@go-to-k/cdkd 0.275.3 → 0.275.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-_U0eVWNU.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-rn1TQits.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-UUnRzwMx.js";
+import { t as ASGProvider } from "./asg-provider-D6Y0zhd3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1507,6 +1507,50 @@ function createListCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/utils/interrupt-signals.ts
+/**
+* SIGTERM -> SIGINT forwarding for the deploy / destroy / rollback commands
+* (issue #1342).
+*
+* CI runners rarely deliver a clean Ctrl-C: GitHub Actions escalates
+* SIGINT -> SIGTERM (~7.5s later) -> SIGKILL (~2.5s after that) on job
+* cancellation, and GitLab CI / `docker stop` / Kubernetes send SIGTERM
+* directly. cdkd's graceful-interrupt handling (the top-level command
+* handlers, the deploy engine's partial-state save, and the per-provider
+* poll-abort listeners in CustomResource / ACM / CloudFront / Route53) is
+* registered on SIGINT only, so an unhandled SIGTERM killed the process
+* mid-run, skipped every `finally`, and stranded the stack lock for its
+* full TTL.
+*
+* Re-emitting SIGTERM as SIGINT routes it through the exact same graceful
+* path with ONE registration per command, covering every current and future
+* SIGINT listener. The "second signal escalates to force-quit" semantics
+* compose correctly: under GitHub Actions the initial SIGINT starts the
+* graceful drain, and the follow-up SIGTERM (delivered when the runner is
+* ~2.5s from SIGKILL) becomes the force-quit that fires the best-effort
+* lock release before the process dies. In SIGTERM-only environments the
+* first SIGTERM starts the full graceful drain.
+*/
+/**
+* Forward SIGTERM deliveries to the process's SIGINT listeners.
+*
+* Returns an unregister function. Callers register at command start and
+* unregister in their outermost `finally` so the listener never leaks across
+* commands (or into `cdkd local start-api`, which owns a real SIGTERM
+* handler of its own).
+*/
+function forwardSigtermToSigint() {
+	const handler = () => {
+		if (process.listenerCount("SIGINT") === 0) process.exit(143);
+		process.emit("SIGINT", "SIGINT");
+	};
+	process.on("SIGTERM", handler);
+	return () => {
+		process.removeListener("SIGTERM", handler);
+	};
+}
+
 //#endregion
 //#region src/deployment/recreate-targets.ts
 /**
@@ -42579,16 +42623,50 @@ async function runDestroyForStack(stackName, state, ctx) {
 		destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
 		if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
 	}
+	const renderer = getLiveRenderer();
+	let draining = false;
+	let lockHeld = false;
+	const sigintHandler = () => {
+		if (draining) {
+			if (lockHeld) {
+				ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
+				process.stderr.write(`\nForce-quit: stack lock may not be released. If the next run reports a lock, run: cdkd force-unlock ${stackName}\n`);
+			}
+			process.exit(130);
+		}
+		draining = true;
+		renderer.printAbove(() => {
+			process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
+		});
+	};
+	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
+	process.on("SIGINT", sigintHandler);
 	logger.info(`\nAcquiring lock for stack ${stackName}...`);
-	await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+	try {
+		await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+	} catch (error) {
+		process.removeListener("SIGINT", sigintHandler);
+		throw error;
+	}
+	lockHeld = true;
 	if (needsStrongRefCheck) {
-		const consumers = await scanActiveConsumers(stackName, regionForState, ctx);
-		if (consumers.length > 0) {
+		const releaseThenUnregister = async () => {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after strong-ref refusal: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
 			}
+			process.removeListener("SIGINT", sigintHandler);
+		};
+		let consumers;
+		try {
+			consumers = await scanActiveConsumers(stackName, regionForState, ctx);
+		} catch (error) {
+			await releaseThenUnregister();
+			throw error;
+		}
+		if (consumers.length > 0) {
+			await releaseThenUnregister();
 			throw new StackHasActiveImportsError(stackName, regionForState, consumers);
 		}
 	}
@@ -42613,22 +42691,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 		});
 	};
-	const renderer = getLiveRenderer();
 	renderer.start();
-	let draining = false;
-	const sigintHandler = () => {
-		if (draining) {
-			ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
-			process.stderr.write(`\nForce-quit: stack lock may not be released. If the next run reports a lock, run: cdkd force-unlock ${stackName}\n`);
-			process.exit(130);
-		}
-		draining = true;
-		renderer.printAbove(() => {
-			process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
-		});
-	};
-	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
-	process.on("SIGINT", sigintHandler);
 	try {
 		logger.info("Building dependency graph...");
 		const template = {
@@ -43955,13 +44018,14 @@ async function deployCommand(stacks, options) {
 	let deployInterrupted = false;
 	const topLevelSigintHandler = () => {
 		if (deployInterrupted) {
-			process.stderr.write("\nForce exit\n");
+			process.stderr.write("\nForce-quit: stack locks may not be released. If the next run reports a lock, run: cdkd force-unlock <stackName>\n");
 			process.exit(130);
 		}
 		process.stderr.write("\nInterrupted — waiting for in-progress operations to complete...\n");
 		deployInterrupted = true;
 	};
 	process.on("SIGINT", topLevelSigintHandler);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
@@ -44101,6 +44165,7 @@ async function deployCommand(stacks, options) {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
 		const runStackInner = async (stackInfo) => {
+			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
 			const stackRegion = stackInfo.region || baseRegion;
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			switchRegion(stackRegion);
@@ -44267,6 +44332,7 @@ async function deployCommand(stacks, options) {
 			}
 		});
 	} finally {
+		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
 	}
@@ -46911,6 +46977,7 @@ async function destroyCommand(stackArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -47120,6 +47187,7 @@ async function destroyCommand(stackArgs, options) {
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 	} finally {
+		unforwardSigterm();
 		awsClients.destroy();
 	}
 }
@@ -50478,6 +50546,7 @@ async function stateDestroyCommand(stackArgs, options) {
 	registerAllProviders(providerRegistry);
 	providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 	if (options.allowUnsupportedTypes?.length) providerRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
+	const unforwardSigterm = forwardSigtermToSigint();
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -50577,6 +50646,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 	} finally {
+		unforwardSigterm();
 		setup.dispose();
 	}
 }
@@ -51187,13 +51257,20 @@ async function rollbackCommand(stackArg, options) {
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
-		await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
 		let interrupted = false;
 		const sigintHandler = () => {
 			process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
 			interrupted = true;
 		};
 		process.on("SIGINT", sigintHandler);
+		const unforwardSigterm = forwardSigtermToSigint();
+		try {
+			await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
+		} catch (error) {
+			unforwardSigterm();
+			process.removeListener("SIGINT", sigintHandler);
+			throw error;
+		}
 		try {
 			const stateData = await setup.stateBackend.getState(stackName, region);
 			const journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
@@ -51333,6 +51410,7 @@ async function rollbackCommand(stackArg, options) {
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${stackName}' (${region}) complete.`);
 		} finally {
+			unforwardSigterm();
 			process.removeListener("SIGINT", sigintHandler);
 			await setup.lockManager.releaseLock(stackName, region).catch((err) => {
 				logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
@@ -63571,7 +63649,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;