@go-to-k/cdkd 0.275.5 → 0.276.0

package/dist/{deploy-engine-rn1TQits.js → deploy-engine-j0TmnJYJ.js}

@@ -7,7 +7,7 @@ import { SQSClient } from "@aws-sdk/client-sqs";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateSnapshotCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -18,6 +18,8 @@ import { CloudFrontClient, GetCloudFrontOriginAccessIdentityCommand } from "@aws
 import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
 import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
+import { CreateClusterSnapshotCommand, DescribeClusterSnapshotsCommand, DescribeClustersCommand, RedshiftClient } from "@aws-sdk/client-redshift";
+import { CreateSnapshotCommand as CreateSnapshotCommand$1, DescribeReplicationGroupsCommand, DescribeSnapshotsCommand as DescribeSnapshotsCommand$1, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { ACMClient } from "@aws-sdk/client-acm";
 import { LambdaMicrovmsClient } from "@aws-sdk/client-lambda-microvms";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -33,8 +35,6 @@ import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
-import { DescribeReplicationGroupsCommand, ElastiCacheClient } from "@aws-sdk/client-elasticache";
-import { DescribeClustersCommand, RedshiftClient } from "@aws-sdk/client-redshift";
 import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensearch";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -627,6 +627,8 @@ var AwsClients = class {
 	cloudWatchClient;
 	cloudWatchLogsClient;
 	bedrockAgentCoreControlClient;
+	redshiftClient;
+	elastiCacheClient;
 	acmClient;
 	lambdaMicrovmsClient;
 	config;
@@ -935,6 +937,32 @@ var AwsClients = class {
 		return this.getBedrockAgentCoreControlClient();
 	}
 	/**
+	* Get Redshift client
+	*/
+	getRedshiftClient() {
+		if (!this.redshiftClient) this.redshiftClient = new RedshiftClient({ ...this.clientOptions });
+		return this.redshiftClient;
+	}
+	/**
+	* Convenience getter for Redshift client
+	*/
+	get redshift() {
+		return this.getRedshiftClient();
+	}
+	/**
+	* Get ElastiCache client
+	*/
+	getElastiCacheClient() {
+		if (!this.elastiCacheClient) this.elastiCacheClient = new ElastiCacheClient({ ...this.clientOptions });
+		return this.elastiCacheClient;
+	}
+	/**
+	* Convenience getter for ElastiCache client
+	*/
+	get elastiCache() {
+		return this.getElastiCacheClient();
+	}
+	/**
 	* Destroy all clients
 	*/
 	destroy() {
@@ -956,6 +984,8 @@ var AwsClients = class {
 		this.cloudWatchClient?.destroy();
 		this.cloudWatchLogsClient?.destroy();
 		this.bedrockAgentCoreControlClient?.destroy();
+		this.redshiftClient?.destroy();
+		this.elastiCacheClient?.destroy();
 		this.acmClient?.destroy();
 		this.lambdaMicrovmsClient?.destroy();
 	}
@@ -7769,7 +7799,8 @@ const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
 	"wait 60 seconds",
 	"concurrent update operation",
 	"because it is in use",
-	"Rate exceeded"
+	"Rate exceeded",
+	"There is an operation running on the Cluster"
 ];
 /**
 * Patterns that mark an AWS error as a transient/retryable failure.
@@ -12038,9 +12069,10 @@ var CloudControlProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
+		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D6Y0zhd3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DeLTuWlm.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -15101,7 +15133,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"],
+			["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
@@ -15180,7 +15212,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DedicatedLogVolume", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"],
+			["DeleteAutomatedBackups", "delete-time lifecycle flag not threaded through cdkd destroy; final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
 			["DomainDnsIps", "not yet implemented by cdkd"],
@@ -17030,6 +17062,478 @@ function extractDeploymentEventError(err) {
 	return result;
 }
 
+//#endregion
+//#region src/provisioning/final-snapshot.ts
+/**
+* `DeletionPolicy: Snapshot` support (issues #1352 / #1353).
+*
+* CloudFormation creates a final snapshot BEFORE deleting a resource whose
+* `DeletionPolicy` is `Snapshot`. cdkd historically treated the policy as
+* `Delete` (no snapshot — silent data loss vs CFn, live-A/B-confirmed on
+* `AWS::EC2::Volume`). The delete paths now honor the policy through the
+* two mechanisms below; a Snapshot-tagged type supported by NEITHER (or one
+* routed via Cloud Control, which has no snapshot notion) is refused with an
+* actionable error unless `--skip-final-snapshot` opts into the data loss.
+*
+* The full CFn-documented Snapshot-capable type list (CFn refuses the
+* attribute on anything else): AWS::EC2::Volume, AWS::ElastiCache::CacheCluster,
+* AWS::ElastiCache::ReplicationGroup, AWS::Neptune::DBCluster,
+* AWS::RDS::DBCluster, AWS::RDS::DBInstance, AWS::Redshift::Cluster,
+* AWS::DocDB::DBCluster — all covered by one of the two mechanisms.
+*/
+/**
+* Types whose delete API takes an atomic final-snapshot parameter. The
+* destroy paths generate a snapshot identifier and pass it via
+* `DeleteContext.finalSnapshotIdentifier`; the type's SDK provider flips its
+* delete call from `SkipFinalSnapshot: true` to the final-snapshot form.
+*/
+const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBCluster",
+	"AWS::Neptune::DBCluster",
+	"AWS::DocDB::DBCluster",
+	"AWS::ElastiCache::CacheCluster"
+]);
+/**
+* Types with no atomic delete parameter, where cdkd snapshots explicitly
+* BEFORE the (routing-layer-agnostic) delete via
+* {@link createPreDeleteFinalSnapshot}. All three are CC-API-routed (no SDK
+* provider), so the pre-delete snapshot lives at the delete call sites, not
+* in a provider: `AWS::EC2::Volume` (EC2 `CreateSnapshot`, issue #1352),
+* `AWS::Redshift::Cluster` (`CreateClusterSnapshot`, issue #1353), and
+* `AWS::ElastiCache::ReplicationGroup` (ElastiCache `CreateSnapshot`
+* against the replication group, issue #1353).
+*/
+const PRE_DELETE_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
+	"AWS::EC2::Volume",
+	"AWS::Redshift::Cluster",
+	"AWS::ElastiCache::ReplicationGroup"
+]);
+/** Sanitize a physical id into the snapshot-identifier charset (shared by the
+* identifier builder and the pre-delete reuse-probe prefix match). */
+function sanitizeSnapshotBase(physicalId) {
+	let base = physicalId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+	if (!/^[a-z]/.test(base)) base = `r${base}`;
+	return base;
+}
+/**
+* The `<sanitized-physical-id>-final-` prefix every cdkd final snapshot of a
+* given source shares — the reuse-probe key for the name-keyed snapshot APIs
+* (Redshift / ElastiCache), the analogue of the EBS tag. Applies the same
+* per-service length cap as {@link buildFinalSnapshotIdentifier} so a
+* truncated generated name still matches its own prefix.
+*/
+function finalSnapshotNamePrefix(physicalId, resourceType) {
+	const maxLength = resourceType === "AWS::ElastiCache::CacheCluster" || resourceType === "AWS::ElastiCache::ReplicationGroup" ? 50 : 255;
+	return `${sanitizeSnapshotBase(physicalId).slice(0, maxLength - 22).replace(/-+$/, "")}-final-`;
+}
+/**
+* Build the final-snapshot identifier for a snapshot-creating delete.
+*
+* Constraints are the intersection of the RDS / Neptune / DocDB snapshot
+* identifier rules and the ElastiCache snapshot name rules: start with a
+* letter, letters/digits/hyphens only, no consecutive or trailing hyphen.
+* The physical id already satisfies the source API's naming rules; it is
+* lowercased (RDS canonicalizes to lowercase anyway) and defensively
+* re-sanitized. A UTC timestamp suffix keeps repeated deletes of a
+* re-created same-name resource from colliding; within ONE run the
+* identifier is generated once per resource, so delete retries reuse it.
+*/
+function buildFinalSnapshotIdentifier(physicalId, resourceType, now = /* @__PURE__ */ new Date()) {
+	const ts = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").replace("T", "-").toLowerCase();
+	return `${finalSnapshotNamePrefix(physicalId, resourceType)}${ts}`;
+}
+/** Tag key marking a cdkd-created final snapshot of an EBS volume. */
+const EBS_FINAL_SNAPSHOT_TAG_KEY = "cdkd:final-snapshot-of";
+/** Test seam (matches the `describe-type.ts` / macro-expander pattern). */
+const finalSnapshotDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+const PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS = 5e3;
+const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 3600 * 1e3;
+/** Post-snapshot settle budget for a Redshift cluster before its delete. */
+const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 1200 * 1e3;
+function errMsg(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function isVolumeNotFound(error) {
+	return (error instanceof Error ? error.name : "") === "InvalidVolume.NotFound" || errMsg(error).includes("InvalidVolume.NotFound");
+}
+/**
+* Create (or resume waiting on) the final EBS snapshot of a volume and wait
+* until it completes, mirroring CloudFormation's observable behavior — CFn
+* deletes the volume only after the final snapshot is done.
+*
+* Idempotent across destroy re-runs: an existing pending/completed snapshot
+* carrying the `cdkd:final-snapshot-of: <volumeId>` tag is reused instead of
+* creating a second one. Reusing a `completed` snapshot is safe HERE (and
+* only here) because an EBS volume id is AWS-generated and never reused, so
+* the tag can only ever point at THIS volume's data — unlike the name-keyed
+* Redshift / ElastiCache APIs, whose user-chosen ids repeat across
+* generations and therefore only resume an in-flight snapshot (see
+* {@link RESUMABLE_SNAPSHOT_STATUS}).
+*
+* @returns the snapshot id, or `null` when the volume no longer exists
+*   (nothing to snapshot; the subsequent delete is idempotent too).
+*/
+async function createEbsFinalSnapshot(client, volumeId, logicalId, logger) {
+	let snapshotId;
+	try {
+		snapshotId = (await client.send(new DescribeSnapshotsCommand({
+			OwnerIds: ["self"],
+			Filters: [{
+				Name: `tag:${EBS_FINAL_SNAPSHOT_TAG_KEY}`,
+				Values: [volumeId]
+			}, {
+				Name: "status",
+				Values: ["pending", "completed"]
+			}]
+		}))).Snapshots?.[0]?.SnapshotId;
+		if (snapshotId) logger.debug(`Reusing existing final snapshot ${snapshotId} for ${logicalId} (${volumeId}) from a previous destroy attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${volumeId}: ${errMsg(probeError)}`);
+	}
+	if (!snapshotId) try {
+		snapshotId = (await client.send(new CreateSnapshotCommand({
+			VolumeId: volumeId,
+			Description: `cdkd final snapshot for ${volumeId} (DeletionPolicy: Snapshot)`,
+			TagSpecifications: [{
+				ResourceType: "snapshot",
+				Tags: [{
+					Key: EBS_FINAL_SNAPSHOT_TAG_KEY,
+					Value: volumeId
+				}]
+			}]
+		}))).SnapshotId;
+	} catch (createError) {
+		if (isVolumeNotFound(createError)) {
+			logger.debug(`Volume ${volumeId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
+		}
+		throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${volumeId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	}
+	if (!snapshotId) throw new CdkdError(`CreateSnapshot for ${logicalId} (${volumeId}) returned no snapshot id. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	logger.info(`Creating final snapshot ${snapshotId} for ${logicalId} (${volumeId}) — DeletionPolicy: Snapshot`);
+	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
+	let notFoundPolls = 0;
+	for (;;) {
+		let state;
+		try {
+			state = (await client.send(new DescribeSnapshotsCommand({ SnapshotIds: [snapshotId] }))).Snapshots?.[0]?.State;
+			notFoundPolls = 0;
+		} catch (pollError) {
+			if (((pollError instanceof Error ? pollError.name : "") === "InvalidSnapshot.NotFound" || errMsg(pollError).includes("InvalidSnapshot.NotFound")) && ++notFoundPolls <= 24) state = void 0;
+			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}): ${errMsg(pollError)}. The volume was NOT deleted; re-run the destroy (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
+		}
+		if (state === "completed") {
+			logger.info(`Final snapshot ${snapshotId} completed for ${logicalId} (${volumeId})`);
+			return snapshotId;
+		}
+		if (state === "error") throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${volumeId}) entered 'error' state. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}) to complete. The volume was NOT deleted; the snapshot continues in AWS — re-run the destroy once it completes (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+	}
+}
+/**
+* Is this one of the typed final-snapshot failures the destroy call sites
+* must RETHROW before applying their "not found = already deleted"
+* idempotency heuristics? (Those heuristics match message substrings; a raw
+* snapshot-poll NotFound would otherwise be read as "resource already
+* deleted" and strand a live, un-snapshotted volume outside state.)
+*/
+function isFinalSnapshotError(error) {
+	return error instanceof CdkdError && (error.code === "FINAL_SNAPSHOT_FAILED" || error.code === "FINAL_SNAPSHOT_TIMEOUT" || error.code === "FINAL_SNAPSHOT_UNSUPPORTED");
+}
+/**
+* Refusal for an atomic-final-snapshot type whose state records
+* `provisionedBy: 'cc-api'` (#614 silent-drop routing / `--recreate-via-cc-api`).
+* Cloud Control `DeleteResource` has no final-snapshot parameter and
+* `CloudControlProvider` cannot honor `finalSnapshotIdentifier`, so deleting
+* via that route would silently drop the promised snapshot — refuse instead.
+*/
+function ccRoutedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
+	return new CdkdError(`${logicalId} (${resourceType}) has DeletionPolicy: Snapshot, but the resource is managed via the Cloud Control API route (provisionedBy: cc-api), which has no final-snapshot delete parameter — deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Create a snapshot manually (e.g. aws rds create-db-snapshot / aws elasticache create-snapshot), then re-run with ${skipFlagHint} to delete WITHOUT cdkd's final snapshot (DATA LOSS otherwise), or retain the resource (DeletionPolicy: Retain) and delete it manually.`, "FINAL_SNAPSHOT_UNSUPPORTED");
+}
+/**
+* Build the refusal error for a Snapshot-tagged type cdkd cannot snapshot.
+* Thrown by the delete call sites BEFORE any delete is issued. Since #1353
+* every CFn-documented Snapshot-capable type is covered, so this only fires
+* for a type CloudFormation itself would refuse the attribute on (hand-
+* edited templates / imported state).
+*/
+function unsupportedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
+	return new CdkdError(`${logicalId} (${resourceType}) has DeletionPolicy: Snapshot, but cdkd does not implement final snapshots for this type (CloudFormation itself only supports Snapshot on: EC2 Volume, ElastiCache CacheCluster / ReplicationGroup, Neptune / RDS / DocDB clusters, RDS instances, Redshift clusters). Deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Re-run with ${skipFlagHint} to delete WITHOUT a final snapshot (DATA LOSS), or retain the resource (DeletionPolicy: Retain) and delete it manually after snapshotting.`, "FINAL_SNAPSHOT_UNSUPPORTED");
+}
+/**
+* Dispatch the pre-delete final snapshot for a `PRE_DELETE_SNAPSHOT_TYPES`
+* member: create (or resume) the snapshot and wait until it is ready, so the
+* caller's subsequent (routing-layer-agnostic) delete cannot lose data.
+*
+* @returns the snapshot id, or `null` when the source resource no longer
+*   exists (nothing to snapshot; the subsequent delete is idempotent too).
+*/
+async function createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, clients, logger) {
+	switch (resourceType) {
+		case "AWS::EC2::Volume": return createEbsFinalSnapshot(clients.ec2, physicalId, logicalId, logger);
+		case "AWS::Redshift::Cluster": return createRedshiftFinalSnapshot(clients.redshift, physicalId, logicalId, logger);
+		case "AWS::ElastiCache::ReplicationGroup": return createReplicationGroupFinalSnapshot(clients.elastiCache, physicalId, logicalId, logger);
+		default: throw new CdkdError(`No pre-delete final-snapshot implementation for ${logicalId} (${resourceType}). The resource was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	}
+}
+/**
+* Shared wait loop for the name-keyed snapshot APIs (Redshift / ElastiCache):
+* poll a status getter until the ready status, tolerating a bounded window of
+* eventual-consistency NotFound right after creation, and wrapping every
+* other poll failure as a typed FINAL_SNAPSHOT error (see the EBS loop's
+* comment for why the wrap is load-bearing).
+*/
+async function waitForNamedSnapshot(opts) {
+	const { snapshotId, logicalId, sourceId, noun, logger } = opts;
+	logger.info(`${opts.reused ? "Resuming" : "Creating"} final snapshot ${snapshotId} for ${logicalId} (${sourceId}) — DeletionPolicy: Snapshot`);
+	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
+	let notFoundPolls = 0;
+	for (;;) {
+		let status;
+		try {
+			status = await opts.pollStatus();
+			notFoundPolls = 0;
+		} catch (pollError) {
+			if (opts.isTransientNotFound(pollError) && ++notFoundPolls <= 24) status = void 0;
+			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}): ${errMsg(pollError)}. The ${noun} was NOT deleted; re-run the delete (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
+		}
+		if (status === opts.readyStatus) {
+			logger.info(`Final snapshot ${snapshotId} ready for ${logicalId} (${sourceId})`);
+			return snapshotId;
+		}
+		if (status !== void 0 && opts.failedStatuses.includes(status)) throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${sourceId}) entered '${status}' state. The ${noun} was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}) to become ready. The ${noun} was NOT deleted; the snapshot continues in AWS — re-run the delete once it is ready (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+	}
+}
+function errorNameOrMessageIncludes(error, token) {
+	return (error instanceof Error ? error.name : "") === token || errMsg(error).includes(token);
+}
+/** Max reuse-probe pages to walk (bounded so a huge snapshot history cannot
+* stall a delete; a miss only costs one extra snapshot, never data). */
+const REUSE_PROBE_MAX_PAGES = 10;
+/**
+* Matcher for a snapshot cdkd itself generated for `physicalId`: the exact
+* `<sanitized-id>-final-<yyyymmdd>-<hhmmss>` shape, NOT a bare prefix. A bare
+* prefix would also match a USER's snapshot named e.g. `mydb-final-backup`
+* and silently adopt it as "the" final snapshot.
+*/
+function generatedSnapshotNameMatcher(physicalId, resourceType) {
+	const escaped = finalSnapshotNamePrefix(physicalId, resourceType).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`^${escaped}\\d{8}-\\d{6}$`);
+}
+/**
+* Is this snapshot resumable from an interrupted delete attempt?
+*
+* ONLY an in-flight (`creating`) snapshot qualifies. This is load-bearing,
+* not conservatism: Redshift / ElastiCache identifiers are USER-CHOSEN and
+* REUSABLE, and a manual snapshot outlives the resource it came from — so a
+* deploy -> destroy -> deploy -> destroy cycle of a fixed-name cluster would
+* find generation 1's `available` snapshot, skip `CreateSnapshot`, and delete
+* generation 2 with NO snapshot of its data. That is precisely the silent
+* data loss this whole feature exists to prevent (reviewer catch).
+*
+* A `creating` snapshot cannot span generations: the new generation can only
+* be created after the old resource is gone, by which time its snapshot has
+* settled to `available`. The cost of the narrower rule is one redundant
+* snapshot when a delete is re-run after its snapshot already completed —
+* cost, never data loss, and the timestamped identifier never collides.
+*/
+const RESUMABLE_SNAPSHOT_STATUS = "creating";
+/**
+* Redshift `CreateClusterSnapshot` + wait to `available` (issue #1353).
+* Idempotent across delete re-runs: a creating/available manual snapshot of
+* this cluster whose identifier carries cdkd's `<cluster>-final-` prefix is
+* reused instead of creating a second one.
+*/
+async function createRedshiftFinalSnapshot(client, clusterId, logicalId, logger) {
+	const matches = generatedSnapshotNameMatcher(clusterId, "AWS::Redshift::Cluster");
+	let snapshotId;
+	try {
+		let marker;
+		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
+			const existing = await client.send(new DescribeClusterSnapshotsCommand({
+				ClusterIdentifier: clusterId,
+				SnapshotType: "manual",
+				...marker !== void 0 && { Marker: marker }
+			}));
+			snapshotId = existing.Snapshots?.find((s) => s.SnapshotIdentifier !== void 0 && matches.test(s.SnapshotIdentifier) && s.Status === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotIdentifier;
+			marker = existing.Marker;
+			if (marker === void 0) break;
+		}
+		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${clusterId}) from a previous delete attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${clusterId}: ${errMsg(probeError)}`);
+	}
+	const reused = snapshotId !== void 0;
+	if (!snapshotId) {
+		const newId = buildFinalSnapshotIdentifier(clusterId, "AWS::Redshift::Cluster");
+		try {
+			await client.send(new CreateClusterSnapshotCommand({
+				SnapshotIdentifier: newId,
+				ClusterIdentifier: clusterId
+			}));
+			snapshotId = newId;
+		} catch (createError) {
+			if (errorNameOrMessageIncludes(createError, "ClusterNotFoundFault")) {
+				logger.debug(`Redshift cluster ${clusterId} no longer exists — skipping final snapshot for ${logicalId}`);
+				return null;
+			}
+			if (errorNameOrMessageIncludes(createError, "InvalidClusterStateFault")) {
+				logger.info(`Redshift cluster ${clusterId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
+				return null;
+			}
+			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${clusterId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The cluster was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		}
+	}
+	const readySnapshotId = await waitForNamedSnapshot({
+		snapshotId,
+		logicalId,
+		sourceId: clusterId,
+		noun: "cluster",
+		reused,
+		readyStatus: "available",
+		failedStatuses: [
+			"failed",
+			"cancelled",
+			"deleted"
+		],
+		pollStatus: async () => {
+			return (await client.send(new DescribeClusterSnapshotsCommand({ SnapshotIdentifier: snapshotId }))).Snapshots?.[0]?.Status;
+		},
+		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "ClusterSnapshotNotFoundFault"),
+		logger
+	});
+	await waitForRedshiftClusterSettled(client, clusterId, logicalId, logger);
+	return readySnapshotId;
+}
+/**
+* Poll a Redshift cluster until it is out of the transient state a just-taken
+* snapshot leaves it in, so the caller's delete is not rejected. Bounded and
+* NEVER fatal: a NotFound means the cluster is already gone, and exhausting
+* the budget only logs — the delete (and its own retry) still runs.
+*/
+async function waitForRedshiftClusterSettled(client, clusterId, logicalId, logger) {
+	const deadline = Date.now() + REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS;
+	for (;;) {
+		let status;
+		try {
+			status = (await client.send(new DescribeClustersCommand({ ClusterIdentifier: clusterId }))).Clusters?.[0]?.ClusterStatus;
+		} catch (pollError) {
+			if (errorNameOrMessageIncludes(pollError, "ClusterNotFoundFault")) return;
+			logger.debug(`Could not read Redshift cluster ${clusterId} while waiting for it to settle: ${errMsg(pollError)}`);
+			return;
+		}
+		if (status === void 0 || status === "available") {
+			await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+			return;
+		}
+		if (Date.now() >= deadline) {
+			logger.info(`Redshift cluster ${clusterId} (${logicalId}) is still '${status}' after the post-snapshot settle wait — proceeding with the delete anyway.`);
+			return;
+		}
+		logger.debug(`Waiting for Redshift cluster ${clusterId} to settle (status: ${status})`);
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+	}
+}
+/**
+* ElastiCache final snapshot for a replication group + wait to `available`
+* (issue #1353), then the caller's delete proceeds.
+*
+* **Cluster-mode matters** (found live 2026-08-03, not by the mocked unit
+* tests): `CreateSnapshot` accepts `ReplicationGroupId` ONLY for a
+* cluster-mode-ENABLED (sharded) group. For the cluster-mode-DISABLED
+* default — which is what a plain CDK / CFn replication group is — AWS
+* rejects it with "Cannot snapshot a replication group with cluster-mode
+* disabled. Please specify a cache cluster instead.", and the snapshot must
+* name the PRIMARY member cache cluster instead. Both shapes produce one
+* snapshot of the group's data; only the parameter differs.
+*
+* Idempotent across delete re-runs via the `<group>-final-` name prefix,
+* probed against whichever source this group's mode uses.
+*
+* Redis only — Memcached / snapshot-incapable node types surface AWS's
+* rejection wrapped, matching CloudFormation's DELETE_FAILED for the same
+* template.
+*/
+async function createReplicationGroupFinalSnapshot(client, replicationGroupId, logicalId, logger) {
+	let snapshotSource;
+	try {
+		const group = (await client.send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: replicationGroupId }))).ReplicationGroups?.[0];
+		if (group === void 0) {
+			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
+		}
+		if (group.ClusterEnabled === true) snapshotSource = { ReplicationGroupId: replicationGroupId };
+		else {
+			const member = group.NodeGroups?.flatMap((n) => n.NodeGroupMembers ?? []).find((m) => m.CurrentRole === "primary")?.CacheClusterId ?? group.MemberClusters?.[0];
+			if (member === void 0) throw new CdkdError(`Replication group ${replicationGroupId} (${logicalId}) has cluster-mode disabled but reports no member cache cluster to snapshot. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+			snapshotSource = { CacheClusterId: member };
+		}
+	} catch (describeError) {
+		if (describeError instanceof CdkdError) throw describeError;
+		if (errorNameOrMessageIncludes(describeError, "ReplicationGroupNotFoundFault")) {
+			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
+		}
+		throw new CdkdError(`Failed to read replication group ${replicationGroupId} (${logicalId}) to pick the final snapshot source required by DeletionPolicy: Snapshot: ${errMsg(describeError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED", describeError instanceof Error ? describeError : void 0);
+	}
+	const matches = generatedSnapshotNameMatcher(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
+	let snapshotId;
+	try {
+		let marker;
+		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
+			const existing = await client.send(new DescribeSnapshotsCommand$1({
+				...snapshotSource,
+				...marker !== void 0 && { Marker: marker }
+			}));
+			snapshotId = existing.Snapshots?.find((s) => s.SnapshotName !== void 0 && matches.test(s.SnapshotName) && s.SnapshotStatus === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotName;
+			marker = existing.Marker;
+			if (marker === void 0) break;
+		}
+		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${replicationGroupId}) from a previous delete attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${replicationGroupId}: ${errMsg(probeError)}`);
+	}
+	const reused = snapshotId !== void 0;
+	if (!snapshotId) {
+		const newId = buildFinalSnapshotIdentifier(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
+		try {
+			await client.send(new CreateSnapshotCommand$1({
+				...snapshotSource,
+				SnapshotName: newId
+			}));
+			snapshotId = newId;
+		} catch (createError) {
+			if (errorNameOrMessageIncludes(createError, "ReplicationGroupNotFoundFault")) {
+				logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+				return null;
+			}
+			if (errorNameOrMessageIncludes(createError, "InvalidReplicationGroupStateFault")) {
+				logger.info(`Replication group ${replicationGroupId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
+				return null;
+			}
+			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${replicationGroupId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		}
+	}
+	return waitForNamedSnapshot({
+		snapshotId,
+		logicalId,
+		sourceId: replicationGroupId,
+		noun: "replication group",
+		reused,
+		readyStatus: "available",
+		failedStatuses: ["failed"],
+		pollStatus: async () => {
+			return (await client.send(new DescribeSnapshotsCommand$1({ SnapshotName: snapshotId }))).Snapshots?.[0]?.SnapshotStatus;
+		},
+		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "SnapshotNotFoundFault"),
+		logger
+	});
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -17230,6 +17734,23 @@ async function withResourceDeadline(operation, opts) {
 //#endregion
 //#region src/deployment/rollback-executor.ts
 /**
+* `UpdateReplacePolicy: Snapshot` on a rollback's delete-of-the-NEW-resource
+* (issue #1354): honor it where it costs nothing — an atomic-final-snapshot
+* type on the SDK route gets a generated identifier threaded into the delete
+* context. Every other Snapshot shape (pre-delete types, cc-api routing)
+* keeps the plain delete DELIBERATELY: the rollback executor's delete-new is
+* load-bearing for same-name re-creation (orphaning would break the revert),
+* it has no snapshot-client plumbing by design (registry + region only), and
+* the new resource was created by the deploy being reverted. Recorded as a
+* scope decision on issue #1354.
+*/
+function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
+	if (record.updateReplacePolicy !== "Snapshot") return void 0;
+	if (!ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) return void 0;
+	if ((record.provisionedBy ?? fallbackProvisionedBy) === "cc-api") return void 0;
+	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
+}
+/**
 * Retry schedule for a re-create that must wait out a name-release delay:
 * an async delete's late name release ("already exists") or the SQS 60s
 * same-name cooldown (issue #1206). 2s/4s/8s then capped at 10s over 8
@@ -17480,7 +18001,13 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					resourceType: op.resourceType,
 					provisionedBy: current.provisionedBy ?? op.provisionedBy
 				});
-				await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+				{
+					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						expectedRegion: ctx.region,
+						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
+					});
+				}
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
 				await afterOp?.(op.logicalId);
@@ -17522,7 +18049,13 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				} catch (createError) {
 					if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+					{
+						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+						await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+							expectedRegion: ctx.region,
+							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
+						});
+					}
 					deletedNewFirst = true;
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
@@ -17553,7 +18086,11 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				};
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
-					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						expectedRegion: ctx.region,
+						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
+					});
 				} catch (deleteError) {
 					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
 					result.warnings++;
@@ -17817,7 +18354,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.275.5";
+	return "0.276.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19341,17 +19878,46 @@ var DeployEngine = class {
 		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n")}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
 	}
 	/**
+	* The `Snapshot`-policy gate every engine delete site runs BEFORE its
+	* delete (issues #1352 / #1353 / #1354). Given the resource's effective
+	* policy for THIS delete (`DeletionPolicy` on the destroy / removal paths,
+	* `UpdateReplacePolicy` on the replacement paths):
+	*
+	*   - not `Snapshot` (or `--skip-final-snapshot`) → no-op.
+	*   - atomic type, SDK-routed → returns the generated identifier for the
+	*     provider's atomic final-snapshot delete parameter.
+	*   - atomic type, cc-api-routed → refuses (Cloud Control has no
+	*     final-snapshot parameter; `CloudControlProvider.delete` also
+	*     fail-closes on the context field as defense-in-depth).
+	*   - `PRE_DELETE_SNAPSHOT_TYPES` (EC2 Volume / Redshift Cluster /
+	*     ElastiCache ReplicationGroup) → creates the snapshot and waits for
+	*     it here, then returns undefined (the subsequent delete is plain).
+	*   - anything else Snapshot-tagged → refuses.
+	*/
+	async prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, policy) {
+		if (policy !== "Snapshot" || this.options.skipFinalSnapshot === true) return void 0;
+		if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) && currentResource.provisionedBy !== "cc-api") return buildFinalSnapshotIdentifier(currentResource.physicalId, resourceType);
+		if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
+		if (PRE_DELETE_SNAPSHOT_TYPES.has(resourceType)) {
+			await createPreDeleteFinalSnapshot(resourceType, currentResource.physicalId, logicalId, this.options.finalSnapshotClients ?? getAwsClients(), this.logger);
+			return;
+		}
+		throw unsupportedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
+	}
+	/**
 	* `--replace` delete-first fallback for a property-driven replacement of a
 	* custom-named resource: delete the old name holder, then re-create it
 	* under the same name. Shared by the create-first collision catch (issue
 	* #960 follow-up) and the name-idempotent same-id guard (issue #1238) so
 	* the two --replace escape hatches cannot drift apart.
 	*/
-	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps) {
+	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy) {
+		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 		try {
 			await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 				expectedRegion: this.stackRegion,
-				forceDataDelete: this.options.forceStatefulRecreation === true
+				forceDataDelete: this.options.forceStatefulRecreation === true,
+				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 			});
 		} catch (deleteError) {
 			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
@@ -19492,10 +20058,12 @@ var DeployEngine = class {
 						if (updateReplacePolicy === "Retain") this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
 						else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
+							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 							try {
 								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true
+									forceDataDelete: this.options.forceStatefulRecreation === true,
+									...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId }
 								});
 								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
@@ -19525,22 +20093,32 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. The resource has a user-supplied physical name, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed), or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 							this.logger.info(`  Create-first collided with the custom-named resource and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy);
 						}
 						if (!deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place. Rename the resource in your CDK code — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. The resource has a user-supplied physical name; either change or remove the explicit name in your CDK code (a fresh or generated name lets the safe create-first order proceed), or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy);
 						}
 						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 						else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
+							let cleanupFinalSnapshotId;
+							let snapshotBlockedDelete = false;
 							try {
+								cleanupFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+							} catch (snapshotError) {
+								if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
+								snapshotBlockedDelete = true;
+								this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
+							}
+							if (!snapshotBlockedDelete) try {
 								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
 									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true
+									forceDataDelete: this.options.forceStatefulRecreation === true,
+									...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
 								});
 								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
@@ -19586,10 +20164,12 @@ var DeployEngine = class {
 								if (statefulReason && this.options.forceStatefulRecreation !== true) throw new CdkdError(`--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
+							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
 							try {
 								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
 									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true
+									forceDataDelete: this.options.forceStatefulRecreation === true,
+									...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId }
 								});
 							} catch (deleteError) {
 								const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
@@ -19641,13 +20221,17 @@ var DeployEngine = class {
 					delete stateResources[logicalId];
 					break;
 				}
+				const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, deletionPolicy);
 				const deleteProvider = this.providerRegistry.getProviderFor({
 					resourceType,
 					provisionedBy: currentResource.provisionedBy
 				}).provider;
 				this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
 				try {
-					await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, { expectedRegion: this.stackRegion }), logicalId, 3, 5e3, deleteProvider);
+					await this.withRetry(() => deleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+						expectedRegion: this.stackRegion,
+						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
+					}), logicalId, 3, 5e3, deleteProvider);
 				} catch (deleteError) {
 					const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
 					if (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException")) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
@@ -19879,5 +20463,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-rn1TQits.js.map
+export { TemplateParser as $, CdkdError as $t, yellow as A, resolveAutoAssetStorage as At, IntrinsicFunctionResolver as B, MIGRATE_TMP_PREFIX as Bt, renderStatefulReason as C, AssetManifestLoader as Ct, gray as D, getDefaultStateBucketName as Dt, cyan as E, synthesisStatusMessage as Et, findActionableSilentDrops as F, resolveUseCdkBootstrapAssets as Ft, resolveExplicitPhysicalId as G, processStackMessages as Gt, refStateLookupFromResource as H, uploadCfnTemplate as Ht, CloudControlProvider as I, stateBucketExistenceConfirmed as It, DiffCalculator as J, AwsClients as Jt, assertRegionMatch as K, clearBucketRegionCache as Kt, slowCcOperationTimeoutMs as L, warnDeprecatedNoPrefixCliFlag as Lt, collectInlinePolicyNamesManagedBySiblings as M, resolveSkipPrefix as Mt, clearOnUpdateRemoval as N, resolveStateBucketWithDefault as Nt, green as O, getLegacyStateBucketName as Ot, ProviderRegistry as P, resolveStateBucketWithDefaultAndSource as Pt, DagBuilder as Q, AssetError as Qt, disableInstanceApiTermination as R, CFN_TEMPLATE_BODY_LIMIT as Rt, isStatefulRecreateTargetSync as S, runDockerStreaming as St, bold as T, Synthesizer as Tt, WAFv2WebACLProvider as U, expectedOwnerParam as Ut, cfnRefValueFromPhysicalId as V, findLargeInlineResources as Vt, normalizeAwsTagsToCfn as W, AssemblyReader as Wt, withRetry as X, resetAwsClients as Xt, describeTypeWithThrottleRetry as Y, getAwsClients as Yt, isRetryableTransientError as Z, setAwsClients as Zt, createPreDeleteFinalSnapshot as _, formatError as _n, validateContainerRepoName as _t, DeploymentEventsStore as a, LocalStartServiceError as an, stringifyValue as at, extractDeploymentEventError as b, withErrorHandling as bn, getDockerCmd as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as cn, createAssetRedirectResolver as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ResourceTimeoutError as dn, AssetModeResolver as dt, ConfigError as en, LockManager as et, computeImplicitDeleteEdges as f, ResourceUpdateNotSupportedError as fn, BOOTSTRAP_MARKER_PREFIX as ft, ccRoutedFinalSnapshotError as g, SynthesisError as gn, validateAssetBucketName as gt, buildFinalSnapshotIdentifier as h, StateError as hn, parseBootstrapMarker as ht, DeploymentEventsReader as i, LocalMigrateError as in, AssetPublisher as it, IAMRoleProvider as j, resolveCaptureObservedState as jt, red as k, resolveApp as kt, replayRollback as l, PartialFailureError as ln, loadPublishableAssetManifest as lt, PRE_DELETE_SNAPSHOT_TYPES as m, StackTerminationProtectionError as mn, getBootstrapMarkerKey as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DeployCancelledError as nn, rebuildClientForBucketRegion as nt, planFailedOps as o, LockError as on, WorkGraph as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, StackHasActiveImportsError as pn, ensureAssetStorage as pt, applyRoleArnIfSet as q, resolveBucketRegion as qt, DeployEngine as r, LocalInvokeBuildError as rn, shouldRetainResource as rt, planRollback as s, MissingCdkCliError as sn, buildAssetRedirectMap as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DependencyError as tn, S3StateBackend as tt, withResourceDeadline as u, ProvisioningError as un, rewriteTemplateAssetReferences as ut, isFinalSnapshotError as v, isCdkdError as vn, buildDockerImage as vt, formatResourceLine as w, getDockerImageBySourceHash as wt, MULTI_REGION_RECREATE_BLOCKED_TYPES as x, __exportAll as xn, runDockerForeground as xt, unsupportedFinalSnapshotError as y, normalizeAwsError as yn, formatDockerLoginError as yt, isTerminationProtectionPropagationError as z, CFN_TEMPLATE_URL_LIMIT as zt };
+//# sourceMappingURL=deploy-engine-j0TmnJYJ.js.map