@go-to-k/cdkd 0.275.4 → 0.275.6

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-CHL0hb1m.js";
+import { $ as TemplateParser, $t as CdkdError, A as yellow, At as resolveAutoAssetStorage, B as IntrinsicFunctionResolver, Bt as MIGRATE_TMP_PREFIX, C as renderStatefulReason, Ct as AssetManifestLoader, D as gray, Dt as getDefaultStateBucketName, E as cyan, Et as synthesisStatusMessage, F as findActionableSilentDrops, Ft as resolveUseCdkBootstrapAssets, G as resolveExplicitPhysicalId, Gt as processStackMessages, H as refStateLookupFromResource, Ht as uploadCfnTemplate, I as CloudControlProvider, It as stateBucketExistenceConfirmed, J as DiffCalculator, Jt as AwsClients, K as assertRegionMatch, L as slowCcOperationTimeoutMs, Lt as warnDeprecatedNoPrefixCliFlag, M as collectInlinePolicyNamesManagedBySiblings, Mt as resolveSkipPrefix, N as clearOnUpdateRemoval, Nt as resolveStateBucketWithDefault, O as green, Ot as getLegacyStateBucketName, P as ProviderRegistry, Pt as resolveStateBucketWithDefaultAndSource, Q as DagBuilder, R as disableInstanceApiTermination, Rt as CFN_TEMPLATE_BODY_LIMIT, S as isStatefulRecreateTargetSync, St as runDockerStreaming, T as bold, Tt as Synthesizer, U as WAFv2WebACLProvider, Ut as expectedOwnerParam, V as cfnRefValueFromPhysicalId, Vt as findLargeInlineResources, W as normalizeAwsTagsToCfn, Wt as AssemblyReader, X as withRetry, Xt as resetAwsClients, Y as describeTypeWithThrottleRetry, Yt as getAwsClients, Z as isRetryableTransientError, Zt as setAwsClients, _ as createEbsFinalSnapshot, _t as validateContainerRepoName, a as DeploymentEventsStore, an as LocalStartServiceError, at as stringifyValue, b as extractDeploymentEventError, bn as withErrorHandling, bt as getDockerCmd, c as replayFailedOperations, cn as NestedStackChildDirectDestroyError, ct as createAssetRedirectResolver, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ResourceTimeoutError, dt as AssetModeResolver, et as LockManager, f as computeImplicitDeleteEdges, fn as ResourceUpdateNotSupportedError, ft as BOOTSTRAP_MARKER_PREFIX, g as ccRoutedFinalSnapshotError, gt as validateAssetBucketName, h as buildFinalSnapshotIdentifier, ht as parseBootstrapMarker, i as DeploymentEventsReader, in as LocalMigrateError, it as AssetPublisher, j as IAMRoleProvider, jt as resolveCaptureObservedState, k as red, kt as resolveApp, l as replayRollback, ln as PartialFailureError, lt as loadPublishableAssetManifest, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackTerminationProtectionError, mt as getBootstrapMarkerKey, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DeployCancelledError, nt as rebuildClientForBucketRegion, o as planFailedOps, ot as WorkGraph, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as StackHasActiveImportsError, pt as ensureAssetStorage, q as applyRoleArnIfSet, qt as resolveBucketRegion, r as DeployEngine, rn as LocalInvokeBuildError$1, rt as shouldRetainResource, s as planRollback, sn as MissingCdkCliError, st as buildAssetRedirectMap, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as S3StateBackend, u as withResourceDeadline, un as ProvisioningError, ut as rewriteTemplateAssetReferences, v as isFinalSnapshotError, vt as buildDockerImage, w as formatResourceLine, wt as getDockerImageBySourceHash, x as MULTI_REGION_RECREATE_BLOCKED_TYPES, xt as runDockerForeground, y as unsupportedFinalSnapshotError, yn as normalizeAwsError, yt as formatDockerLoginError, z as isTerminationProtectionPropagationError, zt as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-D5j6_ZH6.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BxpwCQGo.js";
+import { t as ASGProvider } from "./asg-provider-zDD6EIRo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -707,6 +707,19 @@ const destroyOptions = [
 	new Option("--remove-protection", "Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers stack-level terminationProtection (CDK property) and resource-level protection on AWS::Logs::LogGroup, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::DocDB::DBCluster, AWS::Neptune::DBCluster, AWS::Neptune::DBInstance, AWS::DynamoDB::Table, AWS::EC2::Instance, AWS::Cognito::UserPool, AWS::AutoScaling::AutoScalingGroup, AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::DSQL::Cluster, AWS::NeptuneGraph::Graph, AWS::SMSVOICE::ProtectConfiguration, AWS::VerifiedPermissions::PolicyStore, AWS::EKS::Cluster, AWS::RDS::GlobalCluster, and AWS::DocDB::GlobalCluster.").default(false),
 	allowUnsupportedTypesOption
 ];
+/**
+* `--skip-final-snapshot` (issue #1352) — the explicit data-loss opt-out for
+* `DeletionPolicy: Snapshot` resources. By default the destroy paths honor
+* the policy (CloudFormation parity): an atomic final-snapshot delete
+* parameter for RDS DBInstance / DBCluster, Neptune / DocDB clusters and
+* ElastiCache CacheCluster, a pre-delete EBS `CreateSnapshot`+wait for
+* `AWS::EC2::Volume`, and a refusal for Snapshot-tagged types cdkd cannot
+* snapshot yet (issue #1353). Attached to `cdkd deploy` (template-removal
+* deletes), `cdkd destroy`, and `cdkd state destroy` — NOT to the shared
+* `destroyOptions` array, which `cdkd orphan` also consumes (orphan never
+* deletes AWS resources, so the flag would be inert noise there).
+*/
+const skipFinalSnapshotOption = new Option("--skip-final-snapshot", "Delete resources whose DeletionPolicy is 'Snapshot' WITHOUT creating the final snapshot the policy promises (DATA LOSS — explicit opt-out of CloudFormation parity). By default cdkd creates the final snapshot (RDS / Neptune / DocDB / ElastiCache CacheCluster / EC2 Volume) and refuses to delete Snapshot-tagged types it cannot snapshot yet.").default(false);
 
 //#endregion
 //#region src/cli/commands/state-file-keys.ts
@@ -25232,10 +25245,10 @@ var RDSProvider = class {
 			"EnableIAMDatabaseAuthentication"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
 		["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 		["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
-		["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]
+		["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
@@ -25257,11 +25270,11 @@ var RDSProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::RDS::DBSubnetGroup": return this.deleteDBSubnetGroup(logicalId, physicalId, resourceType, context);
 			case "AWS::RDS::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, context);
-			case "AWS::RDS::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, context);
+			case "AWS::RDS::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -25465,10 +25478,15 @@ var RDSProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -25574,7 +25592,7 @@ var RDSProvider = class {
 			throw new ProvisioningError(`Failed to update DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async deleteDBInstance(logicalId, physicalId, resourceType, context) {
+	async deleteDBInstance(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting DBInstance ${logicalId}: ${physicalId}`);
 		try {
 			if (context?.removeProtection === true) try {
@@ -25587,10 +25605,15 @@ var RDSProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = properties?.["DBClusterIdentifier"] === void 0 ? context?.finalSnapshotIdentifier : void 0;
 			await this.getClient().send(new DeleteDBInstanceCommand({
 				DBInstanceIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DBInstance ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DBInstance ${logicalId}`);
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
@@ -27106,10 +27129,15 @@ var DocDBProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DocDB DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -27731,10 +27759,15 @@ var NeptuneProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$2({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting Neptune DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of Neptune DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -29646,7 +29679,12 @@ var ElastiCacheProvider = class {
 	async deleteCacheCluster(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting CacheCluster ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new DeleteCacheClusterCommand({ CacheClusterId: physicalId }));
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
+			await this.getClient().send(new DeleteCacheClusterCommand({
+				CacheClusterId: physicalId,
+				...finalSnapshotId ? { FinalSnapshotIdentifier: finalSnapshotId } : {}
+			}));
+			if (finalSnapshotId) this.logger.info(`Deleting CacheCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of CacheCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -42623,16 +42661,50 @@ async function runDestroyForStack(stackName, state, ctx) {
 		destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
 		if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
 	}
+	const renderer = getLiveRenderer();
+	let draining = false;
+	let lockHeld = false;
+	const sigintHandler = () => {
+		if (draining) {
+			if (lockHeld) {
+				ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
+				process.stderr.write(`\nForce-quit: stack lock may not be released. If the next run reports a lock, run: cdkd force-unlock ${stackName}\n`);
+			}
+			process.exit(130);
+		}
+		draining = true;
+		renderer.printAbove(() => {
+			process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
+		});
+	};
+	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
+	process.on("SIGINT", sigintHandler);
 	logger.info(`\nAcquiring lock for stack ${stackName}...`);
-	await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+	try {
+		await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+	} catch (error) {
+		process.removeListener("SIGINT", sigintHandler);
+		throw error;
+	}
+	lockHeld = true;
 	if (needsStrongRefCheck) {
-		const consumers = await scanActiveConsumers(stackName, regionForState, ctx);
-		if (consumers.length > 0) {
+		const releaseThenUnregister = async () => {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after strong-ref refusal: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
 			}
+			process.removeListener("SIGINT", sigintHandler);
+		};
+		let consumers;
+		try {
+			consumers = await scanActiveConsumers(stackName, regionForState, ctx);
+		} catch (error) {
+			await releaseThenUnregister();
+			throw error;
+		}
+		if (consumers.length > 0) {
+			await releaseThenUnregister();
 			throw new StackHasActiveImportsError(stackName, regionForState, consumers);
 		}
 	}
@@ -42657,22 +42729,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 		});
 	};
-	const renderer = getLiveRenderer();
 	renderer.start();
-	let draining = false;
-	const sigintHandler = () => {
-		if (draining) {
-			ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
-			process.stderr.write(`\nForce-quit: stack lock may not be released. If the next run reports a lock, run: cdkd force-unlock ${stackName}\n`);
-			process.exit(130);
-		}
-		draining = true;
-		renderer.printAbove(() => {
-			process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
-		});
-	};
-	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
-	process.on("SIGINT", sigintHandler);
 	try {
 		logger.info("Building dependency graph...");
 		const template = {
@@ -42765,6 +42822,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 					...resource.provisionedBy && { provisionedBy: resource.provisionedBy }
 				});
 				try {
+					let finalSnapshotIdentifier;
+					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
+					else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createEbsFinalSnapshot((destroyAwsClients ?? ctx.baseAwsClients).ec2, resource.physicalId, logicalId, logger);
+					else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
 					const provider = destroyProviderRegistry.getProviderFor({
 						resourceType: resource.resourceType,
 						provisionedBy: resource.provisionedBy
@@ -42780,7 +42842,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
 							await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
-								...ctx.removeProtection === true && { removeProtection: true }
+								...ctx.removeProtection === true && { removeProtection: true },
+								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 							});
 							lastDeleteError = null;
 							break;
@@ -42823,7 +42886,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException")) {
+					if (!isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -43126,6 +43189,7 @@ var NestedStackProvider = class {
 			...ctx.exportIndexStore && { exportIndexStore: ctx.exportIndexStore },
 			...ctx.destroyOptions?.profile && { profile: ctx.destroyOptions.profile },
 			...deleteContext?.removeProtection === true && { removeProtection: true },
+			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
 			...ctx.destroyOptions?.resourceTimeoutMs !== void 0 && { resourceTimeoutMs: ctx.destroyOptions.resourceTimeoutMs },
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
@@ -44239,6 +44303,8 @@ async function deployCommand(stacks, options) {
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
+					...options.skipFinalSnapshot && { skipFinalSnapshot: true },
+					finalSnapshotEc2: stackAwsClients.ec2,
 					...options.strictGetatt && { strictGetAtt: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -44329,6 +44395,7 @@ function createDeployCommand() {
 		...stateOptions,
 		...stackOptions,
 		...deployOptions,
+		skipFinalSnapshotOption,
 		...contextOptions,
 		...annotationMessageOptions
 	].forEach((opt) => cmd.addOption(opt));
@@ -47114,6 +47181,7 @@ async function destroyCommand(stackArgs, options) {
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
 						...options.removeProtection === true && { removeProtection: true },
+						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 						...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 						...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
@@ -47129,6 +47197,7 @@ async function destroyCommand(stackArgs, options) {
 					stateBucket,
 					skipConfirmation: options.yes || options.force,
 					removeProtection: options.removeProtection === true,
+					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					exportIndexStore,
 					...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -47184,6 +47253,7 @@ function createDestroyCommand() {
 		...stackOptions,
 		...destroyOptions,
 		...resourceTimeoutOptions,
+		skipFinalSnapshotOption,
 		...contextOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
@@ -50596,6 +50666,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
 						...options.removeProtection === true && { removeProtection: true },
+						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 						...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 						...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
@@ -50611,6 +50682,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					stateBucket: setup.bucket,
 					skipConfirmation: options.yes || options.all === true,
 					removeProtection: options.removeProtection === true,
+					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					exportIndexStore: setup.exportIndexStore,
 					...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -50650,7 +50722,8 @@ function createStateDestroyCommand() {
 		...commonOptions,
 		...stateOptions,
 		...resourceTimeoutOptions,
-		allowUnsupportedTypesOption
+		allowUnsupportedTypesOption,
+		skipFinalSnapshotOption
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -51238,7 +51311,6 @@ async function rollbackCommand(stackArg, options) {
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
-		await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
 		let interrupted = false;
 		const sigintHandler = () => {
 			process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
@@ -51246,6 +51318,13 @@ async function rollbackCommand(stackArg, options) {
 		};
 		process.on("SIGINT", sigintHandler);
 		const unforwardSigterm = forwardSigtermToSigint();
+		try {
+			await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
+		} catch (error) {
+			unforwardSigterm();
+			process.removeListener("SIGINT", sigintHandler);
+			throw error;
+		}
 		try {
 			const stateData = await setup.stateBackend.getState(stackName, region);
 			const journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
@@ -63624,7 +63703,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.6");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;