@go-to-k/cdkd 0.263.1 → 0.264.0

package/dist/{deploy-engine-MdcxM5WC.js → deploy-engine-hlS6y_-0.js}

@@ -5821,6 +5821,26 @@ var S3StateBackend = class {
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
 	/**
+	* Replace the `failedOperations` list on the NEWEST journal segment
+	* (issue #1198) with the ops STILL pending after a `--revert-failed`
+	* replay — an empty list removes the field. Called right after the
+	* failed-op replay, BEFORE the segment's completed ops replay, so a later
+	* completed-op failure that keeps the segment for a re-run does not
+	* re-issue the already-applied failed-op reverts (the journal's
+	* `attemptedProperties` would generate a patch undoing changes that are no
+	* longer present, which can fail on patch-based providers). Per-op — a
+	* partially-successful replay strips only the handled ops. No-op when the
+	* journal / segment / field is absent.
+	*/
+	async setRollbackJournalFailedOperations(stackName, region, remaining) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		const newest = journal?.segments[journal.segments.length - 1];
+		if (!journal || !newest || !newest.failedOperations) return;
+		if (remaining.length === 0) delete newest.failedOperations;
+		else newest.failedOperations = remaining;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+	}
+	/**
 	* Pop the newest segment off the stack's rollback journal after it has
 	* been fully replayed. When the last segment is removed, the journal
 	* object is deleted entirely. Returns the number of segments remaining.
@@ -11240,7 +11260,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DgyaW_9Q.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B5N9p1vq.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -11902,6 +11922,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 	responseBucket;
 	responsePrefix;
 	/**
+	* Memoization for the lazy response-bucket region correction
+	* (`ensureResponseClient`). Mirrors the `clientResolved` /
+	* `resolveInFlight` pattern of the three other state-bucket S3
+	* consumers (S3StateBackend / LockManager / ExportIndexStore), plus a
+	* generation counter: `setResponseBucket` bumps it so a probe that was
+	* still in flight when the bucket was re-set cannot commit its stale
+	* client / resolved flag against the new bucket.
+	*/
+	responseClientResolved = false;
+	responseClientResolveInFlight = null;
+	responseClientGeneration = 0;
+	/**
+	* Whether `this.s3Client` is a provider-OWNED client (built from the
+	* `setResponseBucket` region hint or by a region-correction rebuild)
+	* vs the shared `AwsClients.s3` instance from the constructor. Owned
+	* clients are `destroy()`ed when replaced; the shared one never is.
+	*/
+	ownsS3Client = false;
+	/**
 	* Opt out of the deploy engine's outer transient-error retry loop.
 	*
 	* The loop re-invokes `provider.create()` from the top on a transient
@@ -11981,7 +12020,67 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*/
 	setResponseBucket(bucket, bucketRegion) {
 		this.responseBucket = bucket;
-		if (bucketRegion) this.s3Client = new S3Client(bucketRegion ? { region: bucketRegion } : {});
+		if (bucketRegion) this.replaceS3Client(new S3Client({ region: bucketRegion }));
+		this.responseClientGeneration++;
+		this.responseClientResolved = false;
+		this.responseClientResolveInFlight = null;
+	}
+	/**
+	* Swap `this.s3Client`, destroying the previous client when the
+	* provider owned it (never the shared `AwsClients.s3` instance).
+	* The optional call tolerates test doubles without a `destroy`.
+	*/
+	replaceS3Client(replacement) {
+		if (this.ownsS3Client) this.s3Client.destroy?.();
+		this.s3Client = replacement;
+		this.ownsS3Client = true;
+	}
+	/**
+	* Resolve the response bucket's actual region and, if it differs from the
+	* current S3 client's configured region, swap in a region-corrected client
+	* before any response-bucket S3 operation (placeholder `PutObject`,
+	* pre-signed `ResponseURL` signing, response polling, cleanup).
+	*
+	* The response bucket is cdkd's state bucket, which can live in a
+	* different region from the deploy region (`cdkd deploy --region` /
+	* `AWS_REGION` against the account-scoped region-free default bucket).
+	* A pre-signed URL's host is region-specific, so signing with the deploy
+	* region against a foreign-region bucket makes S3 return a
+	* 301 PermanentRedirect (issue #1195). Mirrors the lazy
+	* `ensureClientForBucket()` correction the state backend (#60), the
+	* LockManager (#803), and the ExportIndexStore (#819) already do via the
+	* shared `rebuildClientForBucketRegion` helper (#827).
+	*
+	* `tolerateNonStandardClient` keeps test doubles (a bare `{ send }`
+	* object from a mocked `getAwsClients`) on the no-rebuild path, and
+	* `resolveBucketRegion` never throws (probe failures degrade to
+	* "no rebuild"), so this can only improve the client's region.
+	*/
+	async ensureResponseClient() {
+		if (this.responseClientResolved || !this.responseBucket) return;
+		if (this.responseClientResolveInFlight) return this.responseClientResolveInFlight;
+		const bucket = this.responseBucket;
+		const generation = this.responseClientGeneration;
+		this.responseClientResolveInFlight = (async () => {
+			try {
+				const replacement = await rebuildClientForBucketRegion(this.s3Client, bucket, {
+					reuseClientCredentials: true,
+					tolerateNonStandardClient: true,
+					onRebuild: ({ bucketRegion, currentRegion }) => {
+						this.logger.debug(`Custom resource response bucket '${bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); building a region-corrected S3 client for response operations.`);
+					}
+				});
+				if (generation !== this.responseClientGeneration) {
+					replacement?.destroy?.();
+					return;
+				}
+				if (replacement) this.replaceS3Client(replacement);
+				this.responseClientResolved = true;
+			} finally {
+				if (generation === this.responseClientGeneration) this.responseClientResolveInFlight = null;
+			}
+		})();
+		return this.responseClientResolveInFlight;
 	}
 	/**
 	* Create a custom resource by invoking its Lambda handler
@@ -12354,6 +12453,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*/
 	async generateResponseURL(responseKey) {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
+		await this.ensureResponseClient();
 		await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.responseBucket,
 			Key: responseKey,
@@ -16452,12 +16552,42 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 	}
 	const current = stateResources[op.logicalId];
 	if (!current) return "skip-absent";
-	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) {
-		if (!replacement) return "skip-already-done";
+	if (replacement) {
+		if (current.physicalId === op.previousState.physicalId) return "skip-already-done";
+		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
+			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
+			return "skip-mismatch";
+		}
+		return op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
+	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
 }
 /**
+* Classify what reverting a FAILED in-flight op (issue #1198) will do
+* against the current state, without touching AWS. Pure — used by both the
+* command's `--revert-failed` plan preview and {@link replayFailedOperations}.
+*/
+function classifyFailedOp(op, stateResources) {
+	if (op.changeType === "DELETE") return "skip-failed-noop";
+	const current = stateResources[op.logicalId];
+	if (op.changeType === "CREATE") {
+		if (op.physicalId === void 0) return "skip-failed-unknown";
+		if (!current) return "skip-failed-noop";
+		if (current.physicalId !== op.physicalId) return "skip-failed-noop";
+		return "delete-failed-create";
+	}
+	if (!current || !op.previousState) return "skip-failed-absent";
+	return "revert-failed-update";
+}
+/** Build the plan items for a segment's failed ops (issue #1198). */
+function planFailedOps(failedOps, stateResources) {
+	return failedOps.map((op) => ({
+		op,
+		action: classifyFailedOp(op, stateResources)
+	}));
+}
+/**
 * Build the full ordered plan for a list of ops (one segment). Mirrors the
 * replay order: UPDATE/DELETE first (reverse completion order), then CREATE
 * deletions in dependency-aware order.
@@ -16515,7 +16645,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -16524,7 +16654,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 		}
 	}
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
@@ -16534,7 +16664,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 	});
 	return result;
 }
-async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp) {
+async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	try {
@@ -16607,6 +16737,93 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				});
 				return;
 			}
+			case "reverse-replacement-readopt": {
+				const current = stateResources[op.logicalId];
+				const prev = op.previousState;
+				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
+				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: current.provisionedBy ?? op.provisionedBy
+				});
+				await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+				stateResources[op.logicalId] = prev;
+				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
+				await afterOp?.(op.logicalId);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "UPDATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
+			case "reverse-replacement": {
+				const current = stateResources[op.logicalId];
+				const prev = op.previousState;
+				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
+				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
+				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: prev.provisionedBy
+				});
+				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: current.provisionedBy ?? op.provisionedBy
+				});
+				let deletedNewFirst = false;
+				let createResult;
+				try {
+					createResult = await createProvider.create(op.logicalId, op.resourceType, { ...prev.properties });
+				} catch (createError) {
+					const msg = createError instanceof Error ? createError.message : String(createError);
+					if (!(/already exists/i.test(msg) || msg.includes("AlreadyExists"))) throw createError;
+					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+					deletedNewFirst = true;
+					delete stateResources[op.logicalId];
+					await afterOp?.(op.logicalId);
+					try {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+							maxRetries: 5,
+							initialDelayMs: 2e3,
+							maxDelayMs: 1e4,
+							logger,
+							...isInterrupted && {
+								isInterrupted,
+								onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting for the old name to release")
+							},
+							isRetryable: (message) => /already exists/i.test(message) || message.includes("AlreadyExists")
+						});
+					} catch (recreateError) {
+						throw new Error(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`);
+					}
+				}
+				const { observedProperties: _staleObserved, ...prevRecord } = prev;
+				stateResources[op.logicalId] = {
+					...prevRecord,
+					physicalId: createResult.physicalId,
+					attributes: createResult.attributes ?? {}
+				};
+				await afterOp?.(op.logicalId);
+				if (!deletedNewFirst) try {
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+				} catch (deleteError) {
+					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
+					result.warnings++;
+				}
+				logger.info(`  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "UPDATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
 			case "revert": {
 				if (!op.previousState) {
 					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — no previous state available`);
@@ -16654,6 +16871,115 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 		});
 	}
 }
+/**
+* Revert a segment's FAILED in-flight operations (issue #1198). Opt-in via
+* `cdkd rollback --revert-failed` — the failed resource's remote state is
+* unknown (the op died partway), so force-applying `previousState` is a
+* deliberate user decision, never the default. Runs BEFORE the segment's
+* completed ops (the failed op is the newest work of the failed deploy).
+*
+* Best-effort like {@link replayRollback}: per-op failures are caught,
+* warned, and counted.
+*/
+async function replayFailedOperations(failedOps, stateResources, stackName, ctx, options = {}) {
+	const result = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		remainingFailedOps: []
+	};
+	const { logger } = ctx;
+	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
+	if (emitEnvelope) ctx.recordEvent?.({
+		eventType: "ROLLBACK_STARTED",
+		stackName
+	});
+	const pending = /* @__PURE__ */ new Set();
+	for (let i = failedOps.length - 1; i >= 0; i--) {
+		if (options.isInterrupted?.()) {
+			result.interrupted = true;
+			for (let j = i; j >= 0; j--) pending.add(failedOps[j]);
+			break;
+		}
+		const op = failedOps[i];
+		const action = classifyFailedOp(op, stateResources);
+		try {
+			switch (action) {
+				case "skip-failed-noop":
+					logger.info(`  Rollback: failed ${op.changeType} of ${op.logicalId} (${op.resourceType}) left nothing to revert, skipping`);
+					break;
+				case "skip-failed-unknown":
+					logger.warn(`  Rollback: failed CREATE of ${op.logicalId} (${op.resourceType}) recorded no physical id — if it was partially created in AWS, delete it manually`);
+					result.warnings++;
+					break;
+				case "skip-failed-absent":
+					logger.warn(`  Rollback: cannot revert failed UPDATE of ${op.logicalId} — no previous state available, skipping`);
+					result.warnings++;
+					break;
+				case "delete-failed-create": {
+					logger.info(`  Rollback: deleting partially-created ${op.logicalId} (${op.resourceType}) (--revert-failed)`);
+					const { provider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: op.provisionedBy
+					});
+					await provider.delete(op.logicalId, op.physicalId, op.resourceType, void 0, { expectedRegion: ctx.region });
+					delete stateResources[op.logicalId];
+					await options.afterOp?.(op.logicalId);
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "CREATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
+					break;
+				}
+				case "revert-failed-update": {
+					const current = stateResources[op.logicalId];
+					const prev = op.previousState;
+					logger.info(`  Rollback: force-reverting failed UPDATE of ${op.logicalId} (${op.resourceType}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
+					const { provider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: op.provisionedBy ?? current.provisionedBy
+					});
+					await provider.update(op.logicalId, current.physicalId, op.resourceType, prev.properties, op.attemptedProperties ?? current.properties);
+					stateResources[op.logicalId] = prev;
+					logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
+					await options.afterOp?.(op.logicalId);
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "UPDATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
+					break;
+				}
+			}
+		} catch (revertError) {
+			logger.warn(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`);
+			result.failures++;
+			pending.add(op);
+			ctx.recordEvent?.({
+				eventType: "ROLLBACK_RESOURCE_FAILED",
+				stackName,
+				operation: op.changeType,
+				logicalId: op.logicalId,
+				resourceType: op.resourceType,
+				...op.provisionedBy && { provisionedBy: op.provisionedBy },
+				error: extractDeploymentEventError(revertError)
+			});
+		}
+	}
+	if (emitEnvelope) ctx.recordEvent?.({
+		eventType: "ROLLBACK_FINISHED",
+		stackName
+	});
+	result.remainingFailedOps = failedOps.filter((op) => pending.has(op));
+	return result;
+}
 function stateResourcesPolicyLabel(op, stateResources) {
 	return stateResources[op.logicalId]?.deletionPolicy ?? "Retain";
 }
@@ -16746,7 +17072,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.263.1";
+	return "0.264.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -17303,6 +17629,14 @@ var DeployEngine = class {
 	*/
 	recordedOutputReads = [];
 	/**
+	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
+	* each CREATE / UPDATE attempted (issue #1198). Written just before the
+	* provider call; read only when the op FAILS, to journal the failed op's
+	* `attemptedProperties` so `cdkd rollback --revert-failed` can generate a
+	* patch that undoes a half-applied update.
+	*/
+	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -17728,6 +18062,7 @@ var DeployEngine = class {
 			skipped: 0
 		};
 		const completedOperations = [];
+		const failedOperations = [];
 		let pendingMigration = migrationPending;
 		let saveChain = Promise.resolve();
 		const saveStateAfterResource = (logicalId) => {
@@ -17789,6 +18124,15 @@ var DeployEngine = class {
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
+							failedOperations.push({
+								logicalId,
+								changeType: change.changeType,
+								resourceType: change.resourceType,
+								provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+								...previousState && { previousState },
+								physicalId: newResources[logicalId]?.physicalId ?? previousState?.physicalId,
+								attemptedProperties: this.attemptedResolvedProps.get(logicalId)
+							});
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -17827,6 +18171,14 @@ var DeployEngine = class {
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
+							failedOperations.push({
+								logicalId,
+								changeType: "DELETE",
+								resourceType: change.resourceType,
+								provisionedBy: previousState?.provisionedBy,
+								...previousState && { previousState },
+								physicalId: previousState?.physicalId
+							});
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -17869,16 +18221,16 @@ var DeployEngine = class {
 			}
 			let autoRollbackClean = false;
 			if (error instanceof InterruptedError) {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "interrupted", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
 				throw error;
 			}
 			if (this.options.noRollback) {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", initialDeploy);
 				this.logger.warn("Deployment failed. --no-rollback is set, skipping rollback.");
 				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			} else {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "auto-rollback-started", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
 				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName)).failures === 0;
 			}
 			try {
@@ -17923,7 +18275,7 @@ var DeployEngine = class {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
-			await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", currentEtag === void 0);
+			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", currentEtag === void 0);
 			throw outputError;
 		}
 		return {
@@ -18033,8 +18385,8 @@ var DeployEngine = class {
 	* `cdkd rollback`. Best-effort like the partial-state save, but warns
 	* LOUDLY on failure — the user just lost the ability to `cdkd rollback`.
 	*/
-	async writeRollbackJournalSegment(stackName, completedOperations, reason, initialDeploy) {
-		if (completedOperations.length === 0) return;
+	async writeRollbackJournalSegment(stackName, completedOperations, failedOperations, reason, initialDeploy) {
+		if (completedOperations.length === 0 && failedOperations.length === 0) return;
 		try {
 			const segment = {
 				...this.options.eventRecorder?.runId !== void 0 && { runId: this.options.eventRecorder.runId },
@@ -18043,7 +18395,8 @@ var DeployEngine = class {
 				initialDeploy,
 				...this.options.roleArn && { roleArn: this.options.roleArn },
 				cdkdVersion: getCdkdVersion(),
-				operations: completedOperations
+				operations: completedOperations,
+				...failedOperations.length > 0 && { failedOperations }
 			};
 			await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
 			this.logger.debug(`Rollback journal segment written (${reason})`);
@@ -18175,6 +18528,7 @@ var DeployEngine = class {
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
 					resourceType,
 					properties: resolvedProps
@@ -18215,6 +18569,7 @@ var DeployEngine = class {
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
@@ -18653,5 +19008,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { rewriteTemplateAssetReferences as $, StackHasActiveImportsError as $t, disableInstanceApiTermination as A, uploadCfnTemplate as At, DiffCalculator as B, CdkdError as Bt, yellow as C, resolveStateBucketWithDefaultAndSource as Ct, findActionableSilentDrops as D, CFN_TEMPLATE_URL_LIMIT as Dt, ProviderRegistry as E, CFN_TEMPLATE_BODY_LIMIT as Et, WAFv2WebACLProvider as F, AwsClients as Ft, rebuildClientForBucketRegion as G, LocalStartServiceError as Gt, TemplateParser as H, DependencyError as Ht, normalizeAwsTagsToCfn as I, getAwsClients as It, stringifyValue as J, NestedStackChildDirectDestroyError as Jt, shouldRetainResource as K, LockError as Kt, resolveExplicitPhysicalId as L, resetAwsClients as Lt, IntrinsicFunctionResolver as M, AssemblyReader as Mt, cfnRefValueFromPhysicalId as N, clearBucketRegionCache as Nt, CloudControlProvider as O, MIGRATE_TMP_PREFIX as Ot, refStateLookupFromResource as P, resolveBucketRegion as Pt, loadPublishableAssetManifest as Q, ResourceUpdateNotSupportedError as Qt, assertRegionMatch as R, setAwsClients as Rt, red as S, resolveStateBucketWithDefault as St, collectInlinePolicyNamesManagedBySiblings as T, warnDeprecatedNoPrefixCliFlag as Tt, LockManager as U, LocalInvokeBuildError as Ut, DagBuilder as V, ConfigError as Vt, S3StateBackend as W, LocalMigrateError as Wt, buildAssetRedirectMap as X, ProvisioningError as Xt, WorkGraph as Y, PartialFailureError as Yt, createAssetRedirectResolver as Z, ResourceTimeoutError as Zt, formatResourceLine as _, getLegacyStateBucketName as _t, DeploymentEventsStore as a, normalizeAwsError as an, validateAssetBucketName as at, gray as b, resolveCaptureObservedState as bt, withResourceDeadline as c, formatDockerLoginError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, runDockerStreaming as dt, StackTerminationProtectionError as en, AssetModeResolver as et, computeImplicitDeleteEdges as f, AssetManifestLoader as ft, renderStatefulReason as g, getDefaultStateBucketName as gt, isStatefulRecreateTargetSync as h, synthesisStatusMessage as ht, DeploymentEventsReader as i, isCdkdError as in, parseBootstrapMarker as it, isTerminationProtectionPropagationError as j, expectedOwnerParam as jt, slowCcOperationTimeoutMs as k, findLargeInlineResources as kt, withRetry as l, getDockerCmd as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, Synthesizer as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as nn, ensureAssetStorage as nt, planRollback as o, withErrorHandling as on, validateContainerRepoName as ot, extractDeploymentEventError as p, getDockerImageBySourceHash as pt, AssetPublisher as q, MissingCdkCliError as qt, DeployEngine as r, formatError as rn, getBootstrapMarkerKey as rt, replayRollback as s, __exportAll as sn, buildDockerImage as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as tn, BOOTSTRAP_MARKER_PREFIX as tt, isRetryableTransientError as u, runDockerForeground as ut, bold as v, resolveApp as vt, IAMRoleProvider as w, resolveUseCdkBootstrapAssets as wt, green as x, resolveSkipPrefix as xt, cyan as y, resolveAutoAssetStorage as yt, applyRoleArnIfSet as z, AssetError as zt };
-//# sourceMappingURL=deploy-engine-MdcxM5WC.js.map
+export { createAssetRedirectResolver as $, ResourceTimeoutError as $t, CloudControlProvider as A, MIGRATE_TMP_PREFIX as At, assertRegionMatch as B, setAwsClients as Bt, green as C, resolveSkipPrefix as Ct, collectInlinePolicyNamesManagedBySiblings as D, warnDeprecatedNoPrefixCliFlag as Dt, IAMRoleProvider as E, resolveUseCdkBootstrapAssets as Et, cfnRefValueFromPhysicalId as F, clearBucketRegionCache as Ft, LockManager as G, LocalInvokeBuildError as Gt, DiffCalculator as H, CdkdError as Ht, refStateLookupFromResource as I, resolveBucketRegion as It, shouldRetainResource as J, LockError as Jt, S3StateBackend as K, LocalMigrateError as Kt, WAFv2WebACLProvider as L, AwsClients as Lt, disableInstanceApiTermination as M, uploadCfnTemplate as Mt, isTerminationProtectionPropagationError as N, expectedOwnerParam as Nt, ProviderRegistry as O, CFN_TEMPLATE_BODY_LIMIT as Ot, IntrinsicFunctionResolver as P, AssemblyReader as Pt, buildAssetRedirectMap as Q, ProvisioningError as Qt, normalizeAwsTagsToCfn as R, getAwsClients as Rt, gray as S, resolveCaptureObservedState as St, yellow as T, resolveStateBucketWithDefaultAndSource as Tt, DagBuilder as U, ConfigError as Ut, applyRoleArnIfSet as V, AssetError as Vt, TemplateParser as W, DependencyError as Wt, stringifyValue as X, NestedStackChildDirectDestroyError as Xt, AssetPublisher as Y, MissingCdkCliError as Yt, WorkGraph as Z, PartialFailureError as Zt, isStatefulRecreateTargetSync as _, synthesisStatusMessage as _t, DeploymentEventsStore as a, formatError as an, getBootstrapMarkerKey as at, bold as b, resolveApp as bt, replayFailedOperations as c, withErrorHandling as cn, validateContainerRepoName as ct, withRetry as d, getDockerCmd as dt, ResourceUpdateNotSupportedError as en, loadPublishableAssetManifest as et, isRetryableTransientError as f, runDockerForeground as ft, MULTI_REGION_RECREATE_BLOCKED_TYPES as g, Synthesizer as gt, extractDeploymentEventError as h, getDockerImageBySourceHash as ht, DeploymentEventsReader as i, SynthesisError as in, ensureAssetStorage as it, slowCcOperationTimeoutMs as j, findLargeInlineResources as jt, findActionableSilentDrops as k, CFN_TEMPLATE_URL_LIMIT as kt, replayRollback as l, __exportAll as ln, buildDockerImage as lt, computeImplicitDeleteEdges as m, AssetManifestLoader as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as nn, AssetModeResolver as nt, planFailedOps as o, isCdkdError as on, parseBootstrapMarker as ot, IMPLICIT_DELETE_DEPENDENCIES as p, runDockerStreaming as pt, rebuildClientForBucketRegion as q, LocalStartServiceError as qt, DeployEngine as r, StateError as rn, BOOTSTRAP_MARKER_PREFIX as rt, planRollback as s, normalizeAwsError as sn, validateAssetBucketName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as tn, rewriteTemplateAssetReferences as tt, withResourceDeadline as u, formatDockerLoginError as ut, renderStatefulReason as v, getDefaultStateBucketName as vt, red as w, resolveStateBucketWithDefault as wt, cyan as x, resolveAutoAssetStorage as xt, formatResourceLine as y, getLegacyStateBucketName as yt, resolveExplicitPhysicalId as z, resetAwsClients as zt };
+//# sourceMappingURL=deploy-engine-hlS6y_-0.js.map