@go-to-k/cdkd 0.275.3 → 0.275.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-_U0eVWNU.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-CHL0hb1m.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-UUnRzwMx.js";
+import { t as ASGProvider } from "./asg-provider-BxpwCQGo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1507,6 +1507,50 @@ function createListCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/utils/interrupt-signals.ts
+/**
+* SIGTERM -> SIGINT forwarding for the deploy / destroy / rollback commands
+* (issue #1342).
+*
+* CI runners rarely deliver a clean Ctrl-C: GitHub Actions escalates
+* SIGINT -> SIGTERM (~7.5s later) -> SIGKILL (~2.5s after that) on job
+* cancellation, and GitLab CI / `docker stop` / Kubernetes send SIGTERM
+* directly. cdkd's graceful-interrupt handling (the top-level command
+* handlers, the deploy engine's partial-state save, and the per-provider
+* poll-abort listeners in CustomResource / ACM / CloudFront / Route53) is
+* registered on SIGINT only, so an unhandled SIGTERM killed the process
+* mid-run, skipped every `finally`, and stranded the stack lock for its
+* full TTL.
+*
+* Re-emitting SIGTERM as SIGINT routes it through the exact same graceful
+* path with ONE registration per command, covering every current and future
+* SIGINT listener. The "second signal escalates to force-quit" semantics
+* compose correctly: under GitHub Actions the initial SIGINT starts the
+* graceful drain, and the follow-up SIGTERM (delivered when the runner is
+* ~2.5s from SIGKILL) becomes the force-quit that fires the best-effort
+* lock release before the process dies. In SIGTERM-only environments the
+* first SIGTERM starts the full graceful drain.
+*/
+/**
+* Forward SIGTERM deliveries to the process's SIGINT listeners.
+*
+* Returns an unregister function. Callers register at command start and
+* unregister in their outermost `finally` so the listener never leaks across
+* commands (or into `cdkd local start-api`, which owns a real SIGTERM
+* handler of its own).
+*/
+function forwardSigtermToSigint() {
+	const handler = () => {
+		if (process.listenerCount("SIGINT") === 0) process.exit(143);
+		process.emit("SIGINT", "SIGINT");
+	};
+	process.on("SIGTERM", handler);
+	return () => {
+		process.removeListener("SIGTERM", handler);
+	};
+}
+
 //#endregion
 //#region src/deployment/recreate-targets.ts
 /**
@@ -43955,13 +43999,14 @@ async function deployCommand(stacks, options) {
 	let deployInterrupted = false;
 	const topLevelSigintHandler = () => {
 		if (deployInterrupted) {
-			process.stderr.write("\nForce exit\n");
+			process.stderr.write("\nForce-quit: stack locks may not be released. If the next run reports a lock, run: cdkd force-unlock <stackName>\n");
 			process.exit(130);
 		}
 		process.stderr.write("\nInterrupted — waiting for in-progress operations to complete...\n");
 		deployInterrupted = true;
 	};
 	process.on("SIGINT", topLevelSigintHandler);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
@@ -44101,6 +44146,7 @@ async function deployCommand(stacks, options) {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
 		const runStackInner = async (stackInfo) => {
+			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
 			const stackRegion = stackInfo.region || baseRegion;
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			switchRegion(stackRegion);
@@ -44267,6 +44313,7 @@ async function deployCommand(stacks, options) {
 			}
 		});
 	} finally {
+		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
 	}
@@ -46911,6 +46958,7 @@ async function destroyCommand(stackArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -47120,6 +47168,7 @@ async function destroyCommand(stackArgs, options) {
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 	} finally {
+		unforwardSigterm();
 		awsClients.destroy();
 	}
 }
@@ -50478,6 +50527,7 @@ async function stateDestroyCommand(stackArgs, options) {
 	registerAllProviders(providerRegistry);
 	providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 	if (options.allowUnsupportedTypes?.length) providerRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -50577,6 +50627,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 	} finally {
+		unforwardSigterm();
 		setup.dispose();
 	}
 }
@@ -51194,6 +51245,7 @@ async function rollbackCommand(stackArg, options) {
 			interrupted = true;
 		};
 		process.on("SIGINT", sigintHandler);
+		const unforwardSigterm = forwardSigtermToSigint();
 		try {
 			const stateData = await setup.stateBackend.getState(stackName, region);
 			const journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
@@ -51333,6 +51385,7 @@ async function rollbackCommand(stackArg, options) {
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${stackName}' (${region}) complete.`);
 		} finally {
+			unforwardSigterm();
 			process.removeListener("SIGINT", sigintHandler);
 			await setup.lockManager.releaseLock(stackName, region).catch((err) => {
 				logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
@@ -63571,7 +63624,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;