@cargo-ai/cli 1.0.25 → 1.0.26

package/README.md

@@ -98,23 +98,23 @@ cargo-ai orchestration workflow --help
 
 ### Domains and example commands
 
-| Domain                   | Description                                                   | Example commands                                                                                                              |
-| ------------------------ | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| **init**                 | Workspace initialisation (user, workspace, datasets, etc.)    | `cargo-ai init`                                                                                                               |
-| **orchestration**        | Workflows, plays, runs, batches, tools, templates             | `cargo-ai orchestration workflow list`, `cargo-ai orchestration run list --workflow-uuid <uuid>`                              |
-| **workspaceManagement**  | Workspaces, users, tokens, roles, folders                     | `cargo-ai workspaceManagement workspaces list`, `cargo-ai workspaceManagement token list`                                     |
-| **storage**              | Datasets, models, relationships, runs, records                | `cargo-ai storage dataset list`, `cargo-ai storage model list`                                                                |
-| **connection**           | Connectors and integrations                                   | `cargo-ai connection connector list`, `cargo-ai connection integration list`                                                  |
-| **billing**              | Usage and subscription                                        | `cargo-ai billing subscription get`, `cargo-ai billing usage get-metrics --payload '{"from":"2025-01-01","to":"2025-01-31"}'` |
-| **segmentation**         | Segments and changes                                          | `cargo-ai segmentation segment list`, `cargo-ai segmentation change list --payload '{}'`                                      |
-| **revenue-organization** | Allocations, capacities, members, territories                 | `cargo-ai revenue-organization member list`, `cargo-ai revenue-organization territory list`                                   |
-| **expression**           | Recipes and expression evaluation                             | `cargo-ai expression recipe list`, `cargo-ai expression eval evaluate --payload '{}'`                                         |
-| **system-of-record**     | System of record, client, logs                                | `cargo-ai system-of-record sor list`, `cargo-ai system-of-record log list --payload '{}'`                                     |
-| **user-management**      | Current user (no workspace context)                           | `cargo-ai user-management user get-current`                                                                                   |
-| **ai**                   | AI templates, agents, releases, chats, MCP, files             | `cargo-ai ai template list`, `cargo-ai ai agent list`, `cargo-ai ai file list`                                                |
-| **context**              | Context repository, runtime sandbox, and knowledge graph      | `cargo-ai context repository get`, `cargo-ai context runtime browse --path <path>`, `cargo-ai context graph get`              |
-| **hosting**              | Cargo Hosting apps (Vite SPAs), workers, and deployments      | `cargo-ai hosting app list`, `cargo-ai hosting worker list`, `cargo-ai hosting deployment list --payload '{}'`                |
-| **workflow**             | Workflow SDK developer tools: per-workspace type sync/codegen | `cargo-ai workflow sync` (SDK deploy lives at `cargo-ai orchestration release deploy-draft --file <path>`)                    |
+| Domain                   | Description                                                       | Example commands                                                                                                              |
+| ------------------------ | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| **init**                 | Workspace initialisation (user, workspace, datasets, etc.)        | `cargo-ai init`                                                                                                               |
+| **orchestration**        | Workflows, plays, runs, batches, tools, templates                 | `cargo-ai orchestration workflow list`, `cargo-ai orchestration run list --workflow-uuid <uuid>`                              |
+| **workspaceManagement**  | Workspaces, users, tokens, roles, folders                         | `cargo-ai workspaceManagement workspaces list`, `cargo-ai workspaceManagement token list`                                     |
+| **storage**              | Datasets, models, relationships, runs, records                    | `cargo-ai storage dataset list`, `cargo-ai storage model list`                                                                |
+| **connection**           | Connectors and integrations                                       | `cargo-ai connection connector list`, `cargo-ai connection integration list`                                                  |
+| **billing**              | Usage and subscription                                            | `cargo-ai billing subscription get`, `cargo-ai billing usage get-metrics --payload '{"from":"2025-01-01","to":"2025-01-31"}'` |
+| **segmentation**         | Segments and changes                                              | `cargo-ai segmentation segment list`, `cargo-ai segmentation change list --payload '{}'`                                      |
+| **revenue-organization** | Allocations, capacities, members, territories                     | `cargo-ai revenue-organization member list`, `cargo-ai revenue-organization territory list`                                   |
+| **expression**           | Recipes and expression evaluation                                 | `cargo-ai expression recipe list`, `cargo-ai expression eval evaluate --payload '{}'`                                         |
+| **system-of-record**     | System of record, client, logs                                    | `cargo-ai system-of-record sor list`, `cargo-ai system-of-record log list --payload '{}'`                                     |
+| **user-management**      | Current user (no workspace context)                               | `cargo-ai user-management user get-current`                                                                                   |
+| **ai**                   | AI templates, agents, releases, chats, MCP, files                 | `cargo-ai ai template list`, `cargo-ai ai agent list`, `cargo-ai ai file list`                                                |
+| **context**              | Context repository, runtime sandbox, and knowledge graph          | `cargo-ai context repository get`, `cargo-ai context runtime browse --path <path>`, `cargo-ai context graph get`              |
+| **hosting**              | Cargo Hosting apps (Vite SPAs), workers, and deployments          | `cargo-ai hosting app list`, `cargo-ai hosting worker list`, `cargo-ai hosting deployment list --payload '{}'`                |
+| **cdk**                  | Declarative IaC: define resources in code, deploy, generate types | `cargo-ai cdk init <dir>`, `cargo-ai cdk types`, `cargo-ai cdk plan`, `cargo-ai cdk deploy`                                   |
 
 Commands that accept complex payloads use a `--payload <json>` option (e.g. `cargo-ai orchestration play create --payload '{"name":"My Play",...}'`). Use `--help` on any subcommand for options.
 

package/build/commands/cdk/index.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { Api } from "../../api.js";
+export declare function registerCdkCommands(program: Command, getApi: () => Api): void;
+//# sourceMappingURL=index.d.ts.map

package/build/commands/cdk/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/cdk/index.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAkBxC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAqpB7E"}

package/build/commands/cdk/index.js

@@ -0,0 +1,539 @@
+import { acquireLock, appendAudit, apply, compile, destroy, detectDrift, emptyState, formatPlan, importResource, liveExecutors, liveReaders, loadResources, newRunId, plan, readState, reconcileDrift, removeResources, restoreSnapshot, snapshotState, writeState, } from "@cargo-ai/cdk";
+import { getConfig } from "../../config.js";
+import { colors, confirm, ExitCodes, failWith, info, outputJson, startSpinner, success, } from "../runHandler.js";
+import { registerInitCommand } from "./init.js";
+import { registerTypesCommand } from "./types.js";
+// `cargo-ai cdk` — declarative deploy of a repo of Cargo resources. The
+// engine (load / compile / apply / state) lives in @cargo-ai/cdk; the CLI parses
+// args, authenticates, confirms, and prints.
+export function registerCdkCommands(program, getApi) {
+    const cdk = program
+        .command("cdk")
+        .description("Cargo CDK — define resources in code and deploy them (plan/deploy)");
+    // `cdk init` — scaffold a starter project; `cdk types` — generate per-workspace
+    // TS types (typed connector/model config).
+    registerInitCommand(cdk);
+    registerTypesCommand(cdk, getApi);
+    cdk
+        .command("plan")
+        .description("Compile the resource tree and diff against cargo.state.json. Offline — no API calls.")
+        .option("--dir <path>", "Repo root containing the resource files (default: cwd)")
+        .option("--json", "Output the raw plan result as JSON")
+        .action(async (opts) => {
+        // Run from the repo root so relative code paths (defineWorker/App/File)
+        // and cargo.state.json resolve against it.
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        let result;
+        try {
+            result = await plan(root);
+        }
+        catch (error) {
+            failWith(`Failed to load cdk repo: ${message(error)}`, {
+                code: ExitCodes.InvalidUsage,
+            });
+        }
+        if (opts.json === true)
+            outputJson(result);
+        else
+            process.stdout.write(`${formatPlan(result)}\n`);
+        if (result.errors.length > 0)
+            process.exitCode = ExitCodes.GenericError;
+    });
+    cdk
+        .command("deploy")
+        .description("Deploy the resource tree to Cargo — create/update resources and write cargo.state.json.")
+        .option("--dir <path>", "Repo root containing the resource files (default: cwd)")
+        .option("--yes", "Skip the confirmation prompt")
+        .option("--dry-run", "Show the plan without applying")
+        .option("--prune", "Delete resources tracked in state but no longer in code")
+        .option("--refresh", "Re-read live resources first and re-apply any modified out-of-band")
+        .option("--recreate-deleted", "With --refresh, also restore resources deleted outside the CDK (off by default)")
+        .option("--force", "Steal the state lock held by another run")
+        .option("--json", "Output the deploy result as JSON")
+        .action(async (opts) => {
+        // Run from the repo root so relative code paths (defineWorker/App/File)
+        // and cargo.state.json resolve against it.
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        const workspaceUuid = await resolveWorkspaceUuid(getApi);
+        const runId = newRunId();
+        // Load the resource tree ONCE (loadResources resets the registry, so it
+        // must not run twice in a process), then reuse the nodes for plan + apply.
+        let nodes;
+        try {
+            nodes = await loadResources(root);
+        }
+        catch (error) {
+            failWith(`Failed to load cdk repo: ${message(error)}`, {
+                code: ExitCodes.InvalidUsage,
+            });
+        }
+        // Hold the state lock for the whole read→plan→apply sequence (not just
+        // the apply), so a concurrent run can't rewrite cargo.state.json between
+        // our read and our write. --dry-run is read-only, so it skips the lock.
+        if (opts.dryRun !== true) {
+            try {
+                acquireLock(root, "deploy", opts.force === true);
+            }
+            catch (error) {
+                failWith(message(error), { code: ExitCodes.GenericError });
+            }
+        }
+        const prior = readState(root);
+        if (prior !== undefined && prior.workspaceUuid !== workspaceUuid) {
+            failWith(`cargo.state.json belongs to workspace ${prior.workspaceUuid}, but the selected workspace is ${workspaceUuid}. Refusing to deploy (would orphan resources).`, { code: ExitCodes.InvalidUsage });
+        }
+        const baseState = prior ?? emptyState(workspaceUuid);
+        // Build the authenticated client lazily so a plain `--dry-run` stays
+        // offline; `--refresh` and the apply both reuse this one instance.
+        let apiClient;
+        const api = () => {
+            if (apiClient === undefined)
+                apiClient = getApi();
+            return apiClient;
+        };
+        // With --refresh, re-read the live resources and fold out-of-band drift
+        // into the state before planning: a resource edited in the UI re-applies
+        // (its code-hash is invalidated) and one deleted externally is recreated.
+        let state = baseState;
+        if (opts.refresh === true &&
+            Object.keys(baseState.resources).length > 0) {
+            let drift;
+            try {
+                drift = await detectDrift(baseState, liveReaders(api()));
+            }
+            catch (error) {
+                failWith(`Refresh failed: ${message(error)}`, {
+                    code: ExitCodes.GenericError,
+                });
+            }
+            const modifiedExternally = drift.filter((d) => d.status === "modified");
+            const deletedExternally = drift.filter((d) => d.status === "deleted");
+            const changed = [...modifiedExternally, ...deletedExternally];
+            if (changed.length === 0) {
+                info("Refresh: no out-of-band drift.");
+            }
+            else {
+                info(`Refresh found ${String(changed.length)} drifted resource(s):`);
+                for (const d of modifiedExternally) {
+                    info(`  modified externally: ${d.id}`);
+                }
+                for (const d of deletedExternally) {
+                    info(`  deleted externally: ${d.id}`);
+                }
+                // A resource present in code but deleted in the UI is ambiguous —
+                // an accident to restore, or an intentional removal. Don't silently
+                // recreate it; force the decision unless --recreate-deleted opts in.
+                if (deletedExternally.length > 0 && opts.recreateDeleted !== true) {
+                    failWith(`${String(deletedExternally.length)} resource(s) were deleted outside the CDK ` +
+                        `(${deletedExternally.map((d) => d.id).join(", ")}). Re-run with ` +
+                        `--recreate-deleted to restore them, or remove them from your code if ` +
+                        `the deletion was intentional.`, { code: ExitCodes.InvalidUsage });
+                }
+                // Modified always re-applies; deleted only reconciles (→ recreate)
+                // once the user has opted in above.
+                const effectiveDrift = opts.recreateDeleted === true ? drift : modifiedExternally;
+                state = reconcileDrift(baseState, effectiveDrift);
+            }
+        }
+        const planResult = compile({ nodes, state });
+        info(formatPlan(planResult));
+        if (planResult.errors.length > 0) {
+            failWith("Plan has errors — fix them before deploying.", {
+                code: ExitCodes.GenericError,
+            });
+        }
+        const deletes = planResult.plan.filter((e) => e.change === "delete");
+        const hasApplyWork = planResult.plan.some((e) => e.change === "create" || e.change === "update");
+        const willPrune = opts.prune === true && deletes.length > 0;
+        if (opts.dryRun === true) {
+            // Make the dry run reflect the --prune decision.
+            if (deletes.length > 0) {
+                info(willPrune
+                    ? `Would prune ${String(deletes.length)} resource(s): ${deletes.map((e) => e.id).join(", ")}`
+                    : `${String(deletes.length)} resource(s) would be left in place — add --prune to remove them.`);
+            }
+            return;
+        }
+        if (!hasApplyWork && !willPrune) {
+            if (deletes.length > 0) {
+                info(`${String(deletes.length)} resource(s) in state are no longer in code. Re-run with --prune to remove them.`);
+            }
+            else {
+                success("Nothing to deploy — everything is up to date.");
+            }
+            return;
+        }
+        if (opts.yes !== true) {
+            const ask = willPrune
+                ? `Deploy to workspace ${workspaceUuid} and prune ${String(deletes.length)} resource(s)?`
+                : `Deploy to workspace ${workspaceUuid}?`;
+            const ok = await confirm(ask);
+            if (!ok)
+                failWith("Aborted.", { code: ExitCodes.GenericError });
+        }
+        // Snapshot the pre-deploy state so `cdk rollback` can restore it.
+        snapshotState(root);
+        // Live progress: a spinner naming the resource currently being applied,
+        // leaving a ✓ line behind for each completed one. Suppressed for --json
+        // so machine output on stdout stays clean.
+        const spinner = opts.json === true ? undefined : startSpinner("Deploying…");
+        const onProgress = spinner === undefined
+            ? undefined
+            : (event) => {
+                if (event.phase === "start") {
+                    const verb = event.change === "create" ? "Creating" : "Updating";
+                    spinner.update(`${verb} ${colors.bold(event.id)} ${colors.dim(`(${event.index}/${event.total})`)}`);
+                }
+                else {
+                    const done = event.change === "create" ? "created" : "updated";
+                    spinner.log(`  ${colors.green("✓")} ${event.id} ${colors.dim(done)}`);
+                }
+            };
+        let result;
+        try {
+            result = await apply({ nodes, state }, liveExecutors(api()), // throws NotAuthenticated if not logged in
+            (next) => writeState(root, next), liveReaders(api()), // capture a live fingerprint for drift detection
+            onProgress);
+        }
+        catch (error) {
+            spinner?.stop();
+            appendAudit(root, {
+                runId,
+                at: new Date().toISOString(),
+                command: "deploy",
+                workspaceUuid,
+                ok: false,
+                error: message(error),
+            });
+            failWith(`Deploy failed: ${message(error)}`, {
+                code: ExitCodes.GenericError,
+                extra: {
+                    runId,
+                    hint: "Resources created before the failure were saved to cargo.state.json — fix the error and re-run to continue.",
+                },
+            });
+        }
+        spinner?.stop();
+        let pruned = {
+            removed: [],
+            released: [],
+        };
+        if (willPrune) {
+            try {
+                pruned = await removeResources(root, api(), deletes.map((e) => e.id));
+            }
+            catch (error) {
+                appendAudit(root, {
+                    runId,
+                    at: new Date().toISOString(),
+                    command: "deploy",
+                    workspaceUuid,
+                    ok: false,
+                    error: `prune: ${message(error)}`,
+                });
+                failWith(`Prune failed: ${message(error)}`, {
+                    code: ExitCodes.GenericError,
+                    extra: { runId },
+                });
+            }
+        }
+        const created = result.applied.filter((e) => e.change === "create").length;
+        const updated = result.applied.filter((e) => e.change === "update").length;
+        appendAudit(root, {
+            runId,
+            at: new Date().toISOString(),
+            command: "deploy",
+            workspaceUuid,
+            ok: true,
+            summary: {
+                created,
+                updated,
+                unchanged: result.skipped.length,
+                pruned: pruned.removed.length,
+                released: pruned.released.length,
+            },
+        });
+        if (opts.json === true) {
+            outputJson({
+                created,
+                updated,
+                skipped: result.skipped.length,
+                pruned: pruned.removed.length,
+                released: pruned.released.length,
+            });
+        }
+        else {
+            success(`${String(created)} created, ${String(updated)} updated, ${String(result.skipped.length)} unchanged.`);
+            if (pruned.removed.length > 0 || pruned.released.length > 0) {
+                info(`Pruned ${String(pruned.removed.length)}${pruned.released.length > 0 ? ` (released ${String(pruned.released.length)} adopted)` : ""}.`);
+            }
+            else if (deletes.length > 0) {
+                info(`${String(deletes.length)} resource(s) no longer in code — re-run with --prune to remove them.`);
+            }
+            // First deploy: nudge the user to commit state and ignore the lock.
+            if (prior === undefined) {
+                info("Wrote cargo.state.json — commit it (it links your code to deployed resources). Add cargo.state.lock to .gitignore.");
+            }
+        }
+    });
+    cdk
+        .command("refresh")
+        .description("Re-read live resources and report drift from the last deploy (read-only).")
+        .option("--dir <path>", "Repo root (default: cwd)")
+        .option("--json", "Output the drift report as JSON")
+        .action(async (opts) => {
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        const workspaceUuid = await resolveWorkspaceUuid(getApi);
+        const state = readState(root);
+        if (state === undefined || Object.keys(state.resources).length === 0) {
+            info("No state — nothing to refresh.");
+            return;
+        }
+        // Reading another workspace's state against the selected one would report
+        // everything as deleted — refuse rather than print misleading drift.
+        if (state.workspaceUuid !== workspaceUuid) {
+            failWith(`cargo.state.json belongs to workspace ${state.workspaceUuid}, not the selected ${workspaceUuid}.`, { code: ExitCodes.InvalidUsage });
+        }
+        const api = getApi();
+        let drift;
+        try {
+            drift = await detectDrift(state, liveReaders(api));
+        }
+        catch (error) {
+            failWith(`Refresh failed: ${message(error)}`, {
+                code: ExitCodes.GenericError,
+            });
+        }
+        if (opts.json === true) {
+            outputJson(drift);
+            return;
+        }
+        const drifted = drift.filter((d) => d.status === "modified" || d.status === "deleted");
+        if (drifted.length === 0) {
+            success(`In sync — ${String(drift.length)} resource(s) match the last deploy.`);
+            return;
+        }
+        info(`${String(drifted.length)} resource(s) drifted from code:`);
+        for (const d of drifted) {
+            info(`  ${d.status === "deleted" ? "deleted externally" : "modified externally"}: ${d.id}`);
+        }
+        info("Run 'cdk deploy --refresh' to re-apply code over the drift.");
+    });
+    cdk
+        .command("import")
+        .argument("<id>", "Code resource id to bind (e.g. agent:sdr)")
+        .argument("<uuid>", "The live resource's uuid in the workspace")
+        .description("Bind an existing live resource to a code resource in cargo.state.json.")
+        .option("--dir <path>", "Repo root (default: cwd)")
+        .option("--force", "Steal the state lock held by another run")
+        .option("--json", "Output the result as JSON")
+        .action(async (id, uuid, opts) => {
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        const workspaceUuid = await resolveWorkspaceUuid(getApi);
+        const api = getApi();
+        const runId = newRunId();
+        try {
+            acquireLock(root, "import", opts.force === true);
+        }
+        catch (error) {
+            failWith(message(error), { code: ExitCodes.GenericError });
+        }
+        snapshotState(root); // enable `cdk rollback`
+        let result;
+        try {
+            result = await importResource(root, api, workspaceUuid, id, uuid);
+        }
+        catch (error) {
+            appendAudit(root, {
+                runId,
+                at: new Date().toISOString(),
+                command: "import",
+                workspaceUuid,
+                ok: false,
+                error: message(error),
+            });
+            failWith(`Import failed: ${message(error)}`, {
+                code: ExitCodes.GenericError,
+                extra: { runId },
+            });
+        }
+        appendAudit(root, {
+            runId,
+            at: new Date().toISOString(),
+            command: "import",
+            workspaceUuid,
+            ok: true,
+            summary: { id, uuid, kind: result.kind },
+        });
+        if (opts.json === true)
+            outputJson(result);
+        else
+            success(`Imported ${id} → ${uuid} (${result.kind}).`);
+    });
+    cdk
+        .command("rollback")
+        .description("Restore cargo.state.json from the snapshot taken before the last deploy/destroy/import.")
+        .option("--dir <path>", "Repo root (default: cwd)")
+        .option("--yes", "Skip the confirmation prompt")
+        .option("--force", "Steal the state lock held by another run")
+        .action(async (opts) => {
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        const workspaceUuid = await resolveWorkspaceUuid(getApi);
+        const runId = newRunId();
+        if (opts.yes !== true) {
+            const ok = await confirm("Restore cargo.state.json from the last snapshot? (restores the state file only — not live resources)");
+            if (!ok)
+                failWith("Aborted.", { code: ExitCodes.GenericError });
+        }
+        try {
+            acquireLock(root, "rollback", opts.force === true);
+        }
+        catch (error) {
+            failWith(message(error), { code: ExitCodes.GenericError });
+        }
+        if (!restoreSnapshot(root)) {
+            failWith("No snapshot found (cargo.state.bak.json) — nothing to roll back.", { code: ExitCodes.InvalidUsage });
+        }
+        appendAudit(root, {
+            runId,
+            at: new Date().toISOString(),
+            command: "rollback",
+            workspaceUuid,
+            ok: true,
+        });
+        success("Restored cargo.state.json from the snapshot. Run 'cargo-ai cdk deploy --refresh' to reconcile live resources to it.");
+    });
+    cdk
+        .command("destroy")
+        .description("Tear down resources recorded in cargo.state.json (deletes by uuid).")
+        .option("--dir <path>", "Repo root (default: cwd)")
+        .option("--yes", "Skip the confirmation prompt")
+        .option("--target <id>", "Only destroy this resource id (e.g. play:welcome)")
+        .option("--all", "Destroy every state-tracked resource (required for blanket teardown)")
+        .option("--force", "Steal the state lock held by another run")
+        .option("--json", "Output the result as JSON")
+        .action(async (opts) => {
+        // Run from the repo root so relative code paths (defineWorker/App/File)
+        // and cargo.state.json resolve against it.
+        if (opts.dir !== undefined)
+            process.chdir(opts.dir);
+        const root = ".";
+        const api = getApi();
+        const workspaceUuid = await resolveWorkspaceUuid(getApi);
+        const runId = newRunId();
+        // Blanket teardown must be explicit — `--yes` alone can't nuke a whole
+        // workspace; you must opt in with --target <id> or --all.
+        if (opts.target === undefined && opts.all !== true) {
+            failWith("Specify --target <id> to remove one resource, or --all to remove everything in state.", { code: ExitCodes.InvalidUsage });
+        }
+        // Lock before reading state so the read→delete sequence is consistent.
+        try {
+            acquireLock(root, "destroy", opts.force === true);
+        }
+        catch (error) {
+            failWith(message(error), { code: ExitCodes.GenericError });
+        }
+        const state = readState(root);
+        if (state === undefined || Object.keys(state.resources).length === 0) {
+            info("Nothing to destroy — no state.");
+            return;
+        }
+        if (state.workspaceUuid !== workspaceUuid) {
+            failWith(`cargo.state.json belongs to workspace ${state.workspaceUuid}, not the selected ${workspaceUuid}.`, { code: ExitCodes.InvalidUsage });
+        }
+        const ids = opts.target !== undefined
+            ? opts.target in state.resources
+                ? [opts.target]
+                : []
+            : Object.keys(state.resources);
+        if (ids.length === 0) {
+            // An explicit --target that matches nothing is a usage error, not a
+            // success — a scripted `destroy --target X && deploy` must not believe
+            // X was torn down when the id was simply mistyped.
+            failWith(`"${String(opts.target)}" is not in state — nothing to destroy. Run \`cargo-ai cdk plan\` to see the tracked ids.`, { code: ExitCodes.InvalidUsage });
+        }
+        // Always show exactly what will be deleted, even with --yes.
+        info(`About to remove ${String(ids.length)} resource(s) from workspace ${workspaceUuid}:`);
+        for (const id of ids)
+            info(`  - ${id}`);
+        if (opts.yes !== true) {
+            const ok = await confirm(`Delete these ${String(ids.length)} resource(s)?`);
+            if (!ok)
+                failWith("Aborted.", { code: ExitCodes.GenericError });
+        }
+        snapshotState(root); // enable `cdk rollback`
+        let result;
+        try {
+            result = await destroy(root, api, { target: opts.target });
+        }
+        catch (error) {
+            appendAudit(root, {
+                runId,
+                at: new Date().toISOString(),
+                command: "destroy",
+                workspaceUuid,
+                ok: false,
+                error: message(error),
+            });
+            failWith(`Destroy failed: ${message(error)}`, {
+                code: ExitCodes.GenericError,
+                extra: {
+                    runId,
+                    hint: "Resources removed before the failure are gone and dropped from state — re-run to remove the rest.",
+                },
+            });
+        }
+        appendAudit(root, {
+            runId,
+            at: new Date().toISOString(),
+            command: "destroy",
+            workspaceUuid,
+            ok: true,
+            summary: {
+                removed: result.removed.length,
+                released: result.released.length,
+                ids: result.removed,
+            },
+        });
+        if (opts.json === true)
+            outputJson(result);
+        else {
+            success(result.removed.length === 0
+                ? "Nothing removed."
+                : `Removed ${String(result.removed.length)}: ${result.removed.join(", ")}`);
+            if (result.released.length > 0) {
+                info(`Released ${String(result.released.length)} adopted (left in place): ${result.released.join(", ")}`);
+            }
+        }
+    });
+}
+// Resolve the workspace to operate on. Prefers an explicit `CARGO_WORKSPACE_UUID`
+// / credentials-file workspace; otherwise falls back to the workspace the token
+// is bound to (the same lookup `cargo-ai whoami` uses), so a workspace-scoped
+// token "just works" without setting an env var.
+async function resolveWorkspaceUuid(getApi) {
+    const { workspaceUuid } = getConfig();
+    if (workspaceUuid !== undefined)
+        return workspaceUuid;
+    try {
+        const { workspace } = await getApi().workspaceManagement.workspace.getCurrent();
+        return workspace.uuid;
+    }
+    catch (error) {
+        failWith(`No workspace selected and couldn't resolve one from your credentials (${message(error)}). ` +
+            "Run 'cargo-ai login' or set CARGO_WORKSPACE_UUID.", { code: ExitCodes.NotAuthenticated });
+    }
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/build/commands/cdk/init.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerInitCommand(parent: Command): void;
+//# sourceMappingURL=init.d.ts.map

package/build/commands/cdk/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/commands/cdk/init.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiBzC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAyEzD"}