@go-to-k/cdkd 0.275.5 → 0.276.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-rn1TQits.js";
+import { $ as TemplateParser, $t as CdkdError, A as yellow, At as resolveAutoAssetStorage, B as IntrinsicFunctionResolver, Bt as MIGRATE_TMP_PREFIX, C as renderStatefulReason, Ct as AssetManifestLoader, D as gray, Dt as getDefaultStateBucketName, E as cyan, Et as synthesisStatusMessage, F as findActionableSilentDrops, Ft as resolveUseCdkBootstrapAssets, G as resolveExplicitPhysicalId, Gt as processStackMessages, H as refStateLookupFromResource, Ht as uploadCfnTemplate, I as CloudControlProvider, It as stateBucketExistenceConfirmed, J as DiffCalculator, Jt as AwsClients, K as assertRegionMatch, L as slowCcOperationTimeoutMs, Lt as warnDeprecatedNoPrefixCliFlag, M as collectInlinePolicyNamesManagedBySiblings, Mt as resolveSkipPrefix, N as clearOnUpdateRemoval, Nt as resolveStateBucketWithDefault, O as green, Ot as getLegacyStateBucketName, P as ProviderRegistry, Pt as resolveStateBucketWithDefaultAndSource, Q as DagBuilder, R as disableInstanceApiTermination, Rt as CFN_TEMPLATE_BODY_LIMIT, S as isStatefulRecreateTargetSync, St as runDockerStreaming, T as bold, Tt as Synthesizer, U as WAFv2WebACLProvider, Ut as expectedOwnerParam, V as cfnRefValueFromPhysicalId, Vt as findLargeInlineResources, W as normalizeAwsTagsToCfn, Wt as AssemblyReader, X as withRetry, Xt as resetAwsClients, Y as describeTypeWithThrottleRetry, Yt as getAwsClients, Z as isRetryableTransientError, Zt as setAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateContainerRepoName, a as DeploymentEventsStore, an as LocalStartServiceError, at as stringifyValue, b as extractDeploymentEventError, bn as withErrorHandling, bt as getDockerCmd, c as replayFailedOperations, cn as NestedStackChildDirectDestroyError, ct as createAssetRedirectResolver, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ResourceTimeoutError, dt as AssetModeResolver, et as LockManager, f as computeImplicitDeleteEdges, fn as ResourceUpdateNotSupportedError, ft as BOOTSTRAP_MARKER_PREFIX, g as ccRoutedFinalSnapshotError, gt as validateAssetBucketName, h as buildFinalSnapshotIdentifier, ht as parseBootstrapMarker, i as DeploymentEventsReader, in as LocalMigrateError, it as AssetPublisher, j as IAMRoleProvider, jt as resolveCaptureObservedState, k as red, kt as resolveApp, l as replayRollback, ln as PartialFailureError, lt as loadPublishableAssetManifest, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackTerminationProtectionError, mt as getBootstrapMarkerKey, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DeployCancelledError, nt as rebuildClientForBucketRegion, o as planFailedOps, ot as WorkGraph, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as StackHasActiveImportsError, pt as ensureAssetStorage, q as applyRoleArnIfSet, qt as resolveBucketRegion, r as DeployEngine, rn as LocalInvokeBuildError$1, rt as shouldRetainResource, s as planRollback, sn as MissingCdkCliError, st as buildAssetRedirectMap, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as S3StateBackend, u as withResourceDeadline, un as ProvisioningError, ut as rewriteTemplateAssetReferences, v as isFinalSnapshotError, vt as buildDockerImage, w as formatResourceLine, wt as getDockerImageBySourceHash, x as MULTI_REGION_RECREATE_BLOCKED_TYPES, xt as runDockerForeground, y as unsupportedFinalSnapshotError, yn as normalizeAwsError, yt as formatDockerLoginError, z as isTerminationProtectionPropagationError, zt as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-j0TmnJYJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-D6Y0zhd3.js";
+import { t as ASGProvider } from "./asg-provider-DeLTuWlm.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -21,6 +21,7 @@ import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDi
 import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$7, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-elasticache";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
@@ -29,14 +30,13 @@ import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
-import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
+import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
 import { Command, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
@@ -707,6 +707,23 @@ const destroyOptions = [
 	new Option("--remove-protection", "Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers stack-level terminationProtection (CDK property) and resource-level protection on AWS::Logs::LogGroup, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::DocDB::DBCluster, AWS::Neptune::DBCluster, AWS::Neptune::DBInstance, AWS::DynamoDB::Table, AWS::EC2::Instance, AWS::Cognito::UserPool, AWS::AutoScaling::AutoScalingGroup, AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::DSQL::Cluster, AWS::NeptuneGraph::Graph, AWS::SMSVOICE::ProtectConfiguration, AWS::VerifiedPermissions::PolicyStore, AWS::EKS::Cluster, AWS::RDS::GlobalCluster, and AWS::DocDB::GlobalCluster.").default(false),
 	allowUnsupportedTypesOption
 ];
+/**
+* `--skip-final-snapshot` (issues #1352 / #1353 / #1354) — the explicit
+* data-loss opt-out for `DeletionPolicy: Snapshot` (and, on the replacement
+* paths, `UpdateReplacePolicy: Snapshot`) resources. By default the delete
+* paths honor the policy (CloudFormation parity): an atomic final-snapshot
+* delete parameter for RDS DBInstance / DBCluster, Neptune / DocDB clusters
+* and ElastiCache CacheCluster; a pre-delete snapshot+wait for
+* `AWS::EC2::Volume`, `AWS::Redshift::Cluster` and
+* `AWS::ElastiCache::ReplicationGroup`; and a refusal when cdkd cannot
+* honor the policy (a Cloud-Control-routed atomic type — its delete has no
+* final-snapshot parameter). Attached to `cdkd deploy` (template-removal +
+* replacement deletes), `cdkd destroy`, and `cdkd state destroy` — NOT to
+* the shared `destroyOptions` array, which `cdkd orphan` also consumes
+* (orphan never deletes AWS resources, so the flag would be inert noise
+* there).
+*/
+const skipFinalSnapshotOption = new Option("--skip-final-snapshot", "Delete resources whose DeletionPolicy (or, on replacements, UpdateReplacePolicy) is 'Snapshot' WITHOUT creating the final snapshot the policy promises (DATA LOSS — explicit opt-out of CloudFormation parity). By default cdkd creates the final snapshot for every CloudFormation-supported type (RDS DBInstance / DBCluster, Neptune / DocDB clusters, ElastiCache CacheCluster / ReplicationGroup, Redshift Cluster, EC2 Volume) and refuses the delete when it cannot — e.g. a resource managed via the Cloud Control API route, whose delete has no final-snapshot parameter.").default(false);
 
 //#endregion
 //#region src/cli/commands/state-file-keys.ts
@@ -25232,10 +25249,10 @@ var RDSProvider = class {
 			"EnableIAMDatabaseAuthentication"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
 		["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 		["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
-		["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]
+		["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"]
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
@@ -25257,11 +25274,11 @@ var RDSProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::RDS::DBSubnetGroup": return this.deleteDBSubnetGroup(logicalId, physicalId, resourceType, context);
 			case "AWS::RDS::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, context);
-			case "AWS::RDS::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, context);
+			case "AWS::RDS::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -25465,10 +25482,15 @@ var RDSProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -25574,7 +25596,7 @@ var RDSProvider = class {
 			throw new ProvisioningError(`Failed to update DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async deleteDBInstance(logicalId, physicalId, resourceType, context) {
+	async deleteDBInstance(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting DBInstance ${logicalId}: ${physicalId}`);
 		try {
 			if (context?.removeProtection === true) try {
@@ -25587,10 +25609,15 @@ var RDSProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = properties?.["DBClusterIdentifier"] === void 0 ? context?.finalSnapshotIdentifier : void 0;
 			await this.getClient().send(new DeleteDBInstanceCommand({
 				DBInstanceIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DBInstance ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DBInstance ${logicalId}`);
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
@@ -25624,14 +25651,14 @@ var RDSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new RemoveTagsFromResourceCommand$1({
+			await this.getClient().send(new RemoveTagsFromResourceCommand$2({
 				ResourceName: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from RDS resource ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new AddTagsToResourceCommand$1({
+			await this.getClient().send(new AddTagsToResourceCommand$2({
 				ResourceName: arn,
 				Tags: tagsToAdd
 			}));
@@ -25866,7 +25893,7 @@ var RDSProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -26161,7 +26188,7 @@ var RDSDBProxyProvider = class {
 			}))
 		};
 		if (p.DBProxyArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$9({ ResourceName: p.DBProxyArn }))).TagList ?? []);
+			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }))).TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -26192,7 +26219,7 @@ var RDSDBProxyProvider = class {
 			Value: v
 		});
 		if (toRemove.length > 0) try {
-			await client.send(new RemoveTagsFromResourceCommand$1({
+			await client.send(new RemoveTagsFromResourceCommand$2({
 				ResourceName: arn,
 				TagKeys: toRemove
 			}));
@@ -26200,7 +26227,7 @@ var RDSDBProxyProvider = class {
 			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId);
 		}
 		if (toAdd.length > 0) try {
-			await client.send(new AddTagsToResourceCommand$1({
+			await client.send(new AddTagsToResourceCommand$2({
 				ResourceName: arn,
 				Tags: toAdd
 			}));
@@ -26467,7 +26494,7 @@ var RDSDBProxyEndpointProvider = class {
 			TargetRole: e.TargetRole ?? "READ_WRITE"
 		};
 		if (e.DBProxyEndpointArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$9({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
+			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -26498,7 +26525,7 @@ var RDSDBProxyEndpointProvider = class {
 			Value: v
 		});
 		if (toRemove.length > 0) try {
-			await client.send(new RemoveTagsFromResourceCommand$1({
+			await client.send(new RemoveTagsFromResourceCommand$2({
 				ResourceName: arn,
 				TagKeys: toRemove
 			}));
@@ -26506,7 +26533,7 @@ var RDSDBProxyEndpointProvider = class {
 			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId);
 		}
 		if (toAdd.length > 0) try {
-			await client.send(new AddTagsToResourceCommand$1({
+			await client.send(new AddTagsToResourceCommand$2({
 				ResourceName: arn,
 				Tags: toAdd
 			}));
@@ -27106,10 +27133,15 @@ var DocDBProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting DocDB DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -27731,10 +27763,15 @@ var NeptuneProvider = class {
 			} catch (disableError) {
 				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
 			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$2({
 				DBClusterIdentifier: physicalId,
-				SkipFinalSnapshot: true
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId) this.logger.info(`Deleting Neptune DBCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of Neptune DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -28728,7 +28765,7 @@ var Route53Provider = class {
 		});
 		const idTail = physicalId.replace(/^\/hostedzone\//, "");
 		try {
-			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({
+			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({
 				ResourceType: "hostedzone",
 				ResourceId: idTail
 			}))).ResourceTagSet?.Tags);
@@ -29646,7 +29683,12 @@ var ElastiCacheProvider = class {
 	async deleteCacheCluster(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting CacheCluster ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new DeleteCacheClusterCommand({ CacheClusterId: physicalId }));
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
+			await this.getClient().send(new DeleteCacheClusterCommand({
+				CacheClusterId: physicalId,
+				...finalSnapshotId ? { FinalSnapshotIdentifier: finalSnapshotId } : {}
+			}));
+			if (finalSnapshotId) this.logger.info(`Deleting CacheCluster ${logicalId} with final snapshot ${finalSnapshotId} (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of CacheCluster ${logicalId}`);
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
@@ -29704,14 +29746,14 @@ var ElastiCacheProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new RemoveTagsFromResourceCommand$2({
+			await this.getClient().send(new RemoveTagsFromResourceCommand$1({
 				ResourceName: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ElastiCache resource ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new AddTagsToResourceCommand$2({
+			await this.getClient().send(new AddTagsToResourceCommand$1({
 				ResourceName: arn,
 				Tags: tagsToAdd
 			}));
@@ -29858,7 +29900,7 @@ var ElastiCacheProvider = class {
 	/** Best-effort tag fetch — failures omit the key without breaking the read. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -42415,7 +42457,7 @@ var ECRProvider = class {
 			if (!(err instanceof LifecyclePolicyNotFoundException)) throw err;
 		}
 		if (r.repositoryArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: r.repositoryArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: r.repositoryArn }))).tags);
 		} catch (err) {
 			if (!(err instanceof RepositoryNotFoundException)) throw err;
 		}
@@ -42784,6 +42826,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 					...resource.provisionedBy && { provisionedBy: resource.provisionedBy }
 				});
 				try {
+					let finalSnapshotIdentifier;
+					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
+					else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
+					else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
 					const provider = destroyProviderRegistry.getProviderFor({
 						resourceType: resource.resourceType,
 						provisionedBy: resource.provisionedBy
@@ -42799,7 +42846,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
 							await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
-								...ctx.removeProtection === true && { removeProtection: true }
+								...ctx.removeProtection === true && { removeProtection: true },
+								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 							});
 							lastDeleteError = null;
 							break;
@@ -42842,7 +42890,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException")) {
+					if (!isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -43145,6 +43193,7 @@ var NestedStackProvider = class {
 			...ctx.exportIndexStore && { exportIndexStore: ctx.exportIndexStore },
 			...ctx.destroyOptions?.profile && { profile: ctx.destroyOptions.profile },
 			...deleteContext?.removeProtection === true && { removeProtection: true },
+			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
 			...ctx.destroyOptions?.resourceTimeoutMs !== void 0 && { resourceTimeoutMs: ctx.destroyOptions.resourceTimeoutMs },
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
@@ -44258,6 +44307,8 @@ async function deployCommand(stacks, options) {
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
+					...options.skipFinalSnapshot && { skipFinalSnapshot: true },
+					finalSnapshotClients: stackAwsClients,
 					...options.strictGetatt && { strictGetAtt: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -44348,6 +44399,7 @@ function createDeployCommand() {
 		...stateOptions,
 		...stackOptions,
 		...deployOptions,
+		skipFinalSnapshotOption,
 		...contextOptions,
 		...annotationMessageOptions
 	].forEach((opt) => cmd.addOption(opt));
@@ -47133,6 +47185,7 @@ async function destroyCommand(stackArgs, options) {
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
 						...options.removeProtection === true && { removeProtection: true },
+						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 						...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 						...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
@@ -47148,6 +47201,7 @@ async function destroyCommand(stackArgs, options) {
 					stateBucket,
 					skipConfirmation: options.yes || options.force,
 					removeProtection: options.removeProtection === true,
+					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					exportIndexStore,
 					...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -47203,6 +47257,7 @@ function createDestroyCommand() {
 		...stackOptions,
 		...destroyOptions,
 		...resourceTimeoutOptions,
+		skipFinalSnapshotOption,
 		...contextOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
@@ -50615,6 +50670,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
 						...options.removeProtection === true && { removeProtection: true },
+						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 						...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 						...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
@@ -50630,6 +50686,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					stateBucket: setup.bucket,
 					skipConfirmation: options.yes || options.all === true,
 					removeProtection: options.removeProtection === true,
+					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					exportIndexStore: setup.exportIndexStore,
 					...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -50669,7 +50726,8 @@ function createStateDestroyCommand() {
 		...commonOptions,
 		...stateOptions,
 		...resourceTimeoutOptions,
-		allowUnsupportedTypesOption
+		allowUnsupportedTypesOption,
+		skipFinalSnapshotOption
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -63649,7 +63707,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;