalOutputsWarning, qr as green, qs as unwrittenCreateOnlyReplacement, qt as collectNestedChildUnaddressed, qu as warnFinchArgvExposure, r as recordedProtectionNote, ra as TemplateNoEchoReresolver, rd as resolveCaptureObservedState, ri as supersededHolderOf, rl as recordLogOnlyValue, rn as sameJournaledOrphans, ro as sendableAssumeRoleCommand, rr as computeParameterTaint, rs as malformedRenderedContainersWarning, ru as isReadableBag, s as readProtection, sa as withPrintingSecrets, sd as resolveUseCdkBootstrapAssets, si as noEchoComparisonForTemplate, sl as errorCauseChain, so as envCredentialsAreAssumedRole, sr as WITHHELD_NAME_DISPLAY, ss as malformedScrubResourceEntriesRefusalMessage, st as computeImplicitDeleteEdges, su as stackInstanceIdCarriedFrom, t as DeployEngine, ta as wouldReturnToSdkProvider, tc as isStatefulRecreateTargetSync, td as resolveApp, ti as supersededAfterRollback, tl as printingCorpusOf, tn as loadJournaledOrphans, to as explicitRoleArnOrThrow, tr as retiredNameGenerationsLeaving, ts as malformedOutputsRefusalMessage, tu as importableOutputKeys, ua as customResourceResponseExpirationWarning, ud as ssmResolvedValueType, ui as withAttemptedItemsMasked, ul as scrubResourceRecord, un as readRefactorMarkerOnce, uo as producerRegionsFromState, ur as secretBearing, us as refuseDivergentRecordRegionForDestroy, ut as deferredServiceTokenWarning, uu as timePhase, va as deleteLeftInPlace, vc as prefetchCreateOnlyPropertyPaths, vd as expectedOwnerParam, vi as secretNamePrintingBags, vl as identityKeyFor, vn as pendingMovesRefusalMessage, vo as carriesFetchableDynamicReference, vr as collectDeclaredOutputNames, vs as refuseMalformedOutputsForDestroy, vt as templateIdentity, vu as rewriteTemplateAssetReferences, wd as processStackMessages, wi as PRE_DELETE_SNAPSHOT_TYPES, wl as recordPhysicalNameCopy, wn as settleUnsettledPrevious, wo as lacksRecordedTableArn, wr as maskingRetryLogger, ws as refuseMalformedResourceEntriesForImportSave, wu as isCrossRegionRedirect, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xi as stateSecretNameNeedles, xn as replayRollback, xo as AWS_NO_VALUE, xr as bindingSkippedOutputs, xs as refuseMalformedResourceEntriesForDeploy, xt as parentSuppliedValues, xu as assertAssetBucketRegion, ya as deleteSkipReason, yc as templateResourceTypes, yd as PARTITION_TABLE, yl as inheritNestedStackParameterAssociations, yn as refusePendingMovesOut, yo as isNamelessDynamicReferenceError, yr as collectPublishedOutputNames, ys as refuseMalformedResourceAttributesForOrphan, yt as conditionFingerprint, yu as AssetModeResolver, zc as noEchoOutputsComparison, zd as injectedAwsRegionValue, zi as extractDeploymentEventError, zl as rebuildClientForBucketRegion, zn as seedsDeleteFirstGuard, zo as hasReadableOrphans, zs as repairMalformedResourcesForReadOnly, zt as displacedPhysicalIdShown, zu as isDockerClientEnvKey } from "./deploy-engine-CVYhHEgq.js";
-import { t as getCdkdVersion } from "./version-C3yhae4b.js";
+import { $a as assertFlagRoleArn, $c as literalSplitDelimitersOf, $i as ccBrokenReason, $l as hasReasonlessBaselineRefusal, $n as retiredAfterRollback, $o as malformedOrphansRefusalMessage, $r as isSupersededResourceRecord, $s as MULTI_REGION_RECREATE_BLOCKED_TYPES, $t as isHandledOrphan, $u as getLegacyStateBucketName, Aa as INTRINSIC_KEYS, Ac as TemplateParser, Ad as hasPlainPrototype, Ai as refusesFinalSnapshot, Al as recordNoEchoAttributeValues, An as demoteSupersededOrphans, Ao as declaresNoEcho, Ar as movedToHint, As as refuseMalformedResourcesForDeploy, At as makeCanonicalizePropertiesFn, Au as buildDockerImage, Bl as CrossPrefixReadError, Bn as orphanNeedsIdentity, Bo as hasReadableOutputs, Br as destroyStackRecordsView, Bs as unpreviewableOrphanRecords, Bt as dropSettledNestedJournals, Bu as isMalformedEnvKey, Cd as StageLoadError, Ci as ATOMIC_FINAL_SNAPSHOT_TYPES, Cn as recordAfterRollbackUpdate, Co as isStalePlaceholderArnAttribute, Cr as DEFAULT_RESOURCE_WARN_AFTER_MS, Cs as refuseMalformedResourceEntriesForImport, Cu as getBootstrapMarkerKey, Dd as utf8ByteLength, Di as createPreDeleteFinalSnapshot, Dl as provenPublicValue, Dn as equalModuloMarkedMask, Do as withSharedDrainBudget, Dr as formatDestructiveChange, Ds as refuseMalformedResourcePropertiesForDrift, Dt as isSecretBearingReferenceString, Du as validateAssetBucketName, Ed as parseFailureDebugDetail, Ei as ccRoutedFinalSnapshotError, El as carriesSecretMask, En as calculateResourceDrift, Er as findDestructiveChanges, Es as refuseMalformedResourcePropertiesForDestroy, Et as diffSecurity, Eu as readBootstrapMarkerBody, Fa as withUnsettledProperties, Fc as maskWholeValue, Fd as displayAssemblyPath, Fi as withCreateTokenLedger, Fl as isSingleDynamicReferenceToken, Fn as recheckFailedPlan, Fo as UNREADABLE_RESOURCES_MAP_ROW, Fr as mappingPairs, Fs as repairMalformedOrphansForReadOnly, Ft as keptForRetainedRecord, Fu as dockerSpawnEnvWithSensitive, Ga as resolveDynamicReferences, Gc as liveMatchesUnresolvedTokenFrame, Gl as isNotImplemented, Go as malformedExportNamesWarning, Gr as cyan, Gs as findHandledUnwrittenCreateOnly, Gt as revertedNestedRowIds, Gu as runDockerForeground, Hc as readsNoEchoSource, Hl as applyCrossPrefixScan, Ho as isReadableOrphanRecord, Hr as withStackRecords, Hs as unreadableResourceEntries, Ht as nestedChildStackName$1, Hu as redactDockerArgvValues, Ia as withoutUnsettledProperties, Ic as maskedLeafCoordinatesOf, Id as renderAssemblyPathEscape, Il as LockManager, In as recordUnderIdIsNotOwn, Io as accountArgs, Ir as parseMappingFile, Is as repairMalformedOutputsForReadOnly, It as recordRetainedForReadoption, Iu as finchSecretArgvRefusal, Ja as keepHeldTokenProvenance, Jl as splitImportedOps, Jn as updatePartialMessage, Jo as malformedLocalResourceEntriesWarning, Jr as red, Jt as getCurrentNestedStackContext, Ju as AssetManifestLoader, Ka as producerLookupOver, Kl as stackInstanceIdOf, Ko as malformedExportSourceWarning, Kr as gray, Kt as withNestedRevertRun, Ku as runDockerStreaming, La as IntrinsicFunctionResolver, Lc as noEchoCoordinatesOf, Ld as resolveAssemblyPath, Li as DeploymentEventsReader, Ll as isLockInfoExpired, Ln as replacementNeverSwapped, Lo as deployRefusesOrphanRowsReason, Lr as proposeRenames, Ls as repairMalformedResourceEntriesForReadOnly, Lt as NESTED_PENDING_PARENT_REASON, Lu as formatDockerLoginError, Ma as unsettledItemsField, Mc as isMarkedCoordinate, Md as ownValue, Ml as recordProvenPublicExpression, Mn as isReplacementOrphan, Mo as STATE_REGION_DIVERGED, Mr as withMovedTo, Ms as refuseMalformedResourcesForExport, Mt as planOrphanAdoption, Mu as describeDockerCapturedOutput, Na as unsettledItemsOf, Nc as maskAtCoordinates, Nd as absoluteAssemblyPathEscape, Ni as ledgerForStack, Nl as wholeStringLeavesOf, Nn as planFailedOps, No as STATE_RESOURCES_MALFORMED, Nr as isPairableType, Ns as refuseMalformedState, Nt as pendingRequestCount, Nu as describeDockerExecFailure, Od as defineOwnKey, Oi as effectiveDeletionPolicy, Ol as recordMaskOnlyValue, On as equalModuloMask, Oo as parameterInputsFor, Or as findRefactorHints, Os as refuseMalformedResourcePropertiesForExport, Ot as keptWholeReasonText, Ou as validateContainerRepoName, Pa as unsettledPropertiesOf, Pc as maskReadbackAtCoordinates, Pd as describeFileReadFailure, Pl as WHOLE_DYNAMIC_REFERENCE_PATTERN, Pn as planRollback, Po as UNREADABLE_ORPHANS_CONTAINER_ROW, Pr as looselyEqual, Ps as repairMalformedOrphanRecordsForReadOnly, Pt as resolvePendingCloudControlRequests, Pu as describeDockerFailure, Qa as applyRoleArnIfSet, Qc as hasMaskableValues, Qi as ProviderRegistry, Ql as hasReadableExportSet, Qn as nameScopeOf, Qo as malformedOrphanRowsKeptWarning, Qr as holdsSupersededResources, Qs as shownType, Qt as dropFailedHint, Qu as getDefaultStateBucketName, Ra as poisonRenderedSpellingsCollidingIn, Rc as noEchoLeavesOf, Rd as injectAwsRegion, Ri as DeploymentEventsStore, Rl as S3StateBackend, Rn as resolveReplacementOldType, Ro as displayLogicalId, Rs as repairMalformedResourcePropertiesForReadOnly, Rt as displacedOpClause, Ru as getDockerCmd, Sd as AssemblyReader, Si as storedSecretNameNeedles, Sl as physicalNameCopiesOf, Sn as removeProtectionTypeList, So as cfnRefValueFromPhysicalId, Sr as DEFAULT_RESOURCE_TIMEOUT_MS, Ss as refuseMalformedResourceEntriesForDestroy, St as readRecordedConditionVerdicts, Su as ensureAssetStorage, Td as describeJsonParseFailure, Ti as buildFinalSnapshotIdentifier, Tl as splitGetAttStringForm, Tn as withUnprovenUnsettled, To as refStateLookupFromResource, Tr as constructPathOf$1, Ts as refuseMalformedResourceEntriesForOrphan, Tt as withResourceDeadline, Tu as parseBootstrapMarker, Uc as recordedNoEchoValuesOf, Ul as crossPrefixDeniedWarning, Un as inheritProducerRegions, Uo as isReadableResourceEntry, Us as withheldAccountClause, Ut as recordDisplacedSkips, Uu as redactedCause, Vc as readbackPathFor, Vd as resolveBucketRegion, Vl as CrossPrefixScanCache, Vn as findNestedStackTypeChanges, Vo as hasReadableResources, Vs as unreadableOrphanRecords, Vu as partitionSensitiveEnv, Wc as valueAtCoordinate, Wl as isAccessDenied, Wo as malformedDriftResourcePropertiesWarning, Wr as bold, Ws as findActionableSilentDrops, Wu as redactedDockerCause, Xa as recordedOutputReferenceRegions, Xc as carryLogOnlyValues, Xl as describeRegionValueKind, Xn as nameGenerationCarriedFrom, Xo as malformedOrphanRecordsRefusalMessage, Xr as addSuperseded, Xs as hasNoCloudControlHandlers, Xt as deleteJournaledOrphans, Xu as Synthesizer, Yl as acceptedCreateOnlyDropsOf, Yn as updatePartialReason, Yo as malformedLocalResourcesWarning, Yr as yellow, Ys as NO_CC_HANDLERS_REASON, Yt as withNestedStackContext, Yu as getDockerImageBySourceHash, Za as recordedReferenceRegions, Zc as createUnionSecretMasker, Zi as CC_BROKEN_REASON, Zl as exportNamesCarriedFrom, Zn as nameGenerationHighWaterOf, Zo as malformedOrphanRecordsWarning, Zr as deleteSupersededEntry, Zs as findReplacedReadersOfRecreateTargets, Zt as dropFailedCommands, Zu as synthesisStatusMessage, _a as deleteIndeterminateGuards, _d as decodeListingKey, _i as secretNamePrintingBag, _l as spelledKeysOf, _n as pendingMovesOutOf, _o as carriesDynamicReference, _r as noEchoParameterValueSeed, _s as refuseMalformedOutputs, _t as renderNestedTemplateTreeDefect, _u as loadPublishableAssetManifest, a as isProtectionValueActive, aa as isCustomResourceType$1, ad as resolveStateBucketWithDefault, ai as withoutSuperseded, al as unionOfSecretBags, ao as applyCallerIdentityCredentials, ar as reachableDivergentParameters, as as malformedResourcePropertiesWarning, au as orphansCarriedFrom, bc as describeTypeWithThrottleRetry, bd as canonicalizeRegion, bi as secretNamedRecordNeedles, bl as recordNestedStackParameterExpressions, bn as replayFailedOperations, bo as keepsSecretReferenceToken, br as isExportAliasCollision, bs as refuseMalformedResourceEntries, bt as conditionInputsFrom, bu as BOOTSTRAP_MARKER_PREFIX, ca as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, cd as stateBucketExistenceConfirmed, ci as noEchoExactEchoLeavesOf, cl as maskSecretsInError, co as classifyRecordedSecretRegion, cr as displayTextOrWithheld, cs as malformedStateRefusalMessage, ct as crossStackOutputProvenanceSource, cu as PhaseClock, da as CloudControlProvider, dd as CFN_TEMPLATE_BODY_LIMIT, di as createReadOnlyAttributeHealerFactory, dl as withPhysicalNameCopies, dn as refactorMarkerMovesOf, do as regionLessSecretName, dr as secretBearingStateKeyWarning, dt as findServiceTokenRefusals, du as AssetPublisher, ea as isCustomResource, ec as isStatefulRecreateTargetForReplace, ed as loadCdkJson, ei as removeSuperseded, el as logOnlyValueCount, en as journaledOrphanLines, eo as assertSendableRoleArn, er as retiredNameGenerationsAfter, es as malformedOrphansWarning, eu as hasUnverifiableParameterRefusal, fa as slowCcOperationTimeoutMs, fd as CFN_TEMPLATE_URL_LIMIT, fi as completedReplayEntries, fn as refactorMarkerRefusalMessage, fo as coerceParameterTypedValue, fr as secretSafeKeyDisplay, fs as refuseMalformedOrphanRecords, ft as serviceTokenBlockingReason, fu as isSensitiveAttributeName, ga as UNSPECIFIED_SKIP_REASON, gd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gi as orphanRecordsPrintingBag, gl as pathCrossesDottedKey, gn as hasPendingMovesOut, go as isImpossibleEmptyStoredAttribute, gr as isWholeDynamicReferenceValue, gs as refuseMalformedOrphansForOrphan, gt as listNestedTemplateRows, gu as createAssetRedirectResolver, ha as RollbackInlinePolicyWriters, hd as uploadCfnTemplate, hi as namingSecretsWithRecordedNoEcho, hl as isUncertifiedBaselineMaskPosition, hn as updateRefactorMarker, ho as getAccountInfo, hr as exportNameSecretExposure, hs as refuseMalformedOrphansForDestroy, ht as isAbsoluteAssetPath, hu as buildAssetRedirectMap, i as PROTECTION_PROPERTY_BY_TYPE, ia as readsNoEchoDeleteValues, id as resolveSkipPrefix, ii as supersededResourcesOf, il as shareLogOnlyValues, in as formatResourceLine, io as AWS_CREDENTIAL_ENV_KEYS, ir as namesAnyDeclaredParameter, is as malformedResourceEntriesWarning, iu as orphansAfterRollback, jc as canonicalCoordinates, jd as nullPrototypeRecord, ji as unsupportedFinalSnapshotError, jl as recordNoEchoParameterFreshValue, jn as isJournaledOrphan, jo as JSON_LISTING_HOLE_VALUE, jr as rollbackOrphanIds, js as refuseMalformedResourcesForDestroy, jt as makeSiblingClaimReader, ju as resolveDockerContextDirectory, ka as DiffCalculator, kc as DagBuilder, kd as hasOwnKey, ki as isFinalSnapshotError, kl as recordMaskOnlyValuesIn, kn as undeclaredEmptyObservedKeys, kr as hintSidesOf, ks as refuseMalformedResourcePropertiesForOrphan, kt as mergeNoChangeOutputs, ku as buildDenyExternalAccessPolicy, la as applyCustomResourceResponseExpiration, ld as warnDeprecatedNoPrefixCliFlag, li as noEchoParameterNamesOf, ll as maskSecretsInText, ln as readRefactorMarker, lo as classifyReplaySecretRegion, lr as exportAliasCollisionScrubWarning, ls as previewableOrphanRecords, lt as inheritedProvenanceForChildDiff, lu as renderPhaseTimings, md as findLargeInlineResources, mi as maskEventTextWithBoundBags, ml as dynamicReferenceTokens, mn as sameMove, mo as parameterTypeMayLoseSecretIdentity, mr as exportNameNoEchoParameters, ms as refuseMalformedOrphans, mt as findNestedTemplateTreeDefect, mu as WorkGraph, n as recordedProtectionEvidence, nc as renderStatefulReason, nd as resolveAutoAssetStorage, ni as supersededHeldByOtherTypeWarning, nl as recordLogOnlyParameterValue, nn as makeForeignHolderScan, no as isIamRoleArn, nr as withNameGenerationReached, ns as malformedOutputsWarning, nu as importableOutputs, o as perType, od as resolveStateBucketWithDefaultAndSource, oi as noEchoAttributeNamesOf, ol as createSecretMasker, oo as callerEnvCredentials, or as resourcesNamingDeclaredParameter, os as malformedResourcesWarning, ot as IMPLICIT_DELETE_DEPENDENCIES, ou as shouldRetainResource, pd as MIGRATE_TMP_PREFIX, pi as journaledOrphanPrintingBag, pl as DYNAMIC_REFERENCE_TOKEN_SCAN, pn as refuseRefactorMarker, po as isUnboundTemplateParameter, pr as carriedExportAliasExposure, ps as refuseMalformedOrphanRecordsForDestroy, pt as childTemplateLoader, pu as stringifyValue, qa as refuseUnreadableCdkCrossAccountRefs, qc as redactForState, ql as withStackInstanceIdWithheld, qo as malformedLocalOutputsWarning, qr as green, qs as unwrittenCreateOnlyReplacement, qt as collectNestedChildUnaddressed, qu as warnFinchArgvExposure, r as recordedProtectionNote, ra as TemplateNoEchoReresolver, rd as resolveCaptureObservedState, ri as supersededHolderOf, rl as recordLogOnlyValue, rn as sameJournaledOrphans, ro as sendableAssumeRoleCommand, rr as computeParameterTaint, rs as malformedRenderedContainersWarning, ru as isReadableBag, s as readProtection, sa as withPrintingSecrets, sd as resolveUseCdkBootstrapAssets, si as noEchoComparisonForTemplate, sl as errorCauseChain, so as envCredentialsAreAssumedRole, sr as WITHHELD_NAME_DISPLAY, ss as malformedScrubResourceEntriesRefusalMessage, st as computeImplicitDeleteEdges, su as stackInstanceIdCarriedFrom, t as DeployEngine, ta as wouldReturnToSdkProvider, tc as isStatefulRecreateTargetSync, td as resolveApp, ti as supersededAfterRollback, tl as printingCorpusOf, tn as loadJournaledOrphans, to as explicitRoleArnOrThrow, tr as retiredNameGenerationsLeaving, ts as malformedOutputsRefusalMessage, tu as importableOutputKeys, ua as customResourceResponseExpirationWarning, ud as ssmResolvedValueType, ui as withAttemptedItemsMasked, ul as scrubResourceRecord, un as readRefactorMarkerOnce, uo as producerRegionsFromState, ur as secretBearing, us as refuseDivergentRecordRegionForDestroy, ut as deferredServiceTokenWarning, uu as timePhase, va as deleteLeftInPlace, vc as prefetchCreateOnlyPropertyPaths, vd as expectedOwnerParam, vi as secretNamePrintingBags, vl as identityKeyFor, vn as pendingMovesRefusalMessage, vo as carriesFetchableDynamicReference, vr as collectDeclaredOutputNames, vs as refuseMalformedOutputsForDestroy, vt as templateIdentity, vu as rewriteTemplateAssetReferences, wd as processStackMessages, wi as PRE_DELETE_SNAPSHOT_TYPES, wl as recordPhysicalNameCopy, wn as settleUnsettledPrevious, wo as lacksRecordedTableArn, wr as maskingRetryLogger, ws as refuseMalformedResourceEntriesForImportSave, wu as isCrossRegionRedirect, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xi as stateSecretNameNeedles, xn as replayRollback, xo as AWS_NO_VALUE, xr as bindingSkippedOutputs, xs as refuseMalformedResourceEntriesForDeploy, xt as parentSuppliedValues, xu as assertAssetBucketRegion, ya as deleteSkipReason, yc as templateResourceTypes, yd as PARTITION_TABLE, yl as inheritNestedStackParameterAssociations, yn as refusePendingMovesOut, yo as isNamelessDynamicReferenceError, yr as collectPublishedOutputNames, ys as refuseMalformedResourceAttributesForOrphan, yt as conditionFingerprint, yu as AssetModeResolver, zc as noEchoOutputsComparison, zd as injectedAwsRegionValue, zi as extractDeploymentEventError, zl as rebuildClientForBucketRegion, zn as seedsDeleteFirstGuard, zo as hasReadableOrphans, zs as repairMalformedResourcesForReadOnly, zt as displacedPhysicalIdShown, zu as isDockerClientEnvKey } from "./deploy-engine-BiJyU4j1.js";
+import { t as getCdkdVersion } from "./version-CrtjwYuX.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2686,7 +2686,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 // src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DOr3JVGp.js");
+	providerClasses ??= import("./provider-classes-BTOXS3cs.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -12028,6 +12028,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		guardIndeterminateCount: 0,
 		journaledOrphanSkips: 0,
 		stateDeleted: false,
+		blockedCount: 0,
 		errorCount: 0,
 		interrupted: false
 	};
@@ -12390,6 +12391,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			Properties: resource.properties || {},
 			...resource.dependencies && resource.dependencies.length > 0 && { DependsOn: resource.dependencies }
 		};
+		const blockingResources = { ...template.Resources };
 		const typeToLogicalIds = /* @__PURE__ */ new Map();
 		for (const [logicalId, resource] of Object.entries(state.resources)) {
 			const ids = typeToLogicalIds.get(resource.resourceType) ?? [];
@@ -12416,6 +12418,12 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			}
 		}
 		for (const { before, after } of computeImplicitDeleteEdges(state.resources)) {
+			const blocking = blockingResources[before]?.DependsOn ?? [];
+			const blockingArray = Array.isArray(blocking) ? blocking : [blocking];
+			if (!blockingArray.includes(after)) blockingResources[before] = {
+				...blockingResources[before],
+				DependsOn: [...blockingArray, after]
+			};
 			const existing = template.Resources[before]?.DependsOn ?? [];
 			const depsArray = Array.isArray(existing) ? existing : [existing];
 			if (!depsArray.includes(after)) {
@@ -12428,8 +12436,17 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		}
 		const dagBuilder = new DagBuilder();
 		const graph = dagBuilder.buildGraph(template);
+		const blockingGraph = dagBuilder.buildGraph({
+			...template,
+			Resources: blockingResources
+		});
 		const executionLevels = dagBuilder.getExecutionLevels(graph);
 		logger.debug(`Dependency graph: ${executionLevels.length} level(s)`);
+		const blockedBy = /* @__PURE__ */ new Map();
+		const blockedIds = [];
+		const blockDependenciesOf = (logicalId) => {
+			for (const dependency of dagBuilder.getAllDependencies(blockingGraph, logicalId)) if (!blockedBy.has(dependency)) blockedBy.set(dependency, logicalId);
+		};
 		const reresolver = ctx.noEchoReresolver;
 		const judgedBagOf = secretNamePrintingBags(state.resources, reresolver === void 0 ? noEchoValues : namingSecretsWithRecordedNoEcho(noEchoValues, (logicalId) => {
 			try {
@@ -12457,6 +12474,24 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 					logger.warn(`Resource ${displaySafe(logicalId)} not found in state, skipping`);
 					return;
 				}
+				const blocker = blockedBy.get(logicalId);
+				if (blocker !== void 0) {
+					const blockReason = `${blocker} depends on it and its delete failed`;
+					logger.info(safeMsg`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `not deleted (${blockReason})`)}`);
+					result.blockedCount++;
+					blockedIds.push(logicalId);
+					recordDestroyEvent(ctx.eventRecorder, {
+						eventType: "RESOURCE_SKIPPED",
+						stackName,
+						operation: "DELETE",
+						logicalId,
+						resourceType: resource.resourceType,
+						...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+						...resource.physicalId && { physicalId: resource.physicalId },
+						reason: blockReason
+					});
+					return;
+				}
 				if (shouldRetainResource(resource.deletionPolicy)) {
 					logger.info(`  ⊘ ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) retained — DeletionPolicy: ${displaySafe(resource.deletionPolicy)}`);
 					result.retainedCount++;
@@ -12665,6 +12700,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 						logger.error(`  ✗ Failed to delete ${displaySafe(logicalId)}:`, wrapped.message);
 						result.errorCount++;
 						failedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
+						blockDependenciesOf(logicalId);
 						recordDestroyEvent(ctx.eventRecorder, {
 							eventType: "RESOURCE_FAILED",
 							stackName,
@@ -12679,6 +12715,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 						logger.error(`  ✗ Failed to delete ${displaySafe(logicalId)}:`, safeStringify(error));
 						result.errorCount++;
 						failedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
+						blockDependenciesOf(logicalId);
 						recordDestroyEvent(ctx.eventRecorder, {
 							eventType: "RESOURCE_FAILED",
 							stackName,
@@ -12761,7 +12798,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		}
 		result.interrupted = lock.interrupted;
 		await saveChain;
-		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > result.journaledOrphanSkips;
+		const preserveState = result.errorCount > 0 || result.interrupted || result.blockedCount > 0 || result.skippedCount > result.journaledOrphanSkips;
 		statePreserved = preserveState;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
@@ -12786,9 +12823,10 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
 			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete` + (journaledOrphanFailures > 0 ? ` (${journaledOrphanFailures} of them recorded only in the rollback journal)` : "") + `. State preserved.`);
 			else logger.warn(`${result.skippedCount - result.journaledOrphanSkips} resource(s) skipped — cdkd did not confirm they were deleted, so they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
+			if (result.blockedCount > 0) logger.warn(safeMsg`${result.blockedCount} resource(s) not deleted because the delete of a resource that ` + "depends on them failed, as CloudFormation leaves them: " + safeMsg`${blockedIds.map((id) => plainOrDescribed(id, "logical id")).join(", ")}. ` + "Their records are kept: once the resource blocking them is deleted, a re-run of 'cdkd destroy' / 'cdkd state destroy' deletes them.");
 		}
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
-		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
+		const skippedSuffix = (result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "") + (result.blockedCount > 0 ? `, ${yellow(result.blockedCount)} blocked` : "");
 		const guardSuffix = result.guardIndeterminateCount > 0 ? `, ${yellow(result.guardIndeterminateCount)} unverified` : "";
 		if (result.guardIndeterminateCount > 0) {
 			const eventsCommand = pasteableCommand("cdkd events", [{
@@ -31516,4 +31554,4 @@ function collectVerbFlags(program) {
 }
 
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DyYTFxF-.js.map
+//# sourceMappingURL=program-Dm0hn2Sn.js.map