@go-to-k/cdkd 0.262.3 → 0.263.0

package/dist/{deploy-engine-CtpGfN3E.js → deploy-engine-BbNhlr7X.js}

@@ -5209,6 +5209,50 @@ function shouldRetainResource(deletionPolicy) {
 	return deletionPolicy === "Retain" || deletionPolicy === "RetainExceptOnCreate";
 }
 
+//#endregion
+//#region src/types/rollback-journal.ts
+/**
+* Journal format version, INDEPENDENT of the state schema. An unknown value
+* on read is a hard error telling the user to upgrade cdkd (forward-compat
+* guard, mirrors state-schema handling).
+*/
+const ROLLBACK_JOURNAL_VERSION = 1;
+/** Thrown when a journal's `journalVersion` is newer than this binary knows. */
+var UnknownRollbackJournalVersionError = class extends Error {
+	foundVersion;
+	stackName;
+	constructor(foundVersion, stackName) {
+		super(`Rollback journal for '${stackName}' has journalVersion ${foundVersion}, but this cdkd only understands up to ${1}. Upgrade cdkd to roll this stack back.`);
+		this.name = "UnknownRollbackJournalVersionError";
+		this.foundVersion = foundVersion;
+		this.stackName = stackName;
+	}
+};
+/**
+* Parse + validate a journal body. Throws
+* {@link UnknownRollbackJournalVersionError} on a newer version, and a plain
+* Error on a structurally-invalid body.
+*/
+function parseRollbackJournal(bodyString, stackName) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyString);
+	} catch (err) {
+		throw new Error(`Rollback journal for '${stackName}' is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new Error(`Rollback journal for '${stackName}' is malformed (not an object).`);
+	const j = parsed;
+	if (typeof j.journalVersion !== "number" || j.journalVersion < 1) throw new Error(`Rollback journal for '${stackName}' has an invalid 'journalVersion' (${String(j.journalVersion)}).`);
+	if (j.journalVersion > 1) throw new UnknownRollbackJournalVersionError(j.journalVersion, stackName);
+	if (!Array.isArray(j.segments)) throw new Error(`Rollback journal for '${stackName}' is missing a 'segments' array.`);
+	return {
+		journalVersion: j.journalVersion,
+		stackName: j.stackName ?? stackName,
+		region: j.region ?? "",
+		segments: j.segments
+	};
+}
+
 //#endregion
 //#region src/utils/bucket-region-client.ts
 /**
@@ -5342,6 +5386,16 @@ var S3StateBackend = class {
 		return `${this.config.prefix}/${stackName}/state.json`;
 	}
 	/**
+	* Get the rollback-journal S3 key — a sibling of `state.json` (issue
+	* #1183). Only the region-scoped layout is used: journals are new objects
+	* only ever written by journal-aware binaries, and the deploy failure path
+	* migrates legacy-layout state before the journal write, so a legacy-key
+	* journal can never exist.
+	*/
+	getRollbackJournalKey(stackName, region) {
+		return `${this.config.prefix}/${stackName}/${region}/rollback-journal.json`;
+	}
+	/**
 	* Resolve the state bucket's actual region and, if it differs from the
 	* client's currently-configured region, replace the S3Client with one
 	* pointed at the bucket's region.
@@ -5567,6 +5621,7 @@ var S3StateBackend = class {
 				}));
 				this.logger.debug(`Deleted legacy state for stack: ${stackName}`);
 			}
+			await this.deleteRollbackJournal(stackName, region);
 			this.logger.debug(`State deleted: ${stackName} (${region})`);
 		} catch (error) {
 			const normalized = normalizeAwsError(error, {
@@ -5739,6 +5794,70 @@ var S3StateBackend = class {
 		if (failures.length > 0) throw new StateError(`Failed to delete ${failures.length} object(s) from bucket '${this.config.bucket}': ${failures.join("; ")}`);
 	}
 	/**
+	* Load the rollback journal for a stack (issue #1183). Returns `null` when
+	* no journal exists (the common case — a journal only lives between a
+	* failed/interrupted deploy and its `cdkd rollback`). Throws
+	* {@link UnknownRollbackJournalVersionError} on a newer-version journal.
+	*/
+	async loadRollbackJournal(stackName, region) {
+		const body = await this.getRawObject(this.getRollbackJournalKey(stackName, region));
+		if (body === null) return null;
+		return parseRollbackJournal(body, stackName);
+	}
+	/**
+	* Append one segment to the stack's rollback journal, creating it if
+	* absent. Existing segments are preserved (never overwritten) so
+	* consecutive failed deploys accumulate one segment each. Every writer
+	* holds the stack lock, so no optimistic locking is needed.
+	*/
+	async appendRollbackJournalSegment(stackName, region, segment) {
+		const journal = await this.loadRollbackJournal(stackName, region) ?? {
+			journalVersion: 1,
+			stackName,
+			region,
+			segments: []
+		};
+		journal.segments.push(segment);
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+	}
+	/**
+	* Pop the newest segment off the stack's rollback journal after it has
+	* been fully replayed. When the last segment is removed, the journal
+	* object is deleted entirely. Returns the number of segments remaining.
+	*/
+	async popRollbackJournalSegment(stackName, region) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal || journal.segments.length === 0) {
+			await this.deleteRollbackJournal(stackName, region);
+			return 0;
+		}
+		journal.segments.pop();
+		if (journal.segments.length === 0) {
+			await this.deleteRollbackJournal(stackName, region);
+			return 0;
+		}
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return journal.segments.length;
+	}
+	/**
+	* Delete the stack's rollback journal object (idempotent). Called on the
+	* deploy success path, after a clean rollback, and via {@link deleteState}
+	* so `cdkd destroy` / `cdkd state destroy` sweep it too.
+	*/
+	async deleteRollbackJournal(stackName, region) {
+		await this.ensureClientForBucket();
+		try {
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: this.getRollbackJournalKey(stackName, region)
+			}));
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return;
+			this.logger.warn(`Failed to delete rollback journal for '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/**
 	* HeadObject probe — returns true on 200, false on NotFound. Other errors
 	* propagate so we don't accidentally swallow IAM denials.
 	*/
@@ -11121,7 +11240,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CAnHrdEN.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DF1bV_pu.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -16284,6 +16403,763 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
+//#endregion
+//#region src/deployment/rollback-executor.ts
+/**
+* True when the op recorded a replacement (old physical id differs from the
+* new one). The old physical resource is already gone / orphaned, so an
+* in-place revert is best-effort — the plan labels these explicitly.
+*/
+function isReplacementOp(op) {
+	return op.changeType === "UPDATE" && op.previousState?.physicalId !== void 0 && op.previousState.physicalId !== op.physicalId;
+}
+function deepEqual(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqual(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!deepEqual(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+/**
+* Classify what a single op WILL do against the current state, without
+* touching AWS. Pure — used both by the command's plan preview and by the
+* replayer (which re-derives the action to stay in lock-step with the
+* plan). `orphanLogicalIds` mirrors `cdk rollback --orphan`.
+*/
+function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
+	const replacement = isReplacementOp(op);
+	if (op.changeType === "DELETE") return "unrecoverable-delete";
+	if (orphanLogicalIds.has(op.logicalId)) return "orphan-flag";
+	if (op.changeType === "CREATE") {
+		const current = stateResources[op.logicalId];
+		if (!current) return "skip-already-done";
+		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) return "skip-mismatch";
+		const policy = current.deletionPolicy;
+		if (policy === "Retain" || policy === "Snapshot") return "orphan-retain";
+		return "delete";
+	}
+	const current = stateResources[op.logicalId];
+	if (!current) return "skip-absent";
+	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) {
+		if (!replacement) return "skip-already-done";
+	}
+	return "revert";
+}
+/**
+* Build the full ordered plan for a list of ops (one segment). Mirrors the
+* replay order: UPDATE/DELETE first (reverse completion order), then CREATE
+* deletions in dependency-aware order.
+*/
+function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
+	const { createOps, otherOps } = partitionOps(operations);
+	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => ({
+		op,
+		action: classifyRollbackOp(op, stateResources, orphanLogicalIds),
+		replacement: isReplacementOp(op)
+	}));
+}
+function partitionOps(operations) {
+	const createOps = [];
+	const otherOps = [];
+	for (const op of operations) if (op.changeType === "CREATE") createOps.push(op);
+	else otherOps.push(op);
+	return {
+		createOps,
+		otherOps
+	};
+}
+/**
+* Replay a list of completed operations against `stateResources` (mutated in
+* place), reverting each. Best-effort: a provider failure is caught, warned,
+* and counted; replay continues.
+*
+* - UPDATE / DELETE first (reverse completion order), then CREATE deletions
+*   in reverse dependency order (dependents deleted before dependencies).
+* - `afterOp` is invoked after each op that MUTATED state (so the command can
+*   persist state incrementally, mirroring `saveStateAfterResource`). The
+*   in-process engine passes no `afterOp` and saves state once at the end.
+* - `isInterrupted` is polled between ops; when it flips true, replay stops
+*   (the pending op is left for a re-run).
+*/
+async function replayRollback(operations, stateResources, stackName, ctx, options = {}) {
+	const orphanLogicalIds = options.orphanLogicalIds ?? /* @__PURE__ */ new Set();
+	const result = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false
+	};
+	if (operations.length === 0) {
+		ctx.logger.info("No completed operations to roll back.");
+		return result;
+	}
+	ctx.logger.info(`Rolling back ${operations.length} completed operation(s)...`);
+	ctx.recordEvent?.({
+		eventType: "ROLLBACK_STARTED",
+		stackName
+	});
+	const { createOps, otherOps } = partitionOps(operations);
+	for (let i = otherOps.length - 1; i >= 0; i--) {
+		if (options.isInterrupted?.()) {
+			result.interrupted = true;
+			break;
+		}
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+	}
+	if (!result.interrupted && createOps.length > 0) {
+		const sorted = sortRollbackCreates(createOps, stateResources);
+		for (const op of sorted) {
+			if (options.isInterrupted?.()) {
+				result.interrupted = true;
+				break;
+			}
+			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+		}
+	}
+	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
+	ctx.recordEvent?.({
+		eventType: "ROLLBACK_FINISHED",
+		stackName
+	});
+	return result;
+}
+async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp) {
+	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
+	const { logger } = ctx;
+	try {
+		switch (action) {
+			case "unrecoverable-delete":
+				logger.warn(`  Rollback: Cannot restore deleted resource ${op.logicalId} (${op.resourceType}) — resource has already been deleted`);
+				result.warnings++;
+				return;
+			case "skip-already-done":
+				logger.debug(`  Rollback: ${op.logicalId} already reverted, skipping`);
+				return;
+			case "skip-mismatch":
+				logger.warn(`  Rollback: Skipping ${op.logicalId} — its physical id changed since the failed deploy (replaced by a later attempt); manual attention may be required`);
+				result.warnings++;
+				return;
+			case "skip-absent":
+				logger.warn(`  Rollback: Cannot restore ${op.logicalId} — resource no longer in state, skipping`);
+				result.warnings++;
+				return;
+			case "orphan-flag":
+				if (op.changeType === "CREATE") {
+					delete stateResources[op.logicalId];
+					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
+					await afterOp?.(op.logicalId);
+				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
+				return;
+			case "orphan-retain":
+				delete stateResources[op.logicalId];
+				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: ${stateResourcesPolicyLabel(op, stateResources)}) — removed from state`);
+				await afterOp?.(op.logicalId);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "CREATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			case "delete": {
+				if (!op.physicalId) {
+					logger.warn(`  Rollback: Cannot delete ${op.logicalId} — no physical ID recorded`);
+					result.warnings++;
+					return;
+				}
+				logger.info(`  Rollback: Deleting created resource ${op.logicalId} (${op.resourceType})`);
+				const { provider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: op.provisionedBy
+				});
+				await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, { expectedRegion: ctx.region });
+				delete stateResources[op.logicalId];
+				logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
+				await afterOp?.(op.logicalId);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "CREATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
+			case "revert": {
+				if (!op.previousState) {
+					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — no previous state available`);
+					result.warnings++;
+					return;
+				}
+				const current = stateResources[op.logicalId];
+				if (!current) {
+					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — resource not found in current state`);
+					result.warnings++;
+					return;
+				}
+				logger.info(`  Rollback: Restoring ${op.logicalId} (${op.resourceType}) to previous state`);
+				const { provider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: op.provisionedBy
+				});
+				await provider.update(op.logicalId, current.physicalId, op.resourceType, op.previousState.properties, current.properties);
+				stateResources[op.logicalId] = op.previousState;
+				logger.info(`  Rollback: ${op.logicalId} restored successfully`);
+				await afterOp?.(op.logicalId);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "UPDATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
+		}
+	} catch (rollbackError) {
+		logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+		logger.warn("  Continuing with remaining rollback operations...");
+		result.failures++;
+		ctx.recordEvent?.({
+			eventType: "ROLLBACK_RESOURCE_FAILED",
+			stackName,
+			operation: op.changeType,
+			logicalId: op.logicalId,
+			resourceType: op.resourceType,
+			...op.provisionedBy && { provisionedBy: op.provisionedBy },
+			error: extractDeploymentEventError(rollbackError)
+		});
+	}
+}
+function stateResourcesPolicyLabel(op, stateResources) {
+	return stateResources[op.logicalId]?.deletionPolicy ?? "Retain";
+}
+/**
+* Sort CREATE rollback operations so that resources depending on others are
+* deleted first (reverse dependency order), using state dependencies. Same
+* algorithm as the pre-extraction `DeployEngine.sortRollbackCreates`.
+*/
+function sortRollbackCreates(createOps, stateResources, logger) {
+	const opMap = /* @__PURE__ */ new Map();
+	const deleteIds = /* @__PURE__ */ new Set();
+	for (const op of createOps) {
+		opMap.set(op.logicalId, op);
+		deleteIds.add(op.logicalId);
+	}
+	const dependedBy = /* @__PURE__ */ new Map();
+	for (const id of deleteIds) if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
+	for (const id of deleteIds) {
+		const resource = stateResources[id];
+		if (!resource?.dependencies) continue;
+		for (const dep of resource.dependencies) {
+			if (!deleteIds.has(dep)) continue;
+			if (!dependedBy.has(dep)) dependedBy.set(dep, /* @__PURE__ */ new Set());
+			dependedBy.get(dep).add(id);
+		}
+	}
+	const sorted = [];
+	let remaining = new Set(deleteIds);
+	while (remaining.size > 0) {
+		const level = [];
+		for (const id of remaining) {
+			const dependents = dependedBy.get(id);
+			if (!(dependents ? [...dependents].some((d) => remaining.has(d)) : false)) level.push(id);
+		}
+		if (level.length === 0) {
+			logger?.warn(`Circular dependency detected in rollback order, processing remaining ${remaining.size} resources`);
+			for (const id of remaining) {
+				const op = opMap.get(id);
+				if (op) sorted.push(op);
+			}
+			break;
+		}
+		for (const id of level) {
+			const op = opMap.get(id);
+			if (op) sorted.push(op);
+		}
+		remaining = new Set([...remaining].filter((id) => !level.includes(id)));
+	}
+	logger?.debug(`Rollback CREATE deletion order: ${sorted.map((op) => op.logicalId).join(" → ")}`);
+	return sorted;
+}
+
+//#endregion
+//#region src/state/deployment-events-store.ts
+/**
+* Deployment-events store (issue #808) — persists the structured
+* deployment events emitted by the deploy engine / destroy runner as
+* JSONL to the state bucket, plus a small per-stack run index:
+*
+* - Events: `{prefix}/{stackName}/{region}/deployments/{runId}.jsonl`
+* - Index:  `{prefix}/{stackName}/{region}/deployments/index.json`
+*
+* Design constraints (all load-bearing):
+*
+* - **Best-effort, never blocking**: `record()` is synchronous and only
+*   buffers in memory; flushes run asynchronously (debounced timer +
+*   size threshold) and are serialized on a write chain. A failed S3
+*   write warns once and degrades to debug-level afterwards — it can
+*   NEVER fail or block the deploy/destroy itself.
+* - **No locking**: each run writes to its own unique `{runId}.jsonl`
+*   key (no concurrent writer by construction). `index.json` is
+*   last-writer-wins — acceptable for a derived view; the `.jsonl`
+*   files are the source of truth and `cdkd events` can read a run
+*   directly by id even if the index lost the race.
+* - **No resource properties** in events — errors + metadata only
+*   (properties may contain secrets and already live in state.json).
+* - **Separate keys from state.json** — no state schema bump; event
+*   files survive `cdkd destroy` (state deletion does not touch
+*   `deployments/`), preserving post-mortem context.
+* - **Bounded growth** (issue #885): `finalize()` prunes `{runId}.jsonl`
+*   streams that fell out of the index window so the `deployments/`
+*   prefix stays bounded; `cdkd events prune` (via
+*   {@link DeploymentEventsReader.pruneRuns}) is the explicit purge.
+*/
+/** Max runs retained in `deployments/index.json` (newest first). */
+const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
+/** Debounce window between buffered events and the async S3 flush. */
+const FLUSH_INTERVAL_MS = 2e3;
+/** Flush immediately once this many events are buffered. */
+const FLUSH_EVENT_THRESHOLD = 50;
+/** Build-time cdkd version, with a dev fallback for non-built contexts. */
+function getCdkdVersion() {
+	return "0.263.0";
+}
+/**
+* Generate a time-sortable unique run id, e.g.
+* `20260613T012345678Z-1a2b3c4d`. The timestamp prefix keeps S3 listings
+* and `cdkd events` output chronologically meaningful; the random suffix
+* guarantees uniqueness across concurrent runs.
+*/
+function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
+	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
+}
+/** S3 key of a run's JSONL event stream. */
+function deploymentEventsKey(prefix, stackName, region, runId) {
+	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
+}
+/** S3 key of a stack's run index. */
+function deploymentEventsIndexKey(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+}
+/** S3 key prefix under which a stack's `deployments/` artifacts live. */
+function deploymentsDirPrefix(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/`;
+}
+/**
+* Parse the wall-clock time encoded in a run id's leading timestamp
+* (e.g. `20260613T012345678Z-1a2b3c4d`) back to epoch milliseconds.
+* Returns `null` for any id that does not start with the canonical
+* compact-ISO prefix — the age-based pruner treats an unparseable id as
+* "do not delete on age grounds", which is the safe direction.
+*/
+function runIdTimestampMs(runId) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
+	if (!m) return null;
+	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
+	const ms = Date.parse(iso);
+	return Number.isNaN(ms) ? null : ms;
+}
+/** Extract the `{runId}` from a `.../{runId}.jsonl` event-stream key. */
+function runIdFromJsonlKey(key, dirPrefix) {
+	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
+	return key.slice(dirPrefix.length, -6);
+}
+/**
+* Buffering JSONL writer for one deployment run. Implements the
+* {@link DeploymentEventRecorder} seam the deploy engine / destroy
+* runner emit through.
+*/
+var DeploymentEventsStore = class {
+	logger = getLogger().child("DeploymentEvents");
+	backend;
+	stackName;
+	region;
+	command;
+	runId;
+	cdkdVersion;
+	startedAt;
+	/** All events recorded so far (the full JSONL body is re-PUT per flush —
+	* S3 has no append, and metadata-only events are small). */
+	events = [];
+	/** Number of events already persisted by the last successful flush. */
+	persistedCount = 0;
+	flushTimer;
+	/** Serializes S3 writes so flushes never interleave. */
+	writeChain = Promise.resolve();
+	warnedOnce = false;
+	finalized = false;
+	constructor(backend, options) {
+		this.backend = backend;
+		this.stackName = options.stackName;
+		this.region = options.region;
+		this.command = options.command;
+		this.runId = options.runId ?? newDeploymentRunId();
+		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	}
+	/**
+	* Buffer one event (synchronous, never throws). The timestamp is
+	* stamped here so emitters don't need to.
+	*/
+	record(event) {
+		try {
+			if (this.finalized) return;
+			this.events.push({
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...event
+			});
+			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
+			else this.scheduleFlush(FLUSH_INTERVAL_MS);
+		} catch {}
+	}
+	/**
+	* Final flush + index update. Called by the owner (deploy CLI per-stack
+	* finally / destroy runner finally) after the run reaches a terminal
+	* state. Best-effort: never throws.
+	*/
+	async finalize(result) {
+		if (this.finalized) return;
+		this.finalized = true;
+		if (this.flushTimer) {
+			clearTimeout(this.flushTimer);
+			this.flushTimer = void 0;
+		}
+		if (this.events.length === 0) return;
+		await this.enqueueWrite(async () => {
+			await this.doFlush();
+			const keptRunIds = await this.updateIndex(result);
+			await this.pruneSupersededRunFiles(keptRunIds);
+		});
+	}
+	/** Await any in-flight async flushes (used by tests). */
+	async drain() {
+		await this.writeChain;
+	}
+	scheduleFlush(delayMs) {
+		if (this.flushTimer) {
+			if (delayMs > 0) return;
+			clearTimeout(this.flushTimer);
+		}
+		this.flushTimer = setTimeout(() => {
+			this.flushTimer = void 0;
+			this.enqueueWrite(() => this.doFlush());
+		}, delayMs);
+		this.flushTimer.unref?.();
+	}
+	enqueueWrite(op) {
+		const next = this.writeChain.then(op).catch((err) => {
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${err instanceof Error ? err.message : String(err)}`);
+		});
+		this.writeChain = next;
+		return next;
+	}
+	async doFlush() {
+		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
+		const snapshotCount = this.events.length;
+		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
+		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
+		this.persistedCount = snapshotCount;
+	}
+	/**
+	* Prepend this run's summary to `deployments/index.json`, truncated to
+	* the last {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs. Read-modify-
+	* write WITHOUT optimistic locking — last-writer-wins (documented
+	* trade-off; the per-run `.jsonl` files are the source of truth).
+	*
+	* Returns the run ids retained in the index (newest-first), which the
+	* caller feeds to {@link pruneSupersededRunFiles} so the `.jsonl` files
+	* stay bounded to the same window as the index.
+	*/
+	async updateIndex(result) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		let existingRuns = [];
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) existingRuns = parsed.runs;
+			}
+		} catch (err) {
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		const runs = [{
+			runId: this.runId,
+			command: this.command,
+			cdkdVersion: this.cdkdVersion,
+			startedAt: this.startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			result,
+			eventCount: this.persistedCount
+		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
+		const file = {
+			indexVersion: 1,
+			stackName: this.stackName,
+			region: this.region,
+			runs,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		return runs.map((r) => r.runId);
+	}
+	/**
+	* Self-bounding prune (issue #885): delete `{runId}.jsonl` streams that
+	* have fallen out of the index window so the `deployments/` prefix does
+	* not grow without bound. Best-effort — runs inside the same write-chain
+	* link as the flush + index write, so a failure here is caught + warned
+	* once by {@link enqueueWrite} and never blocks the deploy / destroy.
+	*
+	* Concurrency-tolerant by construction: the cutoff is the OLDEST retained
+	* run id, and only `.jsonl` files strictly below it are deleted. Run ids
+	* are time-sortable, so a concurrent NEWER run's id sorts ABOVE every
+	* retained id and is never touched. A concurrent run that STARTED earlier
+	* but is still writing could in theory fall below the cutoff if 20+ newer
+	* runs finalized while it ran — an extreme edge that self-heals anyway,
+	* since the whole JSONL body is re-PUT on that run's next flush / finalize
+	* (S3 has no append; each flush rewrites the full stream).
+	*/
+	async pruneSupersededRunFiles(keptRunIds) {
+		if (keptRunIds.length < 20) return;
+		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const stale = (await this.backend.listRawKeys(dirPrefix)).filter((k) => {
+			const runId = runIdFromJsonlKey(k, dirPrefix);
+			return runId !== null && runId < cutoff;
+		});
+		if (stale.length === 0) return;
+		await this.backend.deleteRawObjects(stale);
+		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
+	}
+	warnOnce(message) {
+		if (this.warnedOnce) {
+			this.logger.debug(message);
+			return;
+		}
+		this.warnedOnce = true;
+		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
+	}
+};
+/**
+* Read side for `cdkd events`: discovers regions / runs / event streams
+* under `{prefix}/{stackName}/{region}/deployments/`. Region discovery
+* deliberately does NOT rely on state.json — event files survive
+* `cdkd destroy`, so a destroyed stack's runs stay readable.
+*/
+var DeploymentEventsReader = class {
+	backend;
+	constructor(backend) {
+		this.backend = backend;
+	}
+	/**
+	* Regions that have a `deployments/` index or event stream for the
+	* stack. Derived from the raw key listing under `{prefix}/{stackName}/`.
+	*/
+	async listRegions(stackName) {
+		const prefix = `${this.backend.prefix}/${stackName}/`;
+		const keys = await this.backend.listRawKeys(prefix);
+		const regions = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			const segments = key.slice(prefix.length).split("/");
+			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
+		}
+		return [...regions].sort();
+	}
+	/**
+	* Run summaries for `(stackName, region)`, newest first. Returns the
+	* index file's `runs` (already newest-first); when the index is missing
+	* or unreadable, falls back to enumerating `{runId}.jsonl` keys (sorted
+	* descending — runIds are time-prefixed).
+	*
+	* In the fallback path the run's terminal result / command / version are
+	* NOT known from the key alone, so each run's JSONL is read and its last
+	* `RUN_FINISHED` (+ first `RUN_STARTED`) event mined for the true result,
+	* command, version, and timestamps. A run whose JSONL has no terminal
+	* `RUN_FINISHED` (interrupted run, or one whose index write lost the
+	* race) is reported as `'UNKNOWN'` — it is NEVER fabricated as `'FAILED'`,
+	* which would mislabel a successful run that merely failed to update the
+	* derived index.
+	*/
+	async listRuns(stackName, region) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch {}
+		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
+		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
+		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
+	}
+	/**
+	* Reconstruct a {@link DeploymentRunSummary} for the index-fallback path
+	* by reading the run's JSONL. Derives the true result from the last
+	* `RUN_FINISHED` event; absent that, returns `'UNKNOWN'` rather than
+	* fabricating a definitive failure.
+	*/
+	async summarizeRunFromJsonl(stackName, region, runId) {
+		const fallback = {
+			runId,
+			command: "deploy",
+			cdkdVersion: "unknown",
+			startedAt: "",
+			finishedAt: "",
+			result: "UNKNOWN",
+			eventCount: 0
+		};
+		let events = null;
+		try {
+			events = await this.readRunEvents(stackName, region, runId);
+		} catch {
+			return fallback;
+		}
+		if (events === null || events.length === 0) return fallback;
+		const started = events.find((e) => e.eventType === "RUN_STARTED");
+		let finished;
+		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
+		return {
+			runId,
+			command: started?.command ?? fallback.command,
+			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
+			startedAt: started?.timestamp ?? fallback.startedAt,
+			finishedAt: finished?.timestamp ?? fallback.finishedAt,
+			result: finished?.result ?? "UNKNOWN",
+			eventCount: events.length
+		};
+	}
+	/**
+	* Parse one run's JSONL event stream. Returns `null` when the run file
+	* does not exist. Malformed lines are skipped (a torn final line from
+	* an interrupted flush must not hide the rest of the stream).
+	*/
+	async readRunEvents(stackName, region, runId) {
+		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
+		const raw = await this.backend.getRawObject(key);
+		if (raw === null) return null;
+		const events = [];
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			try {
+				events.push(JSON.parse(trimmed));
+			} catch {}
+		}
+		return events;
+	}
+	/**
+	* Prune a stack's recorded deployment-event runs (issue #885 — `cdkd
+	* events prune`). Deletes `{runId}.jsonl` streams beyond a retention
+	* window and rewrites (or removes) `index.json` to match.
+	*
+	* Retention semantics (see {@link DeploymentEventsPruneOptions}):
+	*   - `all`        — delete every run + the index (full purge).
+	*   - `keep N`     — retain the newest N runs, delete the rest.
+	*   - `olderThanMs`— delete runs whose run-id timestamp is older than the
+	*                    cutoff; a run id with no parseable timestamp is kept.
+	*   - `keep` + `olderThanMs` — a run is deleted only when it is BOTH
+	*                    beyond the newest-N window AND older than the cutoff
+	*                    (the most conservative combination).
+	*   - none of the above — defaults to `keep DEPLOYMENT_EVENTS_MAX_INDEX_RUNS`
+	*                    (matches the index window the writer self-bounds to).
+	*
+	* Unlike the writer's best-effort auto-prune, this is user-initiated and
+	* surfaces errors to the caller (the command reports / exits non-zero).
+	*/
+	async pruneRuns(stackName, region, opts = {}) {
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
+		const runIdsDesc = (await this.backend.listRawKeys(dirPrefix)).map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
+		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		if (opts.all === true) {
+			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+			await this.backend.deleteRawObjects([...toDelete, indexKey]);
+			return {
+				deletedRunIds: runIdsDesc,
+				remainingRunIds: [],
+				indexDeleted: true
+			};
+		}
+		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
+		const keep = opts.keep ?? (noGuards ? 20 : void 0);
+		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
+		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
+		if (opts.olderThanMs !== void 0) {
+			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
+			candidates = candidates.filter((id) => {
+				const t = runIdTimestampMs(id);
+				return t !== null && t < cutoff;
+			});
+		}
+		if (candidates.length === 0) return {
+			deletedRunIds: [],
+			remainingRunIds: runIdsDesc,
+			indexDeleted: false
+		};
+		const deletedSet = new Set(candidates);
+		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
+		const indexDeleted = await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet, remainingRunIds.length === 0);
+		await this.backend.deleteRawObjects(deleteKeys);
+		return {
+			deletedRunIds: candidates,
+			remainingRunIds,
+			indexDeleted
+		};
+	}
+	/**
+	* Drop the pruned run ids from `index.json`, or delete the index entirely
+	* when no `.jsonl` streams remain. A corrupt / unreadable index is left
+	* untouched (the `.jsonl` files are the source of truth; `cdkd events`
+	* falls back to key enumeration). Returns whether the index was deleted.
+	*/
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds, noRunsRemain) {
+		if (noRunsRemain) {
+			await this.backend.deleteRawObjects([indexKey]);
+			return true;
+		}
+		let raw;
+		try {
+			raw = await this.backend.getRawObject(indexKey);
+		} catch {
+			return false;
+		}
+		if (raw === null) return false;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			return false;
+		}
+		if (!Array.isArray(parsed.runs)) return false;
+		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
+		if (remaining.length === parsed.runs.length) return false;
+		const file = {
+			indexVersion: 1,
+			stackName,
+			region,
+			runs: remaining,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
+		return false;
+	}
+};
+
 //#endregion
 //#region src/deployment/deploy-engine.ts
 /**
@@ -16690,6 +17566,10 @@ var DeployEngine = class {
 			const currentEtag = currentStateData?.etag;
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
+			try {
+				const journal = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
+				if (journal && journal.segments.length > 0) this.logger.info(`A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
+			} catch {}
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
 			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters);
@@ -16795,6 +17675,7 @@ var DeployEngine = class {
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
+			await this.deleteRollbackJournalBestEffort(stackName);
 			if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, newState.outputs ?? {});
 			const durationMs = Date.now() - startTime;
 			const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
@@ -16955,6 +17836,7 @@ var DeployEngine = class {
 				if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 			}
 		} catch (error) {
+			const initialDeploy = currentEtag === void 0;
 			try {
 				const preRollbackState = {
 					version: 8,
@@ -16977,14 +17859,20 @@ var DeployEngine = class {
 			} catch (saveError) {
 				this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 			}
+			let autoRollbackClean = false;
 			if (error instanceof InterruptedError) {
-				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, or destroy to clean up.`);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, "interrupted", initialDeploy);
+				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
 				throw error;
 			}
 			if (this.options.noRollback) {
+				await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", initialDeploy);
 				this.logger.warn("Deployment failed. --no-rollback is set, skipping rollback.");
-				this.logger.warn("Partial state has been saved. Manual cleanup may be required.");
-			} else await this.performRollback(completedOperations, newResources, stackName);
+				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
+			} else {
+				await this.writeRollbackJournalSegment(stackName, completedOperations, "auto-rollback-started", initialDeploy);
+				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName)).failures === 0;
+			}
 			try {
 				const postRollbackState = {
 					version: 8,
@@ -16998,6 +17886,7 @@ var DeployEngine = class {
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
 				this.logger.debug("State saved after deployment failure");
+				if (autoRollbackClean) await this.deleteRollbackJournalBestEffort(stackName);
 			} catch (saveError) {
 				this.logger.debug(`Retrying state save after rollback (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 				try {
@@ -17014,6 +17903,7 @@ var DeployEngine = class {
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 					this.logger.debug("State saved after deployment failure (retry succeeded)");
+					if (autoRollbackClean) await this.deleteRollbackJournalBestEffort(stackName);
 				} catch (retryError) {
 					this.logger.warn(`Failed to save state after rollback: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
 				}
@@ -17025,6 +17915,7 @@ var DeployEngine = class {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
+			await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", currentEtag === void 0);
 			throw outputError;
 		}
 		return {
@@ -17094,169 +17985,62 @@ var DeployEngine = class {
 		}
 	}
 	/**
-	* Perform best-effort rollback of completed operations respecting dependencies
-	*
-	* - CREATE → delete the newly created resource (in reverse dependency order)
-	* - UPDATE → update back to previous properties
-	* - DELETE → cannot rollback (resource already deleted), log warning
-	*
-	* Resources completed concurrently in the dispatcher may have dependencies
-	* between them (e.g., IAM Policy depends on IAM Role). When rolling back
-	* CREATEs (deleting), dependent resources must be deleted before their
-	* dependencies. This method sorts CREATE rollback operations using dependency
-	* information from state, then processes UPDATE/DELETE rollbacks, and finally
-	* processes sorted CREATE rollback deletions.
+	* Perform best-effort rollback of completed operations (issue #1183:
+	* extracted into `rollback-executor.ts` so the standalone `cdkd rollback`
+	* command drives identical semantics). Thin wrapper that builds the
+	* executor context from the engine's collaborators and delegates.
 	*/
 	async performRollback(completedOperations, stateResources, stackName) {
-		if (completedOperations.length === 0) {
-			this.logger.info("No completed operations to roll back.");
-			return;
-		}
-		this.logger.info(`Rolling back ${completedOperations.length} completed operation(s)...`);
-		this.recordEvent({
-			eventType: "ROLLBACK_STARTED",
-			stackName
-		});
-		const createOps = [];
-		const otherOps = [];
-		for (const op of completedOperations) if (op.changeType === "CREATE") createOps.push(op);
-		else otherOps.push(op);
-		for (let i = otherOps.length - 1; i >= 0; i--) {
-			const op = otherOps[i];
-			await this.performSingleRollback(op, stateResources, stackName);
-		}
-		if (createOps.length > 0) {
-			const sortedCreateOps = this.sortRollbackCreates(createOps, stateResources);
-			for (const op of sortedCreateOps) await this.performSingleRollback(op, stateResources, stackName);
-		}
-		this.logger.info("Rollback completed. Some resources may remain if deletion failed.");
-		this.recordEvent({
-			eventType: "ROLLBACK_FINISHED",
-			stackName
-		});
+		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext());
+		return {
+			failures: result.failures,
+			warnings: result.warnings
+		};
 	}
 	/**
-	* Sort CREATE rollback operations so that resources depending on others
-	* are deleted first (reverse dependency order).
-	*
-	* Uses state dependencies to determine reverse-dependency order, similar to buildDeletionDependencies.
+	* Best-effort rollback-journal deletion (issue #1183) used on the deploy
+	* success path and after a clean automatic rollback. Never throws — a
+	* failed delete only warns (the journal is advisory; the worst case is a
+	* spurious "previous deploy failed" note on the next deploy).
 	*/
-	sortRollbackCreates(createOps, stateResources) {
-		const opMap = /* @__PURE__ */ new Map();
-		const deleteIds = /* @__PURE__ */ new Set();
-		for (const op of createOps) {
-			opMap.set(op.logicalId, op);
-			deleteIds.add(op.logicalId);
-		}
-		const dependedBy = /* @__PURE__ */ new Map();
-		for (const id of deleteIds) if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
-		for (const id of deleteIds) {
-			const resource = stateResources[id];
-			if (!resource?.dependencies) continue;
-			for (const dep of resource.dependencies) {
-				if (!deleteIds.has(dep)) continue;
-				if (!dependedBy.has(dep)) dependedBy.set(dep, /* @__PURE__ */ new Set());
-				dependedBy.get(dep).add(id);
-			}
-		}
-		const sorted = [];
-		let remaining = new Set(deleteIds);
-		while (remaining.size > 0) {
-			const level = [];
-			for (const id of remaining) {
-				const dependents = dependedBy.get(id);
-				if (!(dependents ? [...dependents].some((d) => remaining.has(d)) : false)) level.push(id);
-			}
-			if (level.length === 0) {
-				this.logger.warn(`Circular dependency detected in rollback order, processing remaining ${remaining.size} resources`);
-				for (const id of remaining) {
-					const op = opMap.get(id);
-					if (op) sorted.push(op);
-				}
-				break;
-			}
-			for (const id of level) {
-				const op = opMap.get(id);
-				if (op) sorted.push(op);
-			}
-			remaining = new Set([...remaining].filter((id) => !level.includes(id)));
+	async deleteRollbackJournalBestEffort(stackName) {
+		try {
+			await this.stateBackend.deleteRollbackJournal(stackName, this.stackRegion);
+		} catch (err) {
+			this.logger.debug(`Failed to delete rollback journal for ${stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		}
-		this.logger.debug(`Rollback CREATE deletion order: ${sorted.map((op) => op.logicalId).join(" → ")}`);
-		return sorted;
+	}
+	/** Build the {@link RollbackExecutorContext} from the engine's fields. */
+	rollbackExecutorContext() {
+		return {
+			providerRegistry: this.providerRegistry,
+			region: this.stackRegion,
+			logger: this.logger,
+			recordEvent: (event) => this.recordEvent(event)
+		};
 	}
 	/**
-	* Perform a single rollback operation (extracted for reuse)
+	* Record one rollback-journal segment (issue #1183) so the failed /
+	* interrupted / about-to-auto-rollback deploy can be reverted later by
+	* `cdkd rollback`. Best-effort like the partial-state save, but warns
+	* LOUDLY on failure — the user just lost the ability to `cdkd rollback`.
 	*/
-	async performSingleRollback(op, stateResources, stackName) {
+	async writeRollbackJournalSegment(stackName, completedOperations, reason, initialDeploy) {
+		if (completedOperations.length === 0) return;
 		try {
-			switch (op.changeType) {
-				case "CREATE": {
-					if (!op.physicalId) {
-						this.logger.warn(`  Rollback: Cannot delete ${op.logicalId} — no physical ID recorded`);
-						break;
-					}
-					this.logger.info(`  Rollback: Deleting created resource ${op.logicalId} (${op.resourceType})`);
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: op.resourceType,
-						provisionedBy: op.provisionedBy
-					});
-					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, { expectedRegion: this.stackRegion });
-					delete stateResources[op.logicalId];
-					this.logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
-					this.recordEvent({
-						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
-						stackName,
-						operation: "CREATE",
-						logicalId: op.logicalId,
-						resourceType: op.resourceType,
-						...op.provisionedBy && { provisionedBy: op.provisionedBy }
-					});
-					break;
-				}
-				case "UPDATE": {
-					if (!op.previousState) {
-						this.logger.warn(`  Rollback: Cannot restore ${op.logicalId} — no previous state available`);
-						break;
-					}
-					this.logger.info(`  Rollback: Restoring ${op.logicalId} (${op.resourceType}) to previous state`);
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: op.resourceType,
-						provisionedBy: op.provisionedBy
-					});
-					const currentResource = stateResources[op.logicalId];
-					if (!currentResource) {
-						this.logger.warn(`  Rollback: Cannot restore ${op.logicalId} — resource not found in current state`);
-						break;
-					}
-					await provider.update(op.logicalId, currentResource.physicalId, op.resourceType, op.previousState.properties, currentResource.properties);
-					stateResources[op.logicalId] = op.previousState;
-					this.logger.info(`  Rollback: ${op.logicalId} restored successfully`);
-					this.recordEvent({
-						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
-						stackName,
-						operation: "UPDATE",
-						logicalId: op.logicalId,
-						resourceType: op.resourceType,
-						...op.provisionedBy && { provisionedBy: op.provisionedBy }
-					});
-					break;
-				}
-				case "DELETE":
-					this.logger.warn(`  Rollback: Cannot restore deleted resource ${op.logicalId} (${op.resourceType}) — resource has already been deleted`);
-					break;
-			}
-		} catch (rollbackError) {
-			this.logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-			this.logger.warn("  Continuing with remaining rollback operations...");
-			this.recordEvent({
-				eventType: "ROLLBACK_RESOURCE_FAILED",
-				stackName,
-				operation: op.changeType,
-				logicalId: op.logicalId,
-				resourceType: op.resourceType,
-				...op.provisionedBy && { provisionedBy: op.provisionedBy },
-				error: extractDeploymentEventError(rollbackError)
-			});
+			const segment = {
+				...this.options.eventRecorder?.runId !== void 0 && { runId: this.options.eventRecorder.runId },
+				timestamp: Date.now(),
+				reason,
+				initialDeploy,
+				...this.options.roleArn && { roleArn: this.options.roleArn },
+				cdkdVersion: getCdkdVersion(),
+				operations: completedOperations
+			};
+			await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
+			this.logger.debug(`Rollback journal segment written (${reason})`);
+		} catch (journalError) {
+			this.logger.warn(`Failed to write rollback journal: ${journalError instanceof Error ? journalError.message : String(journalError)}. 'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
 		}
 	}
 	/**
@@ -17861,5 +18645,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { getBootstrapMarkerKey as $, formatError as $t, refStateLookupFromResource as A, resolveBucketRegion as At, S3StateBackend as B, LocalMigrateError as Bt, findActionableSilentDrops as C, CFN_TEMPLATE_URL_LIMIT as Ct, isTerminationProtectionPropagationError as D, expectedOwnerParam as Dt, disableInstanceApiTermination as E, uploadCfnTemplate as Et, applyRoleArnIfSet as F, AssetError as Ft, WorkGraph as G, PartialFailureError as Gt, shouldRetainResource as H, LockError as Ht, DiffCalculator as I, CdkdError as It, loadPublishableAssetManifest as J, ResourceUpdateNotSupportedError as Jt, buildAssetRedirectMap as K, ProvisioningError as Kt, DagBuilder as L, ConfigError as Lt, normalizeAwsTagsToCfn as M, getAwsClients as Mt, resolveExplicitPhysicalId as N, resetAwsClients as Nt, IntrinsicFunctionResolver as O, AssemblyReader as Ot, assertRegionMatch as P, setAwsClients as Pt, ensureAssetStorage as Q, SynthesisError as Qt, TemplateParser as R, DependencyError as Rt, ProviderRegistry as S, CFN_TEMPLATE_BODY_LIMIT as St, slowCcOperationTimeoutMs as T, findLargeInlineResources as Tt, AssetPublisher as U, MissingCdkCliError as Ut, rebuildClientForBucketRegion as V, LocalStartServiceError as Vt, stringifyValue as W, NestedStackChildDirectDestroyError as Wt, AssetModeResolver as X, StackTerminationProtectionError as Xt, rewriteTemplateAssetReferences as Y, StackHasActiveImportsError as Yt, BOOTSTRAP_MARKER_PREFIX as Z, StateError as Zt, green as _, resolveSkipPrefix as _t, withRetry as a, getDockerCmd as at, IAMRoleProvider as b, resolveUseCdkBootstrapAssets as bt, computeImplicitDeleteEdges as c, AssetManifestLoader as ct, isStatefulRecreateTargetSync as d, synthesisStatusMessage as dt, isCdkdError as en, parseBootstrapMarker as et, renderStatefulReason as f, getDefaultStateBucketName as ft, gray as g, resolveCaptureObservedState as gt, cyan as h, resolveAutoAssetStorage as ht, withResourceDeadline as i, formatDockerLoginError as it, WAFv2WebACLProvider as j, AwsClients as jt, cfnRefValueFromPhysicalId as k, clearBucketRegionCache as kt, extractDeploymentEventError as l, getDockerImageBySourceHash as lt, bold as m, resolveApp as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as nn, validateContainerRepoName as nt, isRetryableTransientError as o, runDockerForeground as ot, formatResourceLine as p, getLegacyStateBucketName as pt, createAssetRedirectResolver as q, ResourceTimeoutError as qt, DeployEngine as r, __exportAll as rn, buildDockerImage as rt, IMPLICIT_DELETE_DEPENDENCIES as s, runDockerStreaming as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as tn, validateAssetBucketName as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, Synthesizer as ut, red as v, resolveStateBucketWithDefault as vt, CloudControlProvider as w, MIGRATE_TMP_PREFIX as wt, collectInlinePolicyNamesManagedBySiblings as x, warnDeprecatedNoPrefixCliFlag as xt, yellow as y, resolveStateBucketWithDefaultAndSource as yt, LockManager as z, LocalInvokeBuildError as zt };
-//# sourceMappingURL=deploy-engine-CtpGfN3E.js.map
+export { rewriteTemplateAssetReferences as $, StackHasActiveImportsError as $t, disableInstanceApiTermination as A, uploadCfnTemplate as At, DiffCalculator as B, CdkdError as Bt, yellow as C, resolveStateBucketWithDefaultAndSource as Ct, findActionableSilentDrops as D, CFN_TEMPLATE_URL_LIMIT as Dt, ProviderRegistry as E, CFN_TEMPLATE_BODY_LIMIT as Et, WAFv2WebACLProvider as F, AwsClients as Ft, rebuildClientForBucketRegion as G, LocalStartServiceError as Gt, TemplateParser as H, DependencyError as Ht, normalizeAwsTagsToCfn as I, getAwsClients as It, stringifyValue as J, NestedStackChildDirectDestroyError as Jt, shouldRetainResource as K, LockError as Kt, resolveExplicitPhysicalId as L, resetAwsClients as Lt, IntrinsicFunctionResolver as M, AssemblyReader as Mt, cfnRefValueFromPhysicalId as N, clearBucketRegionCache as Nt, CloudControlProvider as O, MIGRATE_TMP_PREFIX as Ot, refStateLookupFromResource as P, resolveBucketRegion as Pt, loadPublishableAssetManifest as Q, ResourceUpdateNotSupportedError as Qt, assertRegionMatch as R, setAwsClients as Rt, red as S, resolveStateBucketWithDefault as St, collectInlinePolicyNamesManagedBySiblings as T, warnDeprecatedNoPrefixCliFlag as Tt, LockManager as U, LocalInvokeBuildError as Ut, DagBuilder as V, ConfigError as Vt, S3StateBackend as W, LocalMigrateError as Wt, buildAssetRedirectMap as X, ProvisioningError as Xt, WorkGraph as Y, PartialFailureError as Yt, createAssetRedirectResolver as Z, ResourceTimeoutError as Zt, formatResourceLine as _, getLegacyStateBucketName as _t, DeploymentEventsStore as a, normalizeAwsError as an, validateAssetBucketName as at, gray as b, resolveCaptureObservedState as bt, withResourceDeadline as c, formatDockerLoginError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, runDockerStreaming as dt, StackTerminationProtectionError as en, AssetModeResolver as et, computeImplicitDeleteEdges as f, AssetManifestLoader as ft, renderStatefulReason as g, getDefaultStateBucketName as gt, isStatefulRecreateTargetSync as h, synthesisStatusMessage as ht, DeploymentEventsReader as i, isCdkdError as in, parseBootstrapMarker as it, isTerminationProtectionPropagationError as j, expectedOwnerParam as jt, slowCcOperationTimeoutMs as k, findLargeInlineResources as kt, withRetry as l, getDockerCmd as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, Synthesizer as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as nn, ensureAssetStorage as nt, planRollback as o, withErrorHandling as on, validateContainerRepoName as ot, extractDeploymentEventError as p, getDockerImageBySourceHash as pt, AssetPublisher as q, MissingCdkCliError as qt, DeployEngine as r, formatError as rn, getBootstrapMarkerKey as rt, replayRollback as s, __exportAll as sn, buildDockerImage as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as tn, BOOTSTRAP_MARKER_PREFIX as tt, isRetryableTransientError as u, runDockerForeground as ut, bold as v, resolveApp as vt, IAMRoleProvider as w, resolveUseCdkBootstrapAssets as wt, green as x, resolveSkipPrefix as xt, cyan as y, resolveAutoAssetStorage as yt, applyRoleArnIfSet as z, AssetError as zt };
+//# sourceMappingURL=deploy-engine-BbNhlr7X.js.map