@go-to-k/cdkd 0.17.1 → 0.18.0

package/README.md

@@ -458,10 +458,16 @@ cdkd state resources MyStack --json   # full JSON array
 cdkd state show MyStack
 cdkd state show MyStack --json        # raw {state, lock} JSON
 
-# Remove cdkd's state record for a stack (does NOT delete AWS resources)
-cdkd state rm MyStack                 # confirmation prompt (y/N)
-cdkd state rm MyStack --yes           # skip confirmation
-cdkd state rm StackA StackB --force   # also bypass the locked-stack refusal
+# Orphan a stack from cdkd's state (does NOT delete AWS resources).
+# Synth-driven — needs --app / cdk.json — same stack-pattern routing as deploy.
+cdkd orphan MyStack                   # confirmation prompt (y/N)
+cdkd orphan MyStack --yes
+cdkd orphan 'MyStage/*' --yes         # display-path wildcard
+
+# State-driven counterpart (no CDK app needed — works against the bucket).
+cdkd state orphan MyStack             # confirmation prompt (y/N)
+cdkd state orphan MyStack --yes       # skip confirmation
+cdkd state orphan StackA StackB --force # also bypass the locked-stack refusal
 
 # Destroy a stack's AWS resources AND remove its state record, without
 # requiring the CDK app (no synth — works from any working directory).
@@ -471,10 +477,12 @@ cdkd state destroy --all -y           # every stack in the bucket
 cdkd state destroy MyStack --region us-east-1
 ```
 
-> `cdkd state destroy` vs `cdkd state rm`: `state destroy` deletes both the
-> AWS resources and the state record (the equivalent of `cdkd destroy` minus
-> the CDK-app dependency). `state rm` only forgets the state record and
-> leaves the AWS resources intact.
+> **`destroy` vs `orphan`** (matches aws-cdk-cli's new `cdk orphan`):
+> `destroy` deletes the AWS resources AND the state record. `orphan` deletes
+> ONLY the state record — AWS resources remain intact, just no longer
+> tracked by cdkd. Each has a synth-driven form (`cdkd destroy` / `cdkd
+> orphan`, needs the CDK app) and a state-driven form (`cdkd state destroy`
+> / `cdkd state orphan`, works on the bucket alone).
 
 ### Concurrency Options
 
@@ -561,14 +569,60 @@ s3://{state-bucket}/
 > `env.region` between deploys silently overwrote the prior region's state
 > and `cdkd destroy` ran against the wrong region. cdkd now treats the two
 > regions as independent. Use `cdkd state list` to see both, and
-> `cdkd state rm <stack> --stack-region <region>` to prune one without
+> `cdkd state orphan <stack> --stack-region <region>` to prune one without
 > touching the other.
 >
-> **Legacy layout migration:** state files written by cdkd before this
-> layout (`version: 1`, flat `cdkd/{stackName}/state.json`) are still
-> readable. The next cdkd write auto-migrates to the new key and removes
-> the legacy file. An older cdkd binary reading a `version: 2` file fails
-> with a clear "upgrade cdkd" error rather than silently mishandling it.
+> **Legacy key-layout migration (within the same bucket):** state files
+> written by cdkd before this layout (`version: 1`, flat
+> `cdkd/{stackName}/state.json`) are still readable. The next cdkd write
+> auto-migrates to the new region-prefixed key
+> (`cdkd/{stackName}/{region}/state.json`) and removes the legacy file —
+> no manual action required. An older cdkd binary reading a `version: 2`
+> file fails with a clear "upgrade cdkd" error rather than silently
+> mishandling it.
+>
+> Note: this only covers the **key layout inside an existing state
+> bucket**. The separate **bucket-name migration** (legacy
+> `cdkd-state-{accountId}-{region}` → new `cdkd-state-{accountId}`)
+> is described below and does NOT auto-migrate.
+
+### Bucket migration
+
+The default state-bucket name changed in v0.11.0 from the region-suffixed
+`cdkd-state-{accountId}-{region}` to the region-free
+`cdkd-state-{accountId}`. The bucket name is region-free because S3 names
+are globally unique, so teammates with different profile regions all
+converge on the same bucket; the bucket's actual region is auto-detected
+via `GetBucketLocation`.
+
+Existing users keep working without doing anything: when only the legacy
+bucket exists, cdkd transparently falls back to it and emits a
+deprecation warning. To stop the warning (and consolidate state into the
+new bucket) run:
+
+```bash
+# Per-region: copies all objects from cdkd-state-{accountId}-{region}
+# into cdkd-state-{accountId}. Source bucket is kept by default.
+cdkd state migrate --region us-east-1
+
+# Optional: delete the legacy bucket once the copy is verified.
+cdkd state migrate --region us-east-1 --remove-legacy
+```
+
+This migration is **account-wide / per-region**, not per-stack — running
+it once per region clears the legacy bucket for that region in one shot.
+For multi-region accounts, run it once per region (each invocation copies
+into the same destination bucket).
+
+`cdkd state migrate` refuses to run while any stack has an active
+`lock.json` (an in-flight `cdkd deploy` / `destroy` would race the copy),
+verifies object-count parity between source and destination before any
+source cleanup, and only deletes the legacy bucket when
+`--remove-legacy` is passed.
+
+See the [Configuration](#configuration) table below for the full
+precedence rules of the `--state-bucket` flag and its env-var / cdk.json
+fallbacks.
 
 ### Configuration
 

package/dist/cli.js

@@ -447,7 +447,7 @@ var init_aws_clients = __esm({
 });
 
 // src/cli/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/cli/commands/bootstrap.ts
 import { Command, Option as Option2 } from "commander";
@@ -3488,7 +3488,7 @@ var S3StateBackend = class {
    *
    * Returns true for either layout: the new region-scoped key, or the legacy
    * key when its embedded `region` matches the requested region. This lets
-   * `cdkd state rm <stack> --region X` and `cdkd destroy <stack>` see legacy
+   * `cdkd state orphan <stack> --region X` and `cdkd destroy <stack>` see legacy
    * state without forcing a write-through migration first.
    */
   async stateExists(stackName, region) {
@@ -30630,7 +30630,7 @@ Preparing to destroy stack: ${stackName}`);
       } else {
         const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
         throw new Error(
-          `Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state rm ${stackName} --region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`
+          `Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state orphan ${stackName} --region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`
         );
       }
       const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
@@ -30670,8 +30670,192 @@ function createDestroyCommand() {
   return cmd;
 }
 
+// src/cli/commands/orphan.ts
+import * as readline2 from "node:readline/promises";
+import { Command as Command7 } from "commander";
+init_aws_clients();
+async function orphanCommand(stackArgs, options) {
+  const logger = getLogger();
+  if (options.verbose)
+    logger.setLevel("debug");
+  warnIfDeprecatedRegion(options);
+  const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+  const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+  logger.info("Starting stack orphan...");
+  logger.debug("Options:", options);
+  if (options.region) {
+    process.env["AWS_REGION"] = options.region;
+    process.env["AWS_DEFAULT_REGION"] = options.region;
+  }
+  const awsClients = new AwsClients({
+    ...options.region && { region: options.region },
+    ...options.profile && { profile: options.profile }
+  });
+  setAwsClients(awsClients);
+  try {
+    const stateConfig = {
+      bucket: stateBucket,
+      prefix: options.statePrefix
+    };
+    const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+      ...options.region && { region: options.region },
+      ...options.profile && { profile: options.profile }
+    });
+    await stateBackend.verifyBucketExists();
+    const lockManager = new LockManager(awsClients.s3, stateConfig);
+    const appCmd = options.app || resolveApp();
+    let appStacks = [];
+    if (appCmd) {
+      try {
+        const synthesizer = new Synthesizer();
+        const context = parseContextOptions(options.context);
+        const result = await synthesizer.synthesize({
+          app: appCmd,
+          output: options.output || "cdk.out",
+          ...Object.keys(context).length > 0 && { context }
+        });
+        appStacks = result.stacks.map((s) => ({
+          stackName: s.stackName,
+          displayName: s.displayName,
+          ...s.region && { region: s.region }
+        }));
+      } catch {
+        logger.debug("Could not synthesize app, falling back to state-based stack list");
+      }
+    }
+    const allStateRefs = await stateBackend.listStacks();
+    let candidateStacks;
+    if (appStacks.length > 0) {
+      const stateNames = new Set(allStateRefs.map((r) => r.stackName));
+      candidateStacks = appStacks.filter((s) => stateNames.has(s.stackName));
+    } else if (stackArgs.length > 0 || options.stack || options.all) {
+      const seen = /* @__PURE__ */ new Set();
+      candidateStacks = [];
+      for (const ref of allStateRefs) {
+        if (seen.has(ref.stackName))
+          continue;
+        seen.add(ref.stackName);
+        candidateStacks.push({ stackName: ref.stackName });
+      }
+    } else {
+      throw new Error(
+        "Could not determine which stacks belong to this app. Specify stack names explicitly, use --all, or ensure --app / cdk.json is configured."
+      );
+    }
+    const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
+    let stackNames;
+    if (options.all) {
+      stackNames = candidateStacks.map((s) => s.stackName);
+    } else if (stackPatterns.length > 0) {
+      stackNames = matchStacks(candidateStacks, stackPatterns).map((s) => s.stackName);
+    } else if (candidateStacks.length === 1) {
+      stackNames = candidateStacks.map((s) => s.stackName);
+    } else if (candidateStacks.length === 0) {
+      logger.info("No stacks found in state");
+      return;
+    } else {
+      throw new Error(
+        `Multiple stacks found: ${candidateStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`
+      );
+    }
+    if (stackNames.length === 0) {
+      logger.info("No matching stacks found in state");
+      return;
+    }
+    logger.info(`Found ${stackNames.length} stack(s) to orphan: ${stackNames.join(", ")}`);
+    const stateRefsByName = /* @__PURE__ */ new Map();
+    for (const ref of allStateRefs) {
+      const arr = stateRefsByName.get(ref.stackName) ?? [];
+      arr.push(ref);
+      stateRefsByName.set(ref.stackName, arr);
+    }
+    const skipConfirmation = options.yes || options.force;
+    for (const stackName of stackNames) {
+      const refs = stateRefsByName.get(stackName) ?? [];
+      if (refs.length === 0) {
+        logger.info(`No state found for stack: ${stackName}, skipping`);
+        continue;
+      }
+      const targets = options.stackRegion ? refs.filter((r) => r.region === options.stackRegion) : refs;
+      if (targets.length === 0) {
+        const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
+        throw new Error(
+          `No state found for stack '${stackName}' in region '${options.stackRegion}'. Available regions: ${seen}.`
+        );
+      }
+      if (!options.force) {
+        for (const target of targets) {
+          const locked = await lockManager.isLocked(stackName, target.region);
+          if (locked) {
+            const where = target.region ?? "(legacy)";
+            throw new Error(
+              `Stack '${stackName}' (${where}) is locked. Run 'cdkd force-unlock ${stackName}${target.region ? ` --stack-region ${target.region}` : ""}' first, or pass --force to orphan anyway.`
+            );
+          }
+        }
+      }
+      if (!skipConfirmation) {
+        const targetList = targets.map((t) => t.region ? `${stackName} (${t.region})` : stackName).join(", ");
+        process.stdout.write(
+          `
+WARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.
+Use 'cdkd destroy ${stackName}' if you want to delete the actual resources.
+
+`
+        );
+        const rl = readline2.createInterface({
+          input: process.stdin,
+          output: process.stdout
+        });
+        const answer = await rl.question(
+          `Orphan state for ${targetList} from s3://${stateBucket}/${options.statePrefix}/? (y/N): `
+        );
+        rl.close();
+        const trimmed = answer.trim().toLowerCase();
+        if (trimmed !== "y" && trimmed !== "yes") {
+          logger.info(`Cancelled orphan of stack: ${stackName}`);
+          continue;
+        }
+      }
+      for (const target of targets) {
+        if (target.region) {
+          await stateBackend.deleteState(stackName, target.region);
+          await lockManager.forceReleaseLock(stackName, target.region);
+        } else {
+          await lockManager.forceReleaseLock(stackName, void 0);
+        }
+        const label = target.region ? `${stackName} (${target.region})` : stackName;
+        logger.info(`\u2713 Orphaned state for stack: ${label}`);
+      }
+    }
+  } finally {
+    awsClients.destroy();
+  }
+}
+function createOrphanCommand() {
+  const cmd = new Command7("orphan").description(
+    "Remove cdkd's state record for one or more stacks (does NOT delete AWS resources). Synth-driven; for the CDK-app-free version use 'cdkd state orphan'."
+  ).argument(
+    "[stacks...]",
+    "Stack name(s) to orphan. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*')."
+  ).option("--all", "Orphan all stacks in the current app", false).option(
+    "--stack-region <region>",
+    "Region of the stack record to operate on. Required when the same stack name has state in multiple regions."
+  ).action(withErrorHandling(orphanCommand));
+  [
+    ...commonOptions,
+    ...appOptions,
+    ...stateOptions,
+    ...stackOptions,
+    ...destroyOptions,
+    ...contextOptions
+  ].forEach((opt) => cmd.addOption(opt));
+  cmd.addOption(deprecatedRegionOption);
+  return cmd;
+}
+
 // src/cli/commands/publish-assets.ts
-import { Option as Option3, Command as Command7 } from "commander";
+import { Option as Option3, Command as Command8 } from "commander";
 async function publishAssetsCommand(options) {
   const logger = getLogger();
   if (options.verbose) {
@@ -30690,7 +30874,7 @@ async function publishAssetsCommand(options) {
   logger.info("\u2705 Asset publishing complete");
 }
 function createPublishAssetsCommand() {
-  const cmd = new Command7("publish-assets").description("Publish assets to S3/ECR from asset manifest").requiredOption("--path <path>", "Path to asset manifest file or directory").addOption(
+  const cmd = new Command8("publish-assets").description("Publish assets to S3/ECR from asset manifest").requiredOption("--path <path>", "Path to asset manifest file or directory").addOption(
     new Option3(
       "--asset-publish-concurrency <number>",
       "Maximum concurrent asset publish operations"
@@ -30704,7 +30888,7 @@ function createPublishAssetsCommand() {
 }
 
 // src/cli/commands/force-unlock.ts
-import { Command as Command8, Option as Option4 } from "commander";
+import { Command as Command9, Option as Option4 } from "commander";
 init_aws_clients();
 async function forceUnlockCommand(stackArgs, options) {
   const logger = getLogger();
@@ -30764,7 +30948,7 @@ async function forceUnlockCommand(stackArgs, options) {
   }
 }
 function createForceUnlockCommand() {
-  const cmd = new Command8("force-unlock").description("Force-release a stale lock on a stack").argument("[stacks...]", "Stack name(s) to unlock").addOption(
+  const cmd = new Command9("force-unlock").description("Force-release a stale lock on a stack").argument("[stacks...]", "Stack name(s) to unlock").addOption(
     new Option4(
       "--stack-region <region>",
       "Stack region whose lock to release (use when the same stack name has locks in multiple regions). Defaults to all regions where the stack has state."
@@ -30776,8 +30960,8 @@ function createForceUnlockCommand() {
 }
 
 // src/cli/commands/state.ts
-import * as readline3 from "node:readline/promises";
-import { Command as Command10, Option as Option5 } from "commander";
+import * as readline4 from "node:readline/promises";
+import { Command as Command11, Option as Option5 } from "commander";
 import {
   GetBucketLocationCommand as GetBucketLocationCommand2,
   GetObjectCommand as GetObjectCommand4,
@@ -30786,8 +30970,8 @@ import {
 init_aws_clients();
 
 // src/cli/commands/state-migrate.ts
-import * as readline2 from "node:readline/promises";
-import { Command as Command9 } from "commander";
+import * as readline3 from "node:readline/promises";
+import { Command as Command10 } from "commander";
 import {
   CopyObjectCommand,
   CreateBucketCommand as CreateBucketCommand4,
@@ -31061,7 +31245,7 @@ async function emptyBucketAllVersions(s3, bucket) {
   } while (keyMarker || versionIdMarker);
 }
 async function confirmPrompt(prompt) {
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -31070,7 +31254,7 @@ async function confirmPrompt(prompt) {
   }
 }
 function createStateMigrateCommand() {
-  const cmd = new Command9("migrate").description(
+  const cmd = new Command10("migrate").description(
     "Migrate state from the legacy region-suffixed bucket (cdkd-state-{account}-{region}) to the new region-free default (cdkd-state-{account}). Source bucket is kept by default; pass --remove-legacy to delete it after a successful migration."
   ).option(
     "--region <region>",
@@ -31228,7 +31412,7 @@ async function stateListCommand(options) {
   }
 }
 function createStateListCommand() {
-  const cmd = new Command10("list").alias("ls").description("List stacks registered in the cdkd state bucket").option("-l, --long", "Show resource count, last-modified time, and lock status", false).option("--json", "Output as JSON", false).action(withErrorHandling(stateListCommand));
+  const cmd = new Command11("list").alias("ls").description("List stacks registered in the cdkd state bucket").option("-l, --long", "Show resource count, last-modified time, and lock status", false).option("--json", "Output as JSON", false).action(withErrorHandling(stateListCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31332,7 +31516,7 @@ function formatLockSummary(lockInfo) {
   return `locked by ${lockInfo.owner}${opStr}, ${expiresStr}`;
 }
 function createStateResourcesCommand() {
-  const cmd = new Command10("resources").description("List resources recorded in a stack's state").argument("<stack>", "Stack name (physical CloudFormation name)").option("-l, --long", "Include dependencies and attributes per resource", false).option("--json", "Output as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateResourcesCommand));
+  const cmd = new Command11("resources").description("List resources recorded in a stack's state").argument("<stack>", "Stack name (physical CloudFormation name)").option("-l, --long", "Include dependencies and attributes per resource", false).option("--json", "Output as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateResourcesCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31420,17 +31604,17 @@ async function stateShowCommand(stackName, options) {
   }
 }
 function createStateShowCommand() {
-  const cmd = new Command10("show").description("Show the full cdkd state record for a stack (metadata, outputs, resources)").argument("<stack>", "Stack name (physical CloudFormation name)").option("--json", "Output the raw state and lock as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateShowCommand));
+  const cmd = new Command11("show").description("Show the full cdkd state record for a stack (metadata, outputs, resources)").argument("<stack>", "Stack name (physical CloudFormation name)").option("--json", "Output the raw state and lock as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateShowCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
 }
-async function stateRmCommand(stackArgs, options) {
+async function stateOrphanCommand(stackArgs, options) {
   const logger = getLogger();
   if (options.verbose)
     logger.setLevel("debug");
   if (stackArgs.length === 0) {
-    throw new Error("Stack name is required. Usage: cdkd state rm <stack> [<stack>...]");
+    throw new Error("Stack name is required. Usage: cdkd state orphan <stack> [<stack>...]");
   }
   const setup = await setupStateBackend(options);
   try {
@@ -31468,7 +31652,7 @@ Use 'cdkd destroy ${stackName}' if you want to delete the actual resources.
 
 `
         );
-        const rl = readline3.createInterface({
+        const rl = readline4.createInterface({
           input: process.stdin,
           output: process.stdout
         });
@@ -31502,8 +31686,10 @@ function stackRegionOption() {
     "Region of the stack record to operate on. Required when the same stack name has state in multiple regions."
   );
 }
-function createStateRmCommand() {
-  const cmd = new Command10("rm").description("Remove cdkd state for one or more stacks (does NOT delete AWS resources)").argument("<stacks...>", "Stack name(s) to remove from state").option("-f, --force", "Skip confirmation and remove even if the stack is locked", false).addOption(stackRegionOption()).action(withErrorHandling(stateRmCommand));
+function createStateOrphanCommand() {
+  const cmd = new Command11("orphan").description(
+    "Orphan one or more stacks from cdkd state (removes the state record; does NOT delete AWS resources)"
+  ).argument("<stacks...>", "Stack name(s) to orphan from state").option("-f, --force", "Skip confirmation and remove even if the stack is locked", false).addOption(stackRegionOption()).action(withErrorHandling(stateOrphanCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31553,7 +31739,7 @@ WARNING: This destroys ${stackNames.length} stack(s) and removes their state rec
 `);
       }
       process.stdout.write("\n");
-      const rl = readline3.createInterface({
+      const rl = readline4.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -31628,8 +31814,8 @@ Preparing to destroy stack: ${stackName}${ref.region ? ` (${ref.region})` : ""}`
   }
 }
 function createStateDestroyCommand() {
-  const cmd = new Command10("destroy").description(
-    "Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state rm'."
+  const cmd = new Command11("destroy").description(
+    "Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'."
   ).argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").option("--all", "Destroy every stack in the state bucket", false).addOption(stackRegionOption()).addHelpText(
     "after",
     [
@@ -31641,7 +31827,7 @@ function createStateDestroyCommand() {
       "  cdkd state destroy MyStack --state-bucket cdkd-state-test",
       "  cdkd state destroy MyStack --stack-region us-west-2",
       "",
-      "For removing only the state record (keeping AWS resources intact), use 'cdkd state rm'."
+      "For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'."
     ].join("\n")
   ).action(withErrorHandling(stateDestroyCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
@@ -31760,19 +31946,19 @@ async function stateInfoCommand(options) {
   }
 }
 function createStateInfoCommand() {
-  const cmd = new Command10("info").description(
+  const cmd = new Command11("info").description(
     "Show cdkd state bucket info (bucket name, region, source, schema version, stack count)"
   ).option("--json", "Output as JSON", false).action(withErrorHandling(stateInfoCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   return cmd;
 }
 function createStateCommand() {
-  const cmd = new Command10("state").description("Manage cdkd state stored in S3");
+  const cmd = new Command11("state").description("Manage cdkd state stored in S3");
   cmd.addCommand(createStateInfoCommand());
   cmd.addCommand(createStateListCommand());
   cmd.addCommand(createStateResourcesCommand());
   cmd.addCommand(createStateShowCommand());
-  cmd.addCommand(createStateRmCommand());
+  cmd.addCommand(createStateOrphanCommand());
   cmd.addCommand(createStateDestroyCommand());
   cmd.addCommand(createStateMigrateCommand());
   return cmd;
@@ -31780,8 +31966,8 @@ function createStateCommand() {
 
 // src/cli/commands/import.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import * as readline4 from "node:readline/promises";
-import { Command as Command11 } from "commander";
+import * as readline5 from "node:readline/promises";
+import { Command as Command12 } from "commander";
 init_aws_clients();
 async function importCommand(stackArg, options) {
   const logger = getLogger();
@@ -32077,7 +32263,7 @@ function formatOutcome(outcome) {
   }
 }
 async function confirmPrompt2(prompt) {
-  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -32086,7 +32272,7 @@ async function confirmPrompt2(prompt) {
   }
 }
 function createImportCommand() {
-  const cmd = new Command11("import").description(
+  const cmd = new Command12("import").description(
     "Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies; uses the aws:cdk:path tag (or explicit --resource overrides) to find each resource in AWS."
   ).argument(
     "[stack]",
@@ -32122,6 +32308,7 @@ var SUBCOMMANDS = /* @__PURE__ */ new Set([
   "deploy",
   "diff",
   "destroy",
+  "orphan",
   "import",
   "publish-assets",
   "force-unlock",
@@ -32138,14 +32325,15 @@ function reorderArgs(argv) {
   return [...prefix, ...cmdAndAfter, ...beforeCmd];
 }
 async function main() {
-  const program = new Command12();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.17.1");
+  const program = new Command13();
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.18.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());
   program.addCommand(createDeployCommand());
   program.addCommand(createDiffCommand());
   program.addCommand(createDestroyCommand());
+  program.addCommand(createOrphanCommand());
   program.addCommand(createImportCommand());
   program.addCommand(createPublishAssetsCommand());
   program.addCommand(createForceUnlockCommand());