@go-to-k/cdkd 0.276.3 → 0.276.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as TemplateParser, $t as CdkdError, A as yellow, At as resolveAutoAssetStorage, B as IntrinsicFunctionResolver, Bt as MIGRATE_TMP_PREFIX, C as renderStatefulReason, Ct as AssetManifestLoader, D as gray, Dt as getDefaultStateBucketName, E as cyan, Et as synthesisStatusMessage, F as findActionableSilentDrops, Ft as resolveUseCdkBootstrapAssets, G as resolveExplicitPhysicalId, Gt as processStackMessages, H as refStateLookupFromResource, Ht as uploadCfnTemplate, I as CloudControlProvider, It as stateBucketExistenceConfirmed, J as DiffCalculator, Jt as AwsClients, K as assertRegionMatch, L as slowCcOperationTimeoutMs, Lt as warnDeprecatedNoPrefixCliFlag, M as collectInlinePolicyNamesManagedBySiblings, Mt as resolveSkipPrefix, N as clearOnUpdateRemoval, Nt as resolveStateBucketWithDefault, O as green, Ot as getLegacyStateBucketName, P as ProviderRegistry, Pt as resolveStateBucketWithDefaultAndSource, Q as DagBuilder, R as disableInstanceApiTermination, Rt as CFN_TEMPLATE_BODY_LIMIT, S as isStatefulRecreateTargetSync, St as runDockerStreaming, T as bold, Tt as Synthesizer, U as WAFv2WebACLProvider, Ut as expectedOwnerParam, V as cfnRefValueFromPhysicalId, Vt as findLargeInlineResources, W as normalizeAwsTagsToCfn, Wt as AssemblyReader, X as withRetry, Xt as resetAwsClients, Y as describeTypeWithThrottleRetry, Yt as getAwsClients, Z as isRetryableTransientError, Zt as setAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateContainerRepoName, a as DeploymentEventsStore, an as LocalStartServiceError, at as stringifyValue, b as extractDeploymentEventError, bn as withErrorHandling, bt as getDockerCmd, c as replayFailedOperations, cn as NestedStackChildDirectDestroyError, ct as createAssetRedirectResolver, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ResourceTimeoutError, dt as AssetModeResolver, et as LockManager, f as computeImplicitDeleteEdges, fn as ResourceUpdateNotSupportedError, ft as BOOTSTRAP_MARKER_PREFIX, g as ccRoutedFinalSnapshotError, gt as validateAssetBucketName, h as buildFinalSnapshotIdentifier, ht as parseBootstrapMarker, i as DeploymentEventsReader, in as LocalMigrateError, it as AssetPublisher, j as IAMRoleProvider, jt as resolveCaptureObservedState, k as red, kt as resolveApp, l as replayRollback, ln as PartialFailureError, lt as loadPublishableAssetManifest, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackTerminationProtectionError, mt as getBootstrapMarkerKey, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DeployCancelledError, nt as rebuildClientForBucketRegion, o as planFailedOps, ot as WorkGraph, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as StackHasActiveImportsError, pt as ensureAssetStorage, q as applyRoleArnIfSet, qt as resolveBucketRegion, r as DeployEngine, rn as LocalInvokeBuildError$1, rt as shouldRetainResource, s as planRollback, sn as MissingCdkCliError, st as buildAssetRedirectMap, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as S3StateBackend, u as withResourceDeadline, un as ProvisioningError, ut as rewriteTemplateAssetReferences, v as isFinalSnapshotError, vt as buildDockerImage, w as formatResourceLine, wt as getDockerImageBySourceHash, x as MULTI_REGION_RECREATE_BLOCKED_TYPES, xt as runDockerForeground, y as unsupportedFinalSnapshotError, yn as normalizeAwsError, yt as formatDockerLoginError, z as isTerminationProtectionPropagationError, zt as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-gQzltBso.js";
+import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-BwPdeLbJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DFSI7iBe.js";
+import { t as ASGProvider } from "./asg-provider-Wm3Q60jN.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -51247,6 +51247,20 @@ async function findJournalCandidates(backend, prefix) {
 	return refs;
 }
 /**
+* The `DeletionPolicy Snapshot — ...` note a planned Snapshot delete carries
+* (issue #1366). Consults the SAME mechanism matrix the replay will run, so
+* the preview cannot promise a final snapshot for a shape the executor is
+* about to REFUSE (a cc-api-routed atomic type, or a type with no snapshot
+* mechanism at all). `skipFinalSnapshot` is threaded in because the
+* classifier is pure and cannot see CLI flags — under the opt-out every shape
+* plain-deletes, refusals included, so the flag is checked first.
+*/
+function snapshotNote(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
+	if (skipFinalSnapshot) return "DeletionPolicy Snapshot — NO final snapshot (--skip-final-snapshot)";
+	if (refusesFinalSnapshot(resourceType, effectiveProvisionedBy)) return "DeletionPolicy Snapshot — cdkd cannot snapshot this resource; the rollback will REFUSE it (re-run with --skip-final-snapshot to delete without one)";
+	return "DeletionPolicy Snapshot — final snapshot, then delete";
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -51257,7 +51271,7 @@ function actionLabel(item, skipFinalSnapshot) {
 	const rep = replacement ? " [replacement occurred, best-effort revert]" : "";
 	switch (action) {
 		case "delete": return `  - delete   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "delete-with-final-snapshot": return skipFinalSnapshot ? `  - delete   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Snapshot — NO final snapshot (--skip-final-snapshot)]` : `  - delete   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Snapshot — final snapshot, then delete]`;
+		case "delete-with-final-snapshot": return `  - delete   ${op.logicalId} (${op.resourceType}) [${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
 		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${op.logicalId} (${op.resourceType}) [--orphan]`;
 		case "revert": return `  - revert   ${op.logicalId} (${op.resourceType})${rep}`;
@@ -51280,7 +51294,7 @@ function failedActionLabel(item, skipFinalSnapshot) {
 	switch (action) {
 		case "revert-failed-update": return `  - revert   ${op.logicalId} (${op.resourceType}) [FAILED update — remote state unknown, force-applying previous properties]`;
 		case "delete-failed-create": return `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create]`;
-		case "delete-failed-create-with-final-snapshot": return skipFinalSnapshot ? `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Snapshot — NO final snapshot (--skip-final-snapshot)]` : `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Snapshot — final snapshot, then delete]`;
+		case "delete-failed-create-with-final-snapshot": return `  - delete   ${op.logicalId} (${op.resourceType}) [FAILED create, ${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
 		case "orphan-failed-create-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
 		case "skip-failed-unknown": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${op.logicalId} (${op.resourceType}) — failed ${op.changeType} left nothing to revert`;
@@ -51368,11 +51382,11 @@ async function rollbackCommand(stackArg, options) {
 				if (segment.failedOperations && segment.failedOperations.length > 0) if (options.revertFailed) {
 					const failedPlan = planFailedOps(segment.failedOperations, planStateView);
 					for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-					applyFailedPlanToPreview(failedPlan, planStateView);
+					applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
 				} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
 				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
-				applyPlanToPreview(plan, planStateView);
+				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
 			}
 			logger.info("");
 			if (!skipConfirmation) {
@@ -51506,16 +51520,30 @@ async function rollbackCommand(stackArg, options) {
 	}
 }
 /**
+* Will the replay REFUSE this planned Snapshot delete instead of performing
+* it (issue #1368)? The preview must not unwind a record for an op that
+* never runs — the same question {@link snapshotNote} answers for the label,
+* asked with the same predicate and the same route, so the label and the
+* previewed state cannot disagree.
+*/
+function planItemWillBeRefused(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
+	if (skipFinalSnapshot) return false;
+	return refusesFinalSnapshot(resourceType, effectiveProvisionedBy);
+}
+/**
 * Apply a planned segment's effect to the plan-preview state so the NEXT
 * (older) segment's plan is classified against already-unwound state.
 * Mirrors what `replayRollback` mutates, without touching AWS.
 */
-function applyPlanToPreview(plan, previewState) {
+function applyPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	for (const item of plan) {
 		const { op, action } = item;
 		switch (action) {
-			case "delete":
 			case "delete-with-final-snapshot":
+				if (planItemWillBeRefused(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)) break;
+				if (op.changeType === "CREATE") delete previewState[op.logicalId];
+				break;
+			case "delete":
 			case "orphan-retain":
 			case "orphan-flag":
 				if (op.changeType === "CREATE") delete previewState[op.logicalId];
@@ -51533,12 +51561,15 @@ function applyPlanToPreview(plan, previewState) {
 * Apply a planned FAILED-op revert's effect to the plan-preview state
 * (issue #1198). Mirrors `replayFailedOperations` without touching AWS.
 */
-function applyFailedPlanToPreview(plan, previewState) {
+function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	for (const item of plan) {
 		const { op, action } = item;
 		switch (action) {
-			case "delete-failed-create":
 			case "delete-failed-create-with-final-snapshot":
+				if (planItemWillBeRefused(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)) break;
+				delete previewState[op.logicalId];
+				break;
+			case "delete-failed-create":
 			case "orphan-failed-create-retain":
 				delete previewState[op.logicalId];
 				break;
@@ -63738,7 +63769,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;