aws-cdk 2.1143.0 → 2.1145.0

package/README.md

@@ -207,6 +207,44 @@ $ cdk diff --app='node bin/main.js' MyStackName
 $ cdk diff --app='node bin/main.js' MyStackName --template=path/to/template.yml
 ```
 
+Use `--fail-on` to control which kind of change makes the command exit with code 1. It takes the same
+values as `cdk deploy --require-approval`:
+
+- `--fail-on=any-change`: fail on any difference. `--fail` is an alias for this value.
+- `--fail-on=broadening`: fail only on changes that broaden security permissions, such as new IAM
+  statements or security group rules. All differences are still shown.
+- `--fail-on=destructive`: fail only on changes that replace, delete or orphan an existing resource.
+  See below. `cdk deploy --require-approval=destructive` uses the same classification.
+- `--fail-on=never`: never fail. `--no-fail` is an alias for this value.
+
+```console
+# Fail in CI only when a change broadens security permissions
+$ cdk diff --fail-on=broadening
+```
+
+`--fail-on` cannot be combined with `--fail` or `--no-fail`. When none of them is given, the command does
+not fail, unless the `aws-cdk:enableDiffNoFail` feature flag is set to `false`, in which case it fails on
+any difference.
+
+`--fail-on=destructive` lists the resources that would be replaced, deleted or orphaned, and exits with
+code 1. Changes that update resources in place or add new resources do not cause a failure. This is
+useful in CI to stop changes that would lose data, such as a stateful resource whose logical ID
+changed after it was moved to another construct.
+
+```console
+$ cdk diff --fail-on=destructive MyStackName
+...
+❌  Found 1 destructive change(s) (--fail-on=destructive):
+  MyStackName: AWS::DynamoDB::Table MyTable MyTable794EDED1 will be orphaned
+```
+
+Whether a property change replaces the resource is determined by the change set, so use the default
+`--method=auto` or `--method=change-set` for accurate results. With `--method=template`, a change to
+a property that requires replacement is always reported as a replacement, and a change to a property
+that may require replacement is reported as "may be replaced", which also causes a failure.
+With `--security-only`, changes that are likely mangled non-ASCII characters are not filtered out,
+so they can also be reported as destructive.
+
 The stack header shows the environment the stack will be deployed to. For environment-agnostic
 stacks this is the resolved account and region, not `unknown-account`/`unknown-region`. It is
 omitted when diffing against a local template with `--template`, which does not contact AWS.
@@ -268,6 +306,27 @@ currently deployed stack to the template and tags that are about to be deployed
 will skip deployment if they are identical. Use `--force` to override this behavior
 and always deploy the stack.
 
+#### Requiring approval
+
+`--require-approval` (or `requireApproval` in `cdk.json`) controls which changes need a manual
+confirmation before they are deployed:
+
+- `never`: approval is never required.
+- `any-change`: approval is required for any change to the stack.
+- `broadening` (default): approval is required if changes broaden permissions or security group rules.
+- `destructive`: approval is required if changes replace, delete or orphan an existing resource,
+  including resources in nested stacks. The affected resources are listed before the confirmation.
+  Changes that only broaden permissions do not require approval in this mode. With `--method=direct`,
+  no change set is created, so a change to a property that may require replacement also requires approval.
+
+When approval is required but no terminal is attached, for example in CI, the deployment fails.
+Use `--yes` to confirm automatically.
+
+```console
+# Stop before anything is replaced or deleted, deploy everything else unattended
+$ cdk deploy --require-approval=destructive
+```
+
 #### Disabling Rollback
 
 If a resource fails to be created or updated, the deployment will *roll back* before the CLI returns. All changes made
@@ -1564,6 +1623,11 @@ that can be set in many different ways (such as `~/.cdk.json`).
 $ # Check the current status of telemetry
 $ cdk cli-telemetry --status
 ```
+
+Telemetry is delivered by a short-lived background process, so the CLI exits without waiting for the
+network. That also means nothing is reported in the CLI's own output if delivery fails; set
+[`CDK_TELEMETRY_SENDER_DEBUG=1`](#environment) to see it.
+
 ### `cdk flags`
 
 View and modify your feature flag configurations.
@@ -1931,9 +1995,14 @@ in `build` will be executed by the "watch" process before deployment.
 The following environment variables affect aws-cdk:
 
 - `COLUMNS`: When the CLI cannot detect the terminal width (for example, when output is piped or running in CI), this standard variable is used as the rendering width for `cdk diff` tables. If unset, tables render at their natural width.
+- `CDK_DISABLE_CLI_TELEMETRY`: If set to `true`, disable CLI telemetry collection (see [`cdk cli-telemetry`](#cdk-cli-telemetry)).
 - `CDK_DISABLE_VERSION_CHECK`: If set, disable automatic check for newer versions.
 - `CDK_NEW_BOOTSTRAP`: use the modern bootstrapping stack.
 - `CDK_ROLE_SESSION_NAME`: customize the session name used when the CLI assumes a role (for example `cdk-hnb659fds-deploy-role`). When unset, the CLI defaults to `aws-cdk-<username>`. Useful for attributing deployments in CloudTrail when running from a CI/CD pipeline.
+- `CDK_TELEMETRY_SENDER_DEBUG`: If set to `1`, print diagnostics from telemetry delivery. Telemetry is
+  sent by a short-lived background process that the CLI does not wait for, so its output is normally
+  discarded; setting this passes it through to stderr. Only useful when investigating why telemetry is
+  not arriving.
 
 ### Region resolution
 

package/THIRD_PARTY_LICENSES

@@ -4326,7 +4326,7 @@ The aws-cdk package includes the following third-party software/licensing:
 
 ----------------
 
-** @aws-sdk/core@3.978.0 - https://www.npmjs.com/package/@aws-sdk/core/v/3.978.0 | Apache-2.0
+** @aws-sdk/core@3.978.1 - https://www.npmjs.com/package/@aws-sdk/core/v/3.978.1 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -4531,7 +4531,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-cognito-identity@3.972.70 - https://www.npmjs.com/package/@aws-sdk/credential-provider-cognito-identity/v/3.972.70 | Apache-2.0
+** @aws-sdk/credential-provider-cognito-identity@3.972.71 - https://www.npmjs.com/package/@aws-sdk/credential-provider-cognito-identity/v/3.972.71 | Apache-2.0
                                 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -4737,7 +4737,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-env@3.972.71 - https://www.npmjs.com/package/@aws-sdk/credential-provider-env/v/3.972.71 | Apache-2.0
+** @aws-sdk/credential-provider-env@3.972.72 - https://www.npmjs.com/package/@aws-sdk/credential-provider-env/v/3.972.72 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -4942,11 +4942,11 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-http@3.972.73 - https://www.npmjs.com/package/@aws-sdk/credential-provider-http/v/3.972.73 | Apache-2.0
+** @aws-sdk/credential-provider-http@3.972.74 - https://www.npmjs.com/package/@aws-sdk/credential-provider-http/v/3.972.74 | Apache-2.0
 
 ----------------
 
-** @aws-sdk/credential-provider-ini@3.973.16 - https://www.npmjs.com/package/@aws-sdk/credential-provider-ini/v/3.973.16 | Apache-2.0
+** @aws-sdk/credential-provider-ini@3.973.17 - https://www.npmjs.com/package/@aws-sdk/credential-provider-ini/v/3.973.17 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -5151,11 +5151,11 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-login@3.972.78 - https://www.npmjs.com/package/@aws-sdk/credential-provider-login/v/3.972.78 | Apache-2.0
+** @aws-sdk/credential-provider-login@3.972.79 - https://www.npmjs.com/package/@aws-sdk/credential-provider-login/v/3.972.79 | Apache-2.0
 
 ----------------
 
-** @aws-sdk/credential-provider-node@3.972.83 - https://www.npmjs.com/package/@aws-sdk/credential-provider-node/v/3.972.83 | Apache-2.0
+** @aws-sdk/credential-provider-node@3.972.84 - https://www.npmjs.com/package/@aws-sdk/credential-provider-node/v/3.972.84 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -5360,7 +5360,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-process@3.972.71 - https://www.npmjs.com/package/@aws-sdk/credential-provider-process/v/3.972.71 | Apache-2.0
+** @aws-sdk/credential-provider-process@3.972.72 - https://www.npmjs.com/package/@aws-sdk/credential-provider-process/v/3.972.72 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -5565,7 +5565,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-sso@3.973.15 - https://www.npmjs.com/package/@aws-sdk/credential-provider-sso/v/3.973.15 | Apache-2.0
+** @aws-sdk/credential-provider-sso@3.973.16 - https://www.npmjs.com/package/@aws-sdk/credential-provider-sso/v/3.973.16 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -5770,7 +5770,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-provider-web-identity@3.972.77 - https://www.npmjs.com/package/@aws-sdk/credential-provider-web-identity/v/3.972.77 | Apache-2.0
+** @aws-sdk/credential-provider-web-identity@3.972.78 - https://www.npmjs.com/package/@aws-sdk/credential-provider-web-identity/v/3.972.78 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -5975,7 +5975,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-providers@3.1135.0 - https://www.npmjs.com/package/@aws-sdk/credential-providers/v/3.1135.0 | Apache-2.0
+** @aws-sdk/credential-providers@3.1145.0 - https://www.npmjs.com/package/@aws-sdk/credential-providers/v/3.1145.0 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -7207,11 +7207,11 @@ Apache License
 
 ----------------
 
-** @aws-sdk/nested-clients@3.997.45 - https://www.npmjs.com/package/@aws-sdk/nested-clients/v/3.997.45 | Apache-2.0
+** @aws-sdk/nested-clients@3.997.46 - https://www.npmjs.com/package/@aws-sdk/nested-clients/v/3.997.46 | Apache-2.0
 
 ----------------
 
-** @aws-sdk/signature-v4-multi-region@3.996.46 - https://www.npmjs.com/package/@aws-sdk/signature-v4-multi-region/v/3.996.46 | Apache-2.0
+** @aws-sdk/signature-v4-multi-region@3.996.47 - https://www.npmjs.com/package/@aws-sdk/signature-v4-multi-region/v/3.996.47 | Apache-2.0
                                 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -7417,7 +7417,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/token-providers@3.1129.0 - https://www.npmjs.com/package/@aws-sdk/token-providers/v/3.1129.0 | Apache-2.0
+** @aws-sdk/token-providers@3.1138.0 - https://www.npmjs.com/package/@aws-sdk/token-providers/v/3.1138.0 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -7622,7 +7622,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/xml-builder@3.972.40 - https://www.npmjs.com/package/@aws-sdk/xml-builder/v/3.972.40 | Apache-2.0
+** @aws-sdk/xml-builder@3.972.41 - https://www.npmjs.com/package/@aws-sdk/xml-builder/v/3.972.41 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -8361,7 +8361,7 @@ Apache License
 
 ----------------
 
-** @smithy/core@3.33.3 - https://www.npmjs.com/package/@smithy/core/v/3.33.3 | Apache-2.0
+** @smithy/core@3.35.0 - https://www.npmjs.com/package/@smithy/core/v/3.35.0 | Apache-2.0
                                 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -8567,7 +8567,7 @@ Apache License
 
 ----------------
 
-** @smithy/credential-provider-imds@4.4.16 - https://www.npmjs.com/package/@smithy/credential-provider-imds/v/4.4.16 | Apache-2.0
+** @smithy/credential-provider-imds@4.5.2 - https://www.npmjs.com/package/@smithy/credential-provider-imds/v/4.5.2 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -9182,7 +9182,7 @@ Apache License
 
 ----------------
 
-** @smithy/node-http-handler@4.11.3 - https://www.npmjs.com/package/@smithy/node-http-handler/v/4.11.3 | Apache-2.0
+** @smithy/node-http-handler@4.12.1 - https://www.npmjs.com/package/@smithy/node-http-handler/v/4.12.1 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -9797,7 +9797,7 @@ Apache License
 
 ----------------
 
-** @smithy/signature-v4@5.6.12 - https://www.npmjs.com/package/@smithy/signature-v4/v/5.6.12 | Apache-2.0
+** @smithy/signature-v4@5.7.3 - https://www.npmjs.com/package/@smithy/signature-v4/v/5.7.3 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -10208,7 +10208,7 @@ Apache License
 
 ----------------
 
-** @smithy/types@4.17.2 - https://www.npmjs.com/package/@smithy/types/v/4.17.2 | Apache-2.0
+** @smithy/types@4.19.0 - https://www.npmjs.com/package/@smithy/types/v/4.19.0 | Apache-2.0
                                 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -10936,7 +10936,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ----------------
 
-** cdk-from-cfn@0.333.0 - https://www.npmjs.com/package/cdk-from-cfn/v/0.333.0 | MIT OR Apache-2.0
+** cdk-from-cfn@0.336.0 - https://www.npmjs.com/package/cdk-from-cfn/v/0.336.0 | MIT OR Apache-2.0
 
 ----------------
 
@@ -11604,7 +11604,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ----------------
 
-** ip-address@10.4.0 - https://www.npmjs.com/package/ip-address/v/10.4.0 | MIT
+** ip-address@10.7.2 - https://www.npmjs.com/package/ip-address/v/10.7.2 | MIT
 Copyright (C) 2011 by Beau Gunderson
 
 Permission is hereby granted, free of charge, to any person obtaining a copy

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "comment": "Generated at 2026-09-23T15:30:57Z by generate.sh",
-  "commit": "9c6bd0e"
+  "comment": "Generated at 2026-10-08T00:44:21Z by generate.sh",
+  "commit": "13877dc"
 }

package/lib/api-private-error.d.ts

@@ -0,0 +1 @@
+export { ToolkitError } from '../../@aws-cdk/toolkit-lib/lib/toolkit/toolkit-error';

package/lib/api-private-error.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolkitError = void 0;
+/* eslint-disable import/no-relative-packages */
+// Mimics `api-private.ts`, but intentionally smaller: it exports only `ToolkitError`, so the detached
+// telemetry sender's bundle does not pull in the whole toolkit.
+var toolkit_error_1 = require("../../@aws-cdk/toolkit-lib/lib/toolkit/toolkit-error");
+Object.defineProperty(exports, "ToolkitError", { enumerable: true, get: function () { return toolkit_error_1.ToolkitError; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLXByaXZhdGUtZXJyb3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhcGktcHJpdmF0ZS1lcnJvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxnREFBZ0Q7QUFDaEQsc0dBQXNHO0FBQ3RHLGdFQUFnRTtBQUNoRSxzRkFBb0Y7QUFBM0UsNkdBQUEsWUFBWSxPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyogZXNsaW50LWRpc2FibGUgaW1wb3J0L25vLXJlbGF0aXZlLXBhY2thZ2VzICovXG4vLyBNaW1pY3MgYGFwaS1wcml2YXRlLnRzYCwgYnV0IGludGVudGlvbmFsbHkgc21hbGxlcjogaXQgZXhwb3J0cyBvbmx5IGBUb29sa2l0RXJyb3JgLCBzbyB0aGUgZGV0YWNoZWRcbi8vIHRlbGVtZXRyeSBzZW5kZXIncyBidW5kbGUgZG9lcyBub3QgcHVsbCBpbiB0aGUgd2hvbGUgdG9vbGtpdC5cbmV4cG9ydCB7IFRvb2xraXRFcnJvciB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi90b29sa2l0L3Rvb2xraXQtZXJyb3InO1xuIl19

package/lib/api-private.d.ts

@@ -11,4 +11,3 @@ export * from '../../@aws-cdk/toolkit-lib/lib/api/tags/private';
 export * from '../../@aws-cdk/toolkit-lib/lib/private/activity-printer';
 export * from '../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/borrowed-assembly';
 export * from '../../@aws-cdk/toolkit-lib/lib/toolkit/private/count-assembly-results';
-export { throwIfValidationFailures } from '../../@aws-cdk/toolkit-lib/lib/toolkit/private/validation-report';

package/lib/api-private.js

@@ -36,7 +36,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.throwIfValidationFailures = exports.formatExpressStabilizationWarning = exports.createIgnoreMatcher = exports.Diagnosis = exports.ChangeSetDescriber = exports.cfnApi = exports.deployStack = void 0;
+exports.formatExpressStabilizationWarning = exports.createIgnoreMatcher = exports.Diagnosis = exports.ChangeSetDescriber = exports.cfnApi = exports.deployStack = void 0;
 /* eslint-disable import/no-relative-packages */
 var deploy_stack_1 = require("../../@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack");
 Object.defineProperty(exports, "deployStack", { enumerable: true, get: function () { return deploy_stack_1.deployStack; } });
@@ -54,6 +54,4 @@ __exportStar(require("../../@aws-cdk/toolkit-lib/lib/api/tags/private"), exports
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/private/activity-printer"), exports);
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/borrowed-assembly"), exports);
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/toolkit/private/count-assembly-results"), exports);
-var validation_report_1 = require("../../@aws-cdk/toolkit-lib/lib/toolkit/private/validation-report");
-Object.defineProperty(exports, "throwIfValidationFailures", { enumerable: true, get: function () { return validation_report_1.throwIfValidationFailures; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLXByaXZhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhcGktcHJpdmF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxnREFBZ0Q7QUFDaEQsNEZBQTBGO0FBQWpGLDJHQUFBLFdBQVcsT0FBQTtBQUVwQixpR0FBaUY7QUFDakYsOEVBQW9GO0FBQTNFLGlIQUFBLGtCQUFrQixPQUFBO0FBQzNCLHFGQUFvRjtBQUEzRSxzR0FBQSxTQUFTLE9BQUE7QUFFbEIsaUZBQXVGO0FBQTlFLG1IQUFBLG1CQUFtQixPQUFBO0FBQzVCLCtFQUFvRztBQUEzRixnSUFBQSxpQ0FBaUMsT0FBQTtBQUMxQyxnRkFBOEQ7QUFDOUQsa0ZBQWdFO0FBQ2hFLDBGQUF3RTtBQUN4RSw4R0FBNEY7QUFDNUYsd0dBQXNGO0FBQ3RGLHNHQUE2RztBQUFwRyw4SEFBQSx5QkFBeUIsT0FBQSIsInNvdXJjZXNDb250ZW50IjpbIi8qIGVzbGludC1kaXNhYmxlIGltcG9ydC9uby1yZWxhdGl2ZS1wYWNrYWdlcyAqL1xuZXhwb3J0IHsgZGVwbG95U3RhY2sgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RlcGxveW1lbnRzL2RlcGxveS1zdGFjayc7XG5leHBvcnQgdHlwZSB7IERlcGxveVN0YWNrT3B0aW9ucyBhcyBEZXBsb3lTdGFja0FwaU9wdGlvbnMsIERlc3Ryb3lTdGFja1Jlc3VsdCB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvZGVwbG95LXN0YWNrJztcbmV4cG9ydCAqIGFzIGNmbkFwaSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RlcGxveW1lbnRzL2Nmbi1hcGknO1xuZXhwb3J0IHsgQ2hhbmdlU2V0RGVzY3JpYmVyIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jaGFuZ2Utc2V0cyc7XG5leHBvcnQgeyBEaWFnbm9zaXMgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RpYWdub3NpbmcvZGlhZ25vc2lzJztcbmV4cG9ydCB0eXBlIHsgQ2hhbmdlU2V0UmVwb3J0IH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jaGFuZ2Utc2V0cyc7XG5leHBvcnQgeyBjcmVhdGVJZ25vcmVNYXRjaGVyIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL3V0aWwvZ2xvYi1tYXRjaGVyJztcbmV4cG9ydCB7IGZvcm1hdEV4cHJlc3NTdGFiaWxpemF0aW9uV2FybmluZyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi91dGlsL2Nmbi1leHByZXNzJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvaW8vcHJpdmF0ZSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL3RhZ3MvcHJpdmF0ZSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvcHJpdmF0ZS9hY3Rpdml0eS1wcmludGVyJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvY2xvdWQtYXNzZW1ibHkvcHJpdmF0ZS9ib3Jyb3dlZC1hc3NlbWJseSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvdG9vbGtpdC9wcml2YXRlL2NvdW50LWFzc2VtYmx5LXJlc3VsdHMnO1xuZXhwb3J0IHsgdGhyb3dJZlZhbGlkYXRpb25GYWlsdXJlcyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi90b29sa2l0L3ByaXZhdGUvdmFsaWRhdGlvbi1yZXBvcnQnO1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLXByaXZhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhcGktcHJpdmF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxnREFBZ0Q7QUFDaEQsNEZBQTBGO0FBQWpGLDJHQUFBLFdBQVcsT0FBQTtBQUVwQixpR0FBaUY7QUFDakYsOEVBQW9GO0FBQTNFLGlIQUFBLGtCQUFrQixPQUFBO0FBQzNCLHFGQUFvRjtBQUEzRSxzR0FBQSxTQUFTLE9BQUE7QUFFbEIsaUZBQXVGO0FBQTlFLG1IQUFBLG1CQUFtQixPQUFBO0FBQzVCLCtFQUFvRztBQUEzRixnSUFBQSxpQ0FBaUMsT0FBQTtBQUMxQyxnRkFBOEQ7QUFDOUQsa0ZBQWdFO0FBQ2hFLDBGQUF3RTtBQUN4RSw4R0FBNEY7QUFDNUYsd0dBQXNGIiwic291cmNlc0NvbnRlbnQiOlsiLyogZXNsaW50LWRpc2FibGUgaW1wb3J0L25vLXJlbGF0aXZlLXBhY2thZ2VzICovXG5leHBvcnQgeyBkZXBsb3lTdGFjayB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvZGVwbG95LXN0YWNrJztcbmV4cG9ydCB0eXBlIHsgRGVwbG95U3RhY2tPcHRpb25zIGFzIERlcGxveVN0YWNrQXBpT3B0aW9ucywgRGVzdHJveVN0YWNrUmVzdWx0IH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9kZXBsb3ltZW50cy9kZXBsb3ktc3RhY2snO1xuZXhwb3J0ICogYXMgY2ZuQXBpIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvY2ZuLWFwaSc7XG5leHBvcnQgeyBDaGFuZ2VTZXREZXNjcmliZXIgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2NoYW5nZS1zZXRzJztcbmV4cG9ydCB7IERpYWdub3NpcyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGlhZ25vc2luZy9kaWFnbm9zaXMnO1xuZXhwb3J0IHR5cGUgeyBDaGFuZ2VTZXRSZXBvcnQgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2NoYW5nZS1zZXRzJztcbmV4cG9ydCB7IGNyZWF0ZUlnbm9yZU1hdGNoZXIgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvdXRpbC9nbG9iLW1hdGNoZXInO1xuZXhwb3J0IHsgZm9ybWF0RXhwcmVzc1N0YWJpbGl6YXRpb25XYXJuaW5nIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL3V0aWwvY2ZuLWV4cHJlc3MnO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9pby9wcml2YXRlJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvdGFncy9wcml2YXRlJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9wcml2YXRlL2FjdGl2aXR5LXByaW50ZXInO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jbG91ZC1hc3NlbWJseS9wcml2YXRlL2JvcnJvd2VkLWFzc2VtYmx5JztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi90b29sa2l0L3ByaXZhdGUvY291bnQtYXNzZW1ibHktcmVzdWx0cyc7XG4iXX0=

package/lib/cli/cdk-toolkit.d.ts

@@ -285,11 +285,16 @@ export interface DiffOptions {
      */
     readonly contextLines?: number;
     /**
-     * Whether to fail with exit code 1 in case of diff
+     * Which kind of change makes the diff fail with exit code 1
      *
-     * @default false
+     * - `any-change`: any difference
+     * - `broadening`: a change that broadens security permissions
+     * - `destructive`: a change that replaces, deletes or orphans an existing resource
+     * - `never`: the diff never fails
+     *
+     * @default RequireApproval.NEVER
      */
-    readonly fail?: boolean;
+    readonly failOn?: RequireApproval;
     /**
      * Only run diff on broadened security changes
      *
@@ -386,6 +391,11 @@ export interface CliValidateOptions extends ValidateOptions {
     readonly watch?: boolean;
 }
 interface WatchOptions extends Omit<CfnDeployOptions, 'execute'> {
+    /**
+     * Path to file where stack outputs will be written after a successful deploy as JSON
+     * @default - Outputs are not written to any file
+     */
+    outputsFile?: string;
     /**
      * Reuse the assets with the given asset IDs
      */
@@ -446,11 +456,6 @@ export interface DeployOptions extends CfnDeployOptions, WatchOptions {
      * @default true
      */
     usePreviousParameters?: boolean;
-    /**
-     * Path to file where stack outputs will be written after a successful deploy as JSON
-     * @default - Outputs are not written to any file
-     */
-    outputsFile?: string;
     /**
      * Whether we are on a CI system
      *