destroy

Destroy infrastructure resources tracked in the state file. Resources are destroyed in reverse dependency order (leaves first).

State is loaded with the same backend as plan / apply (backend in the config file, otherwise local .kyku/).

Usage

kyku destroy [options]

Options

Flag	Default	Description
-e, --env <environment>	default	Environment workspace
--auto-approve	false	Skip confirmation prompt
-p, --passphrase <phrase>	—	Passphrase for encrypted state
-c, --config <path>	./infrastructure.ts	Path to config file
--target <selector>	—	Destroy matching resources and their dependents (reverse of plan). Repeatable. Selector is an exact id, an id glob (vm-*), or tags.key=value on resource.tags.
--exclude <selector>	—	Keep matching resources. Errors if the selected set still depends on them. Same selector forms as --target.

Examples

# Destroy with confirmation prompt
kyku destroy

# Destroy automatically
kyku destroy --auto-approve

# Destroy production environment
kyku destroy --env=prod --auto-approve

# Destroy one leaf (nothing depends on it)
kyku destroy --target vm-web --auto-approve

# Destroy every id matching a glob (each match still pulls in dependents)
kyku destroy --target 'vm-*' --auto-approve

# Destroy resources tagged env=prod on resource.tags
kyku destroy --target tags.env=prod --auto-approve

# Destroy a VPC and everything that depends on it
kyku destroy --target vpc-main --auto-approve

# Destroy everything except a standalone bucket
kyku destroy --exclude bucket-assets --auto-approve

Behavior

• Destroy is routed through KykuEngine.destroyAll()
• Resources are destroyed in reverse dependency order (dependents first)
• --target expands dependents (the reverse of plan / apply, which expand ancestors)
• --exclude errors if anything still selected depends on the excluded resource
• Selectors are an exact resource id, an id glob (* / ?, not a regex), or tags.key=value against resource.tags (from the config file when present, otherwise tags stored on the state config). A selector that matches nothing is an error.
• Destroy includes retry with backoff (5 attempts, exponential)
• After destroy, polls readState to confirm resource is gone (up to 10 retries)
• Orphaned resources (in state but not in config) are destroyed
• Custom resources must be removed from config first (their destroy handler needs the resource instance)

Exit Codes

Code	Meaning
0	All selected resources destroyed
1	General error
3	Destroy failed
4	Canceled by user