@go-to-k/cdkd 0.276.1 → 0.276.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as TemplateParser, $t as CdkdError, A as yellow, At as resolveAutoAssetStorage, B as IntrinsicFunctionResolver, Bt as MIGRATE_TMP_PREFIX, C as renderStatefulReason, Ct as AssetManifestLoader, D as gray, Dt as getDefaultStateBucketName, E as cyan, Et as synthesisStatusMessage, F as findActionableSilentDrops, Ft as resolveUseCdkBootstrapAssets, G as resolveExplicitPhysicalId, Gt as processStackMessages, H as refStateLookupFromResource, Ht as uploadCfnTemplate, I as CloudControlProvider, It as stateBucketExistenceConfirmed, J as DiffCalculator, Jt as AwsClients, K as assertRegionMatch, L as slowCcOperationTimeoutMs, Lt as warnDeprecatedNoPrefixCliFlag, M as collectInlinePolicyNamesManagedBySiblings, Mt as resolveSkipPrefix, N as clearOnUpdateRemoval, Nt as resolveStateBucketWithDefault, O as green, Ot as getLegacyStateBucketName, P as ProviderRegistry, Pt as resolveStateBucketWithDefaultAndSource, Q as DagBuilder, R as disableInstanceApiTermination, Rt as CFN_TEMPLATE_BODY_LIMIT, S as isStatefulRecreateTargetSync, St as runDockerStreaming, T as bold, Tt as Synthesizer, U as WAFv2WebACLProvider, Ut as expectedOwnerParam, V as cfnRefValueFromPhysicalId, Vt as findLargeInlineResources, W as normalizeAwsTagsToCfn, Wt as AssemblyReader, X as withRetry, Xt as resetAwsClients, Y as describeTypeWithThrottleRetry, Yt as getAwsClients, Z as isRetryableTransientError, Zt as setAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateContainerRepoName, a as DeploymentEventsStore, an as LocalStartServiceError, at as stringifyValue, b as extractDeploymentEventError, bn as withErrorHandling, bt as getDockerCmd, c as replayFailedOperations, cn as NestedStackChildDirectDestroyError, ct as createAssetRedirectResolver, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ResourceTimeoutError, dt as AssetModeResolver, et as LockManager, f as computeImplicitDeleteEdges, fn as ResourceUpdateNotSupportedError, ft as BOOTSTRAP_MARKER_PREFIX, g as ccRoutedFinalSnapshotError, gt as validateAssetBucketName, h as buildFinalSnapshotIdentifier, ht as parseBootstrapMarker, i as DeploymentEventsReader, in as LocalMigrateError, it as AssetPublisher, j as IAMRoleProvider, jt as resolveCaptureObservedState, k as red, kt as resolveApp, l as replayRollback, ln as PartialFailureError, lt as loadPublishableAssetManifest, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackTerminationProtectionError, mt as getBootstrapMarkerKey, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DeployCancelledError, nt as rebuildClientForBucketRegion, o as planFailedOps, ot as WorkGraph, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as StackHasActiveImportsError, pt as ensureAssetStorage, q as applyRoleArnIfSet, qt as resolveBucketRegion, r as DeployEngine, rn as LocalInvokeBuildError$1, rt as shouldRetainResource, s as planRollback, sn as MissingCdkCliError, st as buildAssetRedirectMap, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as S3StateBackend, u as withResourceDeadline, un as ProvisioningError, ut as rewriteTemplateAssetReferences, v as isFinalSnapshotError, vt as buildDockerImage, w as formatResourceLine, wt as getDockerImageBySourceHash, x as MULTI_REGION_RECREATE_BLOCKED_TYPES, xt as runDockerForeground, y as unsupportedFinalSnapshotError, yn as normalizeAwsError, yt as formatDockerLoginError, z as isTerminationProtectionPropagationError, zt as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-C581XZwt.js";
+import { $ as TemplateParser, $t as CdkdError, A as yellow, At as resolveAutoAssetStorage, B as IntrinsicFunctionResolver, Bt as MIGRATE_TMP_PREFIX, C as renderStatefulReason, Ct as AssetManifestLoader, D as gray, Dt as getDefaultStateBucketName, E as cyan, Et as synthesisStatusMessage, F as findActionableSilentDrops, Ft as resolveUseCdkBootstrapAssets, G as resolveExplicitPhysicalId, Gt as processStackMessages, H as refStateLookupFromResource, Ht as uploadCfnTemplate, I as CloudControlProvider, It as stateBucketExistenceConfirmed, J as DiffCalculator, Jt as AwsClients, K as assertRegionMatch, L as slowCcOperationTimeoutMs, Lt as warnDeprecatedNoPrefixCliFlag, M as collectInlinePolicyNamesManagedBySiblings, Mt as resolveSkipPrefix, N as clearOnUpdateRemoval, Nt as resolveStateBucketWithDefault, O as green, Ot as getLegacyStateBucketName, P as ProviderRegistry, Pt as resolveStateBucketWithDefaultAndSource, Q as DagBuilder, R as disableInstanceApiTermination, Rt as CFN_TEMPLATE_BODY_LIMIT, S as isStatefulRecreateTargetSync, St as runDockerStreaming, T as bold, Tt as Synthesizer, U as WAFv2WebACLProvider, Ut as expectedOwnerParam, V as cfnRefValueFromPhysicalId, Vt as findLargeInlineResources, W as normalizeAwsTagsToCfn, Wt as AssemblyReader, X as withRetry, Xt as resetAwsClients, Y as describeTypeWithThrottleRetry, Yt as getAwsClients, Z as isRetryableTransientError, Zt as setAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateContainerRepoName, a as DeploymentEventsStore, an as LocalStartServiceError, at as stringifyValue, b as extractDeploymentEventError, bn as withErrorHandling, bt as getDockerCmd, c as replayFailedOperations, cn as NestedStackChildDirectDestroyError, ct as createAssetRedirectResolver, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ResourceTimeoutError, dt as AssetModeResolver, et as LockManager, f as computeImplicitDeleteEdges, fn as ResourceUpdateNotSupportedError, ft as BOOTSTRAP_MARKER_PREFIX, g as ccRoutedFinalSnapshotError, gt as validateAssetBucketName, h as buildFinalSnapshotIdentifier, ht as parseBootstrapMarker, i as DeploymentEventsReader, in as LocalMigrateError, it as AssetPublisher, j as IAMRoleProvider, jt as resolveCaptureObservedState, k as red, kt as resolveApp, l as replayRollback, ln as PartialFailureError, lt as loadPublishableAssetManifest, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackTerminationProtectionError, mt as getBootstrapMarkerKey, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DeployCancelledError, nt as rebuildClientForBucketRegion, o as planFailedOps, ot as WorkGraph, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as StackHasActiveImportsError, pt as ensureAssetStorage, q as applyRoleArnIfSet, qt as resolveBucketRegion, r as DeployEngine, rn as LocalInvokeBuildError$1, rt as shouldRetainResource, s as planRollback, sn as MissingCdkCliError, st as buildAssetRedirectMap, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as S3StateBackend, u as withResourceDeadline, un as ProvisioningError, ut as rewriteTemplateAssetReferences, v as isFinalSnapshotError, vt as buildDockerImage, w as formatResourceLine, wt as getDockerImageBySourceHash, x as MULTI_REGION_RECREATE_BLOCKED_TYPES, xt as runDockerForeground, y as unsupportedFinalSnapshotError, yn as normalizeAwsError, yt as formatDockerLoginError, z as isTerminationProtectionPropagationError, zt as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-gQzltBso.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Cfex3rAs.js";
+import { t as ASGProvider } from "./asg-provider-DFSI7iBe.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -718,12 +718,13 @@ const destroyOptions = [
 * `AWS::ElastiCache::ReplicationGroup`; and a refusal when cdkd cannot
 * honor the policy (a Cloud-Control-routed atomic type — its delete has no
 * final-snapshot parameter). Attached to `cdkd deploy` (template-removal +
-* replacement deletes), `cdkd destroy`, and `cdkd state destroy` — NOT to
-* the shared `destroyOptions` array, which `cdkd orphan` also consumes
-* (orphan never deletes AWS resources, so the flag would be inert noise
-* there).
+* replacement deletes), `cdkd destroy`, `cdkd state destroy`, and
+* `cdkd rollback` (issue #1358 — a rolled-back CREATE under
+* `DeletionPolicy: Snapshot` is snapshotted, then deleted) — NOT to the
+* shared `destroyOptions` array, which `cdkd orphan` also consumes (orphan
+* never deletes AWS resources, so the flag would be inert noise there).
 */
-const skipFinalSnapshotOption = new Option("--skip-final-snapshot", "Delete resources whose DeletionPolicy (or, on replacements, UpdateReplacePolicy) is 'Snapshot' WITHOUT creating the final snapshot the policy promises (DATA LOSS — explicit opt-out of CloudFormation parity). By default cdkd creates the final snapshot for every CloudFormation-supported type (RDS DBInstance / DBCluster, Neptune / DocDB clusters, ElastiCache CacheCluster / ReplicationGroup, Redshift Cluster, EC2 Volume) and refuses the delete when it cannot — e.g. a resource managed via the Cloud Control API route, whose delete has no final-snapshot parameter.").default(false);
+const skipFinalSnapshotOption = new Option("--skip-final-snapshot", "Delete resources whose DeletionPolicy (or, on replacements, UpdateReplacePolicy) is 'Snapshot' WITHOUT creating the final snapshot the policy promises (DATA LOSS — explicit opt-out of CloudFormation parity). By default cdkd creates the final snapshot for every CloudFormation-supported type (RDS DBInstance / DBCluster, Neptune / DocDB clusters, ElastiCache CacheCluster / ReplicationGroup, Redshift Cluster, EC2 Volume) and refuses the delete when it cannot — e.g. a resource managed via the Cloud Control API route, whose delete has no final-snapshot parameter. On 'cdkd rollback' the flag governs the rolled-back CREATE's DeletionPolicy; a reverse-replacement delete of the NEW resource keeps its own bounded UpdateReplacePolicy behavior and is unaffected.").default(false);
 
 //#endregion
 //#region src/cli/commands/state-file-keys.ts
@@ -51245,13 +51246,19 @@ async function findJournalCandidates(backend, prefix) {
 	}
 	return refs;
 }
-/** Human label for a planned rollback action (plan preview). */
-function actionLabel(item) {
+/**
+* Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
+* is threaded in because the classifier is pure (it cannot see CLI flags) and
+* the Snapshot label would otherwise promise a final snapshot the run is about
+* to skip — a data-loss-relevant lie in the one preview the user reads.
+*/
+function actionLabel(item, skipFinalSnapshot) {
 	const { op, action, replacement } = item;
 	const rep = replacement ? " [replacement occurred, best-effort revert]" : "";
 	switch (action) {
 		case "delete": return `  - delete   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain/Snapshot — left in AWS]`;
+		case "delete-with-final-snapshot": return skipFinalSnapshot ? `  - delete   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Snapshot — NO final snapshot (--skip-final-snapshot)]` : `  - delete   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Snapshot — final snapshot, then delete]`;
+		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${op.logicalId} (${op.resourceType}) [--orphan]`;
 		case "revert": return `  - revert   ${op.logicalId} (${op.resourceType})${rep}`;
 		case "reverse-replacement": return `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
@@ -51262,12 +51269,19 @@ function actionLabel(item) {
 		case "skip-already-done": return `  - skip     ${op.logicalId} (${op.resourceType}) — already reverted`;
 	}
 }
-/** Human label for a planned FAILED-op revert (issue #1198, --revert-failed). */
-function failedActionLabel(item) {
+/**
+* Human label for a planned FAILED-op revert (issue #1198, --revert-failed).
+* Takes `skipFinalSnapshot` for the same reason {@link actionLabel} does: the
+* classifier is pure, so without the flag the Snapshot label would promise a
+* final snapshot the run is about to skip (issue #1362).
+*/
+function failedActionLabel(item, skipFinalSnapshot) {
 	const { op, action } = item;
 	switch (action) {
 		case "revert-failed-update": return `  - revert   ${op.logicalId} (${op.resourceType}) [FAILED update — remote state unknown, force-applying previous properties]`;
 		case "delete-failed-create": return `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create]`;
+		case "delete-failed-create-with-final-snapshot": return skipFinalSnapshot ? `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Snapshot — NO final snapshot (--skip-final-snapshot)]` : `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Snapshot — final snapshot, then delete]`;
+		case "orphan-failed-create-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
 		case "skip-failed-unknown": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed ${op.changeType} left nothing to revert`;
 		case "skip-failed-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no previous state available`;
@@ -51294,6 +51308,7 @@ async function rollbackCommand(stackArg, options) {
 	warnIfDeprecatedRegion(options);
 	const setup = await setupStateBackend(options);
 	const skipConfirmation = options.force === true || options.yes === true;
+	let stackAwsClients;
 	try {
 		let ref;
 		if (stackArg) ref = resolveSingleRegion(stackArg, await setup.stateBackend.listStacks(), options.stackRegion);
@@ -51312,6 +51327,12 @@ async function rollbackCommand(stackArg, options) {
 		}
 		const stackName = ref.stackName;
 		const region = ref.region ?? setup.region;
+		stackAwsClients = new AwsClients({
+			region,
+			...options.profile && { profile: options.profile }
+		});
+		setAwsClients(stackAwsClients);
+		const finalSnapshotClients = stackAwsClients;
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
@@ -51346,11 +51367,11 @@ async function rollbackCommand(stackArg, options) {
 				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${segment.reason}${segment.runId ? `, run ${segment.runId}` : ""}):`);
 				if (segment.failedOperations && segment.failedOperations.length > 0) if (options.revertFailed) {
 					const failedPlan = planFailedOps(segment.failedOperations, planStateView);
-					for (const item of failedPlan) logger.info(failedActionLabel(item));
+					for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
 					applyFailedPlanToPreview(failedPlan, planStateView);
 				} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
-				for (const item of plan) logger.info(actionLabel(item));
+				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
 				applyPlanToPreview(plan, planStateView);
 			}
 			logger.info("");
@@ -51370,7 +51391,9 @@ async function rollbackCommand(stackArg, options) {
 				providerRegistry,
 				region,
 				logger: logger.child("rollback"),
-				recordEvent: (e) => eventRecorder.record(e)
+				recordEvent: (e) => eventRecorder.record(e),
+				finalSnapshotClients,
+				skipFinalSnapshot: options.skipFinalSnapshot === true
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
@@ -51475,6 +51498,10 @@ async function rollbackCommand(stackArg, options) {
 			});
 		}
 	} finally {
+		if (stackAwsClients) {
+			setAwsClients(setup.awsClients);
+			stackAwsClients.destroy();
+		}
 		setup.dispose();
 	}
 }
@@ -51488,6 +51515,7 @@ function applyPlanToPreview(plan, previewState) {
 		const { op, action } = item;
 		switch (action) {
 			case "delete":
+			case "delete-with-final-snapshot":
 			case "orphan-retain":
 			case "orphan-flag":
 				if (op.changeType === "CREATE") delete previewState[op.logicalId];
@@ -51510,6 +51538,8 @@ function applyFailedPlanToPreview(plan, previewState) {
 		const { op, action } = item;
 		switch (action) {
 			case "delete-failed-create":
+			case "delete-failed-create-with-final-snapshot":
+			case "orphan-failed-create-retain":
 				delete previewState[op.logicalId];
 				break;
 			case "revert-failed-update":
@@ -51520,7 +51550,7 @@ function applyFailedPlanToPreview(plan, previewState) {
 	}
 }
 function createRollbackCommand() {
-	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(stackRegionOption()).addHelpText("after", [
+	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(skipFinalSnapshotOption).addOption(stackRegionOption()).addHelpText("after", [
 		"",
 		"Examples:",
 		"  cdkd rollback MyStack",
@@ -51528,6 +51558,7 @@ function createRollbackCommand() {
 		"  cdkd rollback MyStack --force",
 		"  cdkd rollback MyStack --orphan MyBucket --orphan MyTable",
 		"  cdkd rollback MyStack --revert-failed   # also revert the failed in-flight resource",
+		"  cdkd rollback MyStack --skip-final-snapshot  # DeletionPolicy Snapshot → delete without the snapshot",
 		"  cdkd rollback MyStack --stack-region us-west-2",
 		"",
 		"Exit codes: 0 = clean, 2 = partial (journal kept for re-run), 1 = hard error."
@@ -63707,7 +63738,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;