cdkd
CLI Flag Coverage Matrix
Run vp run cli-flag-coverage to regenerate.
32 / 42 declared CLI flags appear in at least one tests/integration/<name>/verify.sh script. 10 flags are not exercised by any integ verify.sh.
Important: this is a VISIBILITY report, not a CI gate
Many cdkd flags are tested at the unit-test level rather than via an integ verify.sh (--dry-run, --verbose, --profile, etc.) — flagging those as "uncovered" would produce 50%+ false-positive noise, defeating any gate. The "uncovered flags" section below lists flags that no integ shell script mentions; treat it as a question ("does THIS flag warrant a real-AWS test?"), not an answer ("this is a gap").
See the script docstring for the design rationale; the coverage numbers here are intentionally not wired to a CI hard-fail (contrast with the provider-coverage matrix in docs/integ-coverage.md, where a coverage gate IS appropriate because every registered provider is expected to have real-AWS verification). CI does, however, run a staleness check on this generated file — vp run cli-flag-coverage followed by git diff --exit-code — so the matrix cannot silently drift; that guards freshness, not coverage %.
Flags with no integ verify.sh mention (10)
Reviewer judgment required per flag — many of these are pure-logic flags adequately tested at the unit level.
--allow-unsupported-types--asset-publish-concurrency--context--ignore-errors--image-build-concurrency--no-aggressive-vpc-parallel--prefix-user-supplied-names--role-arn--stack--strict
Flags exercised by integ verify.sh (32)
Long-form flags referenced in integs but NOT declared in src/cli/options.ts (328)
These are mostly third-party CLI flags (--query for aws / --region for aws s3 ls / --no-paginate / etc.) OR typos of cdkd flag names. Listed here for visibility — review only if a row matches a cdkd flag with a misspelling.
--Arn----Name--TopicArn----accept--access-key-id--account-id--active--add-host--alarm-names--alarm-types--all--api-id--api-key--application-id--application-name--apply-immediately--archive-name--arg--argjson--asset-bucket--assume-role--attribute--attribute-definitions--attribute-names--authorizer-id--auto--auto-scaling-group-names--backup-id--backup-plan-id--backup-vault-name--bearer-token--body--browser-id--bucket--budget-name--build-arg--certificate-arn--cfn-stack-name--cli-binary-format--cli-input-json--client-certificate-id--client-id--client-token--cloud-watch-logs-log-group-arn--cloud-watch-logs-role-arn--cluster--cluster-id--cluster-identifier--cluster-ids--clusters--code-interpreter-id--code-signing-config-arn--configuration-profile-id--configuration-set-name--container-host--container-repo--content-type--count--create-bucket-configuration--database-input--database-name--db-cluster-identifier--db-instance-identifier--db-parameter-group-name--db-subnet-group-name--delete--delete-automated-backups--deletion-protection--deployment-configuration--deployment-group-name--deployment-strategy-id--description--destroy--detach--directory-id--directory-ids--distribution-config--email-identity--enforce-consumer-deletion--entries--env-vars--environment--environment-id--evaluator-id--event--event-bus-name--event-source-arn--execution-arn--fail--family-prefix--field-name--file-path--file-system-id--file-system-ids--filter--filter-pattern--filters--force-delete-without-recovery--format--from-cfn-stack--from-path--from-stack--from-state--function-name--global-cluster-identifier--global-secondary-index-updates--graph-identifier--group-id--group-ids--group-name--help--host--host-port--hosted-zone-id--id--identifier--identity-pool-id--ids--if-match--ignore-workspace--image-id--image-identifier--image-ids--include-non-importable--include-planned-deletion--input--input-type--instance-group-id--instance-id--instance-ids--instance-profile-name--instance-states--instance-type--integration-id--internet-gateway-id--internet-gateway-ids--invocation-type--ip-permissions--item--job-name--json--key--key-id--language--launch-template-names--layer-name--lb-port--listener-arn--load-balancer-arn--load-balancer-arns--log-group-name--log-group-name-prefix--max-count--max-items--max-results--max-time--message--message-body--message-group-id--metric-name--mfa-configuration--migrate-from-cloudformation--min-count--mount--name--name-filter--name-prefix--name-query--names--namespace--nat-gateway-id--nat-gateway-ids--network-interface-id--next-token--no-asset-metadata--no-audit--no-buffer--no-build--no-cli-auto-prompt--no-deletion-protection--no-deletion-protection-enabled--no-disable-api-termination--no-fund--no-path-metadata--no-prefix-user-supplied-names--no-pull--no-retain-primary-cluster--no-termination-protected--no-verify-auth--no-version-reporting--nologo--notification--older-than--open-id-connect-provider-arn--output-dir--output-path--overwrite--owner-ids--ownership-controls--parameter
(128 more entries truncated — see docs/_generated/cli-flag-coverage.json for the full list.)