@go-to-k/cdkd 0.17.1 → 0.18.1

package/dist/cli.js

@@ -447,7 +447,7 @@ var init_aws_clients = __esm({
 });
 
 // src/cli/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/cli/commands/bootstrap.ts
 import { Command, Option as Option2 } from "commander";
@@ -537,10 +537,122 @@ var destroyOptions = [
   )
 ];
 
+// src/provisioning/resource-name.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+var stackNameStore = new AsyncLocalStorage();
+function withStackName(stackName, fn) {
+  return stackNameStore.run(stackName, fn);
+}
+function getCurrentStackName() {
+  return stackNameStore.getStore();
+}
+function generateResourceName(name, options) {
+  const { maxLength, lowercase = false, allowedPattern = /[^a-zA-Z0-9-]/g } = options;
+  const currentStackName = stackNameStore.getStore();
+  const fullName = currentStackName ? `${currentStackName}-${name}` : name;
+  let sanitized = lowercase ? fullName.toLowerCase() : fullName;
+  sanitized = sanitized.replace(allowedPattern, "-");
+  sanitized = sanitized.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+  if (sanitized.length <= maxLength) {
+    return sanitized;
+  }
+  const hash = createHash("sha256").update(fullName).digest("hex").substring(0, 8);
+  const maxPrefixLength = maxLength - hash.length - 1;
+  const prefix = sanitized.substring(0, maxPrefixLength).replace(/-+$/, "");
+  return `${prefix}-${hash}`;
+}
+var FALLBACK_NAME_RULES = {
+  "AWS::S3::Bucket": { nameProperty: "BucketName", options: { maxLength: 63, lowercase: true } },
+  "AWS::SQS::Queue": { nameProperty: "QueueName", options: { maxLength: 80 } },
+  "AWS::SNS::Topic": { nameProperty: "TopicName", options: { maxLength: 256 } },
+  "AWS::Lambda::Function": { nameProperty: "FunctionName", options: { maxLength: 64 } },
+  "AWS::Lambda::LayerVersion": { nameProperty: "LayerName", options: { maxLength: 64 } },
+  "AWS::IAM::Role": { nameProperty: "RoleName", options: { maxLength: 64 } },
+  "AWS::IAM::Policy": { nameProperty: "PolicyName", options: { maxLength: 64 } },
+  "AWS::IAM::User": { nameProperty: "UserName", options: { maxLength: 64 } },
+  "AWS::IAM::Group": { nameProperty: "GroupName", options: { maxLength: 128 } },
+  "AWS::IAM::InstanceProfile": {
+    nameProperty: "InstanceProfileName",
+    options: { maxLength: 128 }
+  },
+  "AWS::DynamoDB::Table": { nameProperty: "TableName", options: { maxLength: 255 } },
+  "AWS::ECR::Repository": {
+    nameProperty: "RepositoryName",
+    options: { maxLength: 256, lowercase: true }
+  },
+  "AWS::ECS::Cluster": { nameProperty: "ClusterName", options: { maxLength: 255 } },
+  "AWS::ECS::Service": { nameProperty: "ServiceName", options: { maxLength: 255 } },
+  "AWS::Logs::LogGroup": { nameProperty: "LogGroupName", options: { maxLength: 512 } },
+  "AWS::CloudWatch::Alarm": { nameProperty: "AlarmName", options: { maxLength: 256 } },
+  "AWS::Events::Rule": { nameProperty: "Name", options: { maxLength: 64 } },
+  "AWS::Events::EventBus": { nameProperty: "Name", options: { maxLength: 256 } },
+  "AWS::Kinesis::Stream": { nameProperty: "Name", options: { maxLength: 128 } },
+  "AWS::StepFunctions::StateMachine": {
+    nameProperty: "StateMachineName",
+    options: { maxLength: 80 }
+  },
+  "AWS::SecretsManager::Secret": {
+    nameProperty: "Name",
+    options: { maxLength: 512, allowedPattern: /[^a-zA-Z0-9-/_]/g }
+  },
+  "AWS::SSM::Parameter": { nameProperty: "Name", options: { maxLength: 2048 } },
+  "AWS::Cognito::UserPool": { nameProperty: "UserPoolName", options: { maxLength: 128 } },
+  "AWS::ElastiCache::SubnetGroup": {
+    nameProperty: "CacheSubnetGroupName",
+    options: { maxLength: 255, lowercase: true }
+  },
+  "AWS::ElastiCache::CacheCluster": {
+    nameProperty: "ClusterName",
+    options: { maxLength: 40, lowercase: true }
+  },
+  "AWS::RDS::DBSubnetGroup": {
+    nameProperty: "DBSubnetGroupName",
+    options: { maxLength: 255, lowercase: true }
+  },
+  "AWS::RDS::DBCluster": {
+    nameProperty: "DBClusterIdentifier",
+    options: { maxLength: 63, lowercase: true }
+  },
+  "AWS::RDS::DBInstance": {
+    nameProperty: "DBInstanceIdentifier",
+    options: { maxLength: 63, lowercase: true }
+  },
+  "AWS::ElasticLoadBalancingV2::LoadBalancer": {
+    nameProperty: "Name",
+    options: { maxLength: 32 }
+  },
+  "AWS::ElasticLoadBalancingV2::TargetGroup": {
+    nameProperty: "Name",
+    options: { maxLength: 32 }
+  },
+  "AWS::WAFv2::WebACL": { nameProperty: "Name", options: { maxLength: 128 } },
+  "AWS::CodeBuild::Project": { nameProperty: "Name", options: { maxLength: 255 } },
+  "AWS::S3Express::DirectoryBucket": {
+    nameProperty: "BucketName",
+    options: { maxLength: 63, lowercase: true }
+  }
+};
+function applyDefaultNameForFallback(logicalId, resourceType, properties) {
+  const rule = FALLBACK_NAME_RULES[resourceType];
+  if (!rule)
+    return properties;
+  if (properties[rule.nameProperty])
+    return properties;
+  const generatedName = generateResourceName(logicalId, rule.options);
+  return {
+    ...properties,
+    [rule.nameProperty]: generatedName
+  };
+}
+
 // src/utils/live-renderer.ts
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var FRAME_INTERVAL_MS = 80;
 var ESC = "\x1B[";
+function scopedKey(id, stackName) {
+  return stackName ? `${stackName}:${id}` : id;
+}
 var LiveRenderer = class {
   constructor(stream = process.stdout) {
     this.stream = stream;
@@ -594,12 +706,14 @@ var LiveRenderer = class {
     this.active = false;
   }
   addTask(id, label) {
-    this.tasks.set(id, { label, startedAt: Date.now() });
+    const stackName = getCurrentStackName();
+    this.tasks.set(scopedKey(id, stackName), { label, startedAt: Date.now(), stackName });
     if (this.active)
       this.draw();
   }
   removeTask(id) {
-    if (!this.tasks.delete(id))
+    const stackName = getCurrentStackName();
+    if (!this.tasks.delete(scopedKey(id, stackName)))
       return;
     if (this.active)
       this.draw();
@@ -635,11 +749,16 @@ var LiveRenderer = class {
       return;
     const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
     this.spinnerIndex++;
+    const distinctStacks = /* @__PURE__ */ new Set();
+    for (const task of this.tasks.values())
+      distinctStacks.add(task.stackName);
+    const showStackPrefix = distinctStacks.size > 1;
     const cols = this.stream.columns ?? 80;
     const lines = [];
     for (const task of this.tasks.values()) {
       const elapsed = ((Date.now() - task.startedAt) / 1e3).toFixed(1);
-      const raw = `  ${frame} ${task.label} (${elapsed}s)`;
+      const prefix = showStackPrefix && task.stackName ? `[${task.stackName}] ` : "";
+      const raw = `  ${frame} ${prefix}${task.label} (${elapsed}s)`;
       lines.push(this.truncate(raw, cols));
     }
     this.stream.write(lines.join("\n") + "\n");
@@ -672,6 +791,24 @@ function getLiveRenderer() {
   return globalRenderer;
 }
 
+// src/utils/stack-context.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var outputBufferStore = new AsyncLocalStorage2();
+async function runStackBuffered(fn) {
+  const buffer = { lines: [] };
+  return outputBufferStore.run(buffer, async () => {
+    try {
+      const result = await fn();
+      return { ok: true, result, lines: buffer.lines };
+    } catch (error) {
+      return { ok: false, error, lines: buffer.lines };
+    }
+  });
+}
+function getCurrentStackOutputBuffer() {
+  return outputBufferStore.getStore();
+}
+
 // src/utils/logger.ts
 var colors = {
   reset: "\x1B[0m",
@@ -726,28 +863,48 @@ var ConsoleLogger = class {
     }
     return `${message}${formattedArgs}`;
   }
+  /**
+   * Route a formatted log line. When a per-stack output buffer is active in
+   * the current async context (parallel multi-stack deploy), capture the
+   * line into the buffer so it can be flushed as one atomic block when the
+   * stack finishes. Otherwise fall through to the live renderer / console
+   * as before.
+   */
+  emit(level, formatted) {
+    const buffer = getCurrentStackOutputBuffer();
+    if (buffer) {
+      buffer.lines.push(formatted);
+      return;
+    }
+    getLiveRenderer().printAbove(() => {
+      if (level === "error")
+        console.error(formatted);
+      else if (level === "warn")
+        console.warn(formatted);
+      else if (level === "info")
+        console.info(formatted);
+      else
+        console.debug(formatted);
+    });
+  }
   debug(message, ...args) {
     if (this.shouldLog("debug")) {
-      const formatted = this.formatMessage("debug", message, ...args);
-      getLiveRenderer().printAbove(() => console.debug(formatted));
+      this.emit("debug", this.formatMessage("debug", message, ...args));
     }
   }
   info(message, ...args) {
     if (this.shouldLog("info")) {
-      const formatted = this.formatMessage("info", message, ...args);
-      getLiveRenderer().printAbove(() => console.info(formatted));
+      this.emit("info", this.formatMessage("info", message, ...args));
     }
   }
   warn(message, ...args) {
     if (this.shouldLog("warn")) {
-      const formatted = this.formatMessage("warn", message, ...args);
-      getLiveRenderer().printAbove(() => console.warn(formatted));
+      this.emit("warn", this.formatMessage("warn", message, ...args));
     }
   }
   error(message, ...args) {
     if (this.shouldLog("error")) {
-      const formatted = this.formatMessage("error", message, ...args);
-      getLiveRenderer().printAbove(() => console.error(formatted));
+      this.emit("error", this.formatMessage("error", message, ...args));
     }
   }
   /**
@@ -3488,7 +3645,7 @@ var S3StateBackend = class {
    *
    * Returns true for either layout: the new region-scoped key, or the legacy
    * key when its embedded `region` matches the requested region. This lets
-   * `cdkd state rm <stack> --region X` and `cdkd destroy <stack>` see legacy
+   * `cdkd state orphan <stack> --region X` and `cdkd destroy <stack>` see legacy
    * state without forcing a write-through migration first.
    */
   async stateExists(stackName, region) {
@@ -7765,112 +7922,6 @@ import {
 } from "@aws-sdk/client-iam";
 init_aws_clients();
 
-// src/provisioning/resource-name.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash } from "node:crypto";
-var stackNameStore = new AsyncLocalStorage();
-function withStackName(stackName, fn) {
-  return stackNameStore.run(stackName, fn);
-}
-function generateResourceName(name, options) {
-  const { maxLength, lowercase = false, allowedPattern = /[^a-zA-Z0-9-]/g } = options;
-  const currentStackName = stackNameStore.getStore();
-  const fullName = currentStackName ? `${currentStackName}-${name}` : name;
-  let sanitized = lowercase ? fullName.toLowerCase() : fullName;
-  sanitized = sanitized.replace(allowedPattern, "-");
-  sanitized = sanitized.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-  if (sanitized.length <= maxLength) {
-    return sanitized;
-  }
-  const hash = createHash("sha256").update(fullName).digest("hex").substring(0, 8);
-  const maxPrefixLength = maxLength - hash.length - 1;
-  const prefix = sanitized.substring(0, maxPrefixLength).replace(/-+$/, "");
-  return `${prefix}-${hash}`;
-}
-var FALLBACK_NAME_RULES = {
-  "AWS::S3::Bucket": { nameProperty: "BucketName", options: { maxLength: 63, lowercase: true } },
-  "AWS::SQS::Queue": { nameProperty: "QueueName", options: { maxLength: 80 } },
-  "AWS::SNS::Topic": { nameProperty: "TopicName", options: { maxLength: 256 } },
-  "AWS::Lambda::Function": { nameProperty: "FunctionName", options: { maxLength: 64 } },
-  "AWS::Lambda::LayerVersion": { nameProperty: "LayerName", options: { maxLength: 64 } },
-  "AWS::IAM::Role": { nameProperty: "RoleName", options: { maxLength: 64 } },
-  "AWS::IAM::Policy": { nameProperty: "PolicyName", options: { maxLength: 64 } },
-  "AWS::IAM::User": { nameProperty: "UserName", options: { maxLength: 64 } },
-  "AWS::IAM::Group": { nameProperty: "GroupName", options: { maxLength: 128 } },
-  "AWS::IAM::InstanceProfile": {
-    nameProperty: "InstanceProfileName",
-    options: { maxLength: 128 }
-  },
-  "AWS::DynamoDB::Table": { nameProperty: "TableName", options: { maxLength: 255 } },
-  "AWS::ECR::Repository": {
-    nameProperty: "RepositoryName",
-    options: { maxLength: 256, lowercase: true }
-  },
-  "AWS::ECS::Cluster": { nameProperty: "ClusterName", options: { maxLength: 255 } },
-  "AWS::ECS::Service": { nameProperty: "ServiceName", options: { maxLength: 255 } },
-  "AWS::Logs::LogGroup": { nameProperty: "LogGroupName", options: { maxLength: 512 } },
-  "AWS::CloudWatch::Alarm": { nameProperty: "AlarmName", options: { maxLength: 256 } },
-  "AWS::Events::Rule": { nameProperty: "Name", options: { maxLength: 64 } },
-  "AWS::Events::EventBus": { nameProperty: "Name", options: { maxLength: 256 } },
-  "AWS::Kinesis::Stream": { nameProperty: "Name", options: { maxLength: 128 } },
-  "AWS::StepFunctions::StateMachine": {
-    nameProperty: "StateMachineName",
-    options: { maxLength: 80 }
-  },
-  "AWS::SecretsManager::Secret": {
-    nameProperty: "Name",
-    options: { maxLength: 512, allowedPattern: /[^a-zA-Z0-9-/_]/g }
-  },
-  "AWS::SSM::Parameter": { nameProperty: "Name", options: { maxLength: 2048 } },
-  "AWS::Cognito::UserPool": { nameProperty: "UserPoolName", options: { maxLength: 128 } },
-  "AWS::ElastiCache::SubnetGroup": {
-    nameProperty: "CacheSubnetGroupName",
-    options: { maxLength: 255, lowercase: true }
-  },
-  "AWS::ElastiCache::CacheCluster": {
-    nameProperty: "ClusterName",
-    options: { maxLength: 40, lowercase: true }
-  },
-  "AWS::RDS::DBSubnetGroup": {
-    nameProperty: "DBSubnetGroupName",
-    options: { maxLength: 255, lowercase: true }
-  },
-  "AWS::RDS::DBCluster": {
-    nameProperty: "DBClusterIdentifier",
-    options: { maxLength: 63, lowercase: true }
-  },
-  "AWS::RDS::DBInstance": {
-    nameProperty: "DBInstanceIdentifier",
-    options: { maxLength: 63, lowercase: true }
-  },
-  "AWS::ElasticLoadBalancingV2::LoadBalancer": {
-    nameProperty: "Name",
-    options: { maxLength: 32 }
-  },
-  "AWS::ElasticLoadBalancingV2::TargetGroup": {
-    nameProperty: "Name",
-    options: { maxLength: 32 }
-  },
-  "AWS::WAFv2::WebACL": { nameProperty: "Name", options: { maxLength: 128 } },
-  "AWS::CodeBuild::Project": { nameProperty: "Name", options: { maxLength: 255 } },
-  "AWS::S3Express::DirectoryBucket": {
-    nameProperty: "BucketName",
-    options: { maxLength: 63, lowercase: true }
-  }
-};
-function applyDefaultNameForFallback(logicalId, resourceType, properties) {
-  const rule = FALLBACK_NAME_RULES[resourceType];
-  if (!rule)
-    return properties;
-  if (properties[rule.nameProperty])
-    return properties;
-  const generatedName = generateResourceName(logicalId, rule.options);
-  return {
-    ...properties,
-    [rule.nameProperty]: generatedName
-  };
-}
-
 // src/provisioning/import-helpers.ts
 function readNameProperty(input, propertyName) {
   const value = input.properties?.[propertyName];
@@ -29998,6 +30049,68 @@ async function deployCommand(stacks, options) {
     }
     const summary = workGraph.summary();
     logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
+    const bufferStackOutput = targetStacks.length > 1;
+    const runStack = async (stackInfo) => {
+      const stackRegion = stackInfo.region || baseRegion;
+      logger.info(
+        `
+Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region: ${stackRegion})` : ""}`
+      );
+      switchRegion(stackRegion);
+      const stackAwsClients = new AwsClients({
+        region: stackRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      setAwsClients(stackAwsClients);
+      const stateS3Client = new AwsClients({
+        region: baseRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      const stackStateBackend = new S3StateBackend(stateS3Client.s3, stateConfig, {
+        region: baseRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      const stackLockManager = new LockManager(stateS3Client.s3, stateConfig);
+      const stackProviderRegistry = new ProviderRegistry();
+      registerAllProviders(stackProviderRegistry);
+      stackProviderRegistry.setCustomResourceResponseBucket(stateBucket, baseRegion);
+      const stackDeployEngine = new DeployEngine(
+        stackStateBackend,
+        stackLockManager,
+        dagBuilder,
+        diffCalculator,
+        stackProviderRegistry,
+        {
+          concurrency: options.concurrency,
+          dryRun: options.dryRun,
+          noRollback: !options.rollback
+        },
+        stackRegion
+      );
+      try {
+        const deployResult = await stackDeployEngine.deploy(
+          stackInfo.stackName,
+          stackInfo.template
+        );
+        logger.info("\nDeployment Summary:");
+        logger.info(`  Stack: ${deployResult.stackName}`);
+        logger.info(`  Created: ${deployResult.created}`);
+        logger.info(`  Updated: ${deployResult.updated}`);
+        logger.info(`  Deleted: ${deployResult.deleted}`);
+        logger.info(`  Unchanged: ${deployResult.unchanged}`);
+        logger.info(`  Duration: ${(deployResult.durationMs / 1e3).toFixed(2)}s`);
+        if (options.dryRun) {
+          logger.info("\n\u2713 Dry run completed - no actual changes made");
+        } else {
+          logger.info("\n\u2713 Deployment completed successfully");
+        }
+      } finally {
+        stackAwsClients.destroy();
+        stateS3Client.destroy();
+        switchRegion(baseRegion);
+        setAwsClients(awsClients);
+      }
+    };
     await workGraph.execute(
       {
         "asset-build": options.imageBuildConcurrency,
@@ -30009,65 +30122,16 @@ async function deployCommand(stacks, options) {
           await assetPublisher.executeNode(node);
         } else {
           const { stack: stackInfo } = node.data;
-          const stackRegion = stackInfo.region || baseRegion;
-          logger.info(
-            `
-Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region: ${stackRegion})` : ""}`
-          );
-          switchRegion(stackRegion);
-          const stackAwsClients = new AwsClients({
-            region: stackRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          setAwsClients(stackAwsClients);
-          const stateS3Client = new AwsClients({
-            region: baseRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          const stackStateBackend = new S3StateBackend(stateS3Client.s3, stateConfig, {
-            region: baseRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          const stackLockManager = new LockManager(stateS3Client.s3, stateConfig);
-          const stackProviderRegistry = new ProviderRegistry();
-          registerAllProviders(stackProviderRegistry);
-          stackProviderRegistry.setCustomResourceResponseBucket(stateBucket, baseRegion);
-          const stackDeployEngine = new DeployEngine(
-            stackStateBackend,
-            stackLockManager,
-            dagBuilder,
-            diffCalculator,
-            stackProviderRegistry,
-            {
-              concurrency: options.concurrency,
-              dryRun: options.dryRun,
-              noRollback: !options.rollback
-            },
-            stackRegion
-          );
-          try {
-            const deployResult = await stackDeployEngine.deploy(
-              stackInfo.stackName,
-              stackInfo.template
-            );
-            logger.info("\nDeployment Summary:");
-            logger.info(`  Stack: ${deployResult.stackName}`);
-            logger.info(`  Created: ${deployResult.created}`);
-            logger.info(`  Updated: ${deployResult.updated}`);
-            logger.info(`  Deleted: ${deployResult.deleted}`);
-            logger.info(`  Unchanged: ${deployResult.unchanged}`);
-            logger.info(`  Duration: ${(deployResult.durationMs / 1e3).toFixed(2)}s`);
-            if (options.dryRun) {
-              logger.info("\n\u2713 Dry run completed - no actual changes made");
-            } else {
-              logger.info("\n\u2713 Deployment completed successfully");
-            }
-          } finally {
-            stackAwsClients.destroy();
-            stateS3Client.destroy();
-            switchRegion(baseRegion);
-            setAwsClients(awsClients);
+          if (!bufferStackOutput) {
+            await runStack(stackInfo);
+            return;
           }
+          const outcome = await runStackBuffered(() => runStack(stackInfo));
+          if (outcome.lines.length > 0) {
+            process.stdout.write(outcome.lines.join("\n") + "\n");
+          }
+          if (!outcome.ok)
+            throw outcome.error;
         }
       }
     );
@@ -30630,7 +30694,7 @@ Preparing to destroy stack: ${stackName}`);
       } else {
         const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
         throw new Error(
-          `Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state rm ${stackName} --region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`
+          `Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state orphan ${stackName} --region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`
         );
       }
       const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
@@ -30670,8 +30734,192 @@ function createDestroyCommand() {
   return cmd;
 }
 
+// src/cli/commands/orphan.ts
+import * as readline2 from "node:readline/promises";
+import { Command as Command7 } from "commander";
+init_aws_clients();
+async function orphanCommand(stackArgs, options) {
+  const logger = getLogger();
+  if (options.verbose)
+    logger.setLevel("debug");
+  warnIfDeprecatedRegion(options);
+  const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+  const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+  logger.info("Starting stack orphan...");
+  logger.debug("Options:", options);
+  if (options.region) {
+    process.env["AWS_REGION"] = options.region;
+    process.env["AWS_DEFAULT_REGION"] = options.region;
+  }
+  const awsClients = new AwsClients({
+    ...options.region && { region: options.region },
+    ...options.profile && { profile: options.profile }
+  });
+  setAwsClients(awsClients);
+  try {
+    const stateConfig = {
+      bucket: stateBucket,
+      prefix: options.statePrefix
+    };
+    const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+      ...options.region && { region: options.region },
+      ...options.profile && { profile: options.profile }
+    });
+    await stateBackend.verifyBucketExists();
+    const lockManager = new LockManager(awsClients.s3, stateConfig);
+    const appCmd = options.app || resolveApp();
+    let appStacks = [];
+    if (appCmd) {
+      try {
+        const synthesizer = new Synthesizer();
+        const context = parseContextOptions(options.context);
+        const result = await synthesizer.synthesize({
+          app: appCmd,
+          output: options.output || "cdk.out",
+          ...Object.keys(context).length > 0 && { context }
+        });
+        appStacks = result.stacks.map((s) => ({
+          stackName: s.stackName,
+          displayName: s.displayName,
+          ...s.region && { region: s.region }
+        }));
+      } catch {
+        logger.debug("Could not synthesize app, falling back to state-based stack list");
+      }
+    }
+    const allStateRefs = await stateBackend.listStacks();
+    let candidateStacks;
+    if (appStacks.length > 0) {
+      const stateNames = new Set(allStateRefs.map((r) => r.stackName));
+      candidateStacks = appStacks.filter((s) => stateNames.has(s.stackName));
+    } else if (stackArgs.length > 0 || options.stack || options.all) {
+      const seen = /* @__PURE__ */ new Set();
+      candidateStacks = [];
+      for (const ref of allStateRefs) {
+        if (seen.has(ref.stackName))
+          continue;
+        seen.add(ref.stackName);
+        candidateStacks.push({ stackName: ref.stackName });
+      }
+    } else {
+      throw new Error(
+        "Could not determine which stacks belong to this app. Specify stack names explicitly, use --all, or ensure --app / cdk.json is configured."
+      );
+    }
+    const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
+    let stackNames;
+    if (options.all) {
+      stackNames = candidateStacks.map((s) => s.stackName);
+    } else if (stackPatterns.length > 0) {
+      stackNames = matchStacks(candidateStacks, stackPatterns).map((s) => s.stackName);
+    } else if (candidateStacks.length === 1) {
+      stackNames = candidateStacks.map((s) => s.stackName);
+    } else if (candidateStacks.length === 0) {
+      logger.info("No stacks found in state");
+      return;
+    } else {
+      throw new Error(
+        `Multiple stacks found: ${candidateStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`
+      );
+    }
+    if (stackNames.length === 0) {
+      logger.info("No matching stacks found in state");
+      return;
+    }
+    logger.info(`Found ${stackNames.length} stack(s) to orphan: ${stackNames.join(", ")}`);
+    const stateRefsByName = /* @__PURE__ */ new Map();
+    for (const ref of allStateRefs) {
+      const arr = stateRefsByName.get(ref.stackName) ?? [];
+      arr.push(ref);
+      stateRefsByName.set(ref.stackName, arr);
+    }
+    const skipConfirmation = options.yes || options.force;
+    for (const stackName of stackNames) {
+      const refs = stateRefsByName.get(stackName) ?? [];
+      if (refs.length === 0) {
+        logger.info(`No state found for stack: ${stackName}, skipping`);
+        continue;
+      }
+      const targets = options.stackRegion ? refs.filter((r) => r.region === options.stackRegion) : refs;
+      if (targets.length === 0) {
+        const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
+        throw new Error(
+          `No state found for stack '${stackName}' in region '${options.stackRegion}'. Available regions: ${seen}.`
+        );
+      }
+      if (!options.force) {
+        for (const target of targets) {
+          const locked = await lockManager.isLocked(stackName, target.region);
+          if (locked) {
+            const where = target.region ?? "(legacy)";
+            throw new Error(
+              `Stack '${stackName}' (${where}) is locked. Run 'cdkd force-unlock ${stackName}${target.region ? ` --stack-region ${target.region}` : ""}' first, or pass --force to orphan anyway.`
+            );
+          }
+        }
+      }
+      if (!skipConfirmation) {
+        const targetList = targets.map((t) => t.region ? `${stackName} (${t.region})` : stackName).join(", ");
+        process.stdout.write(
+          `
+WARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.
+Use 'cdkd destroy ${stackName}' if you want to delete the actual resources.
+
+`
+        );
+        const rl = readline2.createInterface({
+          input: process.stdin,
+          output: process.stdout
+        });
+        const answer = await rl.question(
+          `Orphan state for ${targetList} from s3://${stateBucket}/${options.statePrefix}/? (y/N): `
+        );
+        rl.close();
+        const trimmed = answer.trim().toLowerCase();
+        if (trimmed !== "y" && trimmed !== "yes") {
+          logger.info(`Cancelled orphan of stack: ${stackName}`);
+          continue;
+        }
+      }
+      for (const target of targets) {
+        if (target.region) {
+          await stateBackend.deleteState(stackName, target.region);
+          await lockManager.forceReleaseLock(stackName, target.region);
+        } else {
+          await lockManager.forceReleaseLock(stackName, void 0);
+        }
+        const label = target.region ? `${stackName} (${target.region})` : stackName;
+        logger.info(`\u2713 Orphaned state for stack: ${label}`);
+      }
+    }
+  } finally {
+    awsClients.destroy();
+  }
+}
+function createOrphanCommand() {
+  const cmd = new Command7("orphan").description(
+    "Remove cdkd's state record for one or more stacks (does NOT delete AWS resources). Synth-driven; for the CDK-app-free version use 'cdkd state orphan'."
+  ).argument(
+    "[stacks...]",
+    "Stack name(s) to orphan. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*')."
+  ).option("--all", "Orphan all stacks in the current app", false).option(
+    "--stack-region <region>",
+    "Region of the stack record to operate on. Required when the same stack name has state in multiple regions."
+  ).action(withErrorHandling(orphanCommand));
+  [
+    ...commonOptions,
+    ...appOptions,
+    ...stateOptions,
+    ...stackOptions,
+    ...destroyOptions,
+    ...contextOptions
+  ].forEach((opt) => cmd.addOption(opt));
+  cmd.addOption(deprecatedRegionOption);
+  return cmd;
+}
+
 // src/cli/commands/publish-assets.ts
-import { Option as Option3, Command as Command7 } from "commander";
+import { Option as Option3, Command as Command8 } from "commander";
 async function publishAssetsCommand(options) {
   const logger = getLogger();
   if (options.verbose) {
@@ -30690,7 +30938,7 @@ async function publishAssetsCommand(options) {
   logger.info("\u2705 Asset publishing complete");
 }
 function createPublishAssetsCommand() {
-  const cmd = new Command7("publish-assets").description("Publish assets to S3/ECR from asset manifest").requiredOption("--path <path>", "Path to asset manifest file or directory").addOption(
+  const cmd = new Command8("publish-assets").description("Publish assets to S3/ECR from asset manifest").requiredOption("--path <path>", "Path to asset manifest file or directory").addOption(
     new Option3(
       "--asset-publish-concurrency <number>",
       "Maximum concurrent asset publish operations"
@@ -30704,7 +30952,7 @@ function createPublishAssetsCommand() {
 }
 
 // src/cli/commands/force-unlock.ts
-import { Command as Command8, Option as Option4 } from "commander";
+import { Command as Command9, Option as Option4 } from "commander";
 init_aws_clients();
 async function forceUnlockCommand(stackArgs, options) {
   const logger = getLogger();
@@ -30764,7 +31012,7 @@ async function forceUnlockCommand(stackArgs, options) {
   }
 }
 function createForceUnlockCommand() {
-  const cmd = new Command8("force-unlock").description("Force-release a stale lock on a stack").argument("[stacks...]", "Stack name(s) to unlock").addOption(
+  const cmd = new Command9("force-unlock").description("Force-release a stale lock on a stack").argument("[stacks...]", "Stack name(s) to unlock").addOption(
     new Option4(
       "--stack-region <region>",
       "Stack region whose lock to release (use when the same stack name has locks in multiple regions). Defaults to all regions where the stack has state."
@@ -30776,8 +31024,8 @@ function createForceUnlockCommand() {
 }
 
 // src/cli/commands/state.ts
-import * as readline3 from "node:readline/promises";
-import { Command as Command10, Option as Option5 } from "commander";
+import * as readline4 from "node:readline/promises";
+import { Command as Command11, Option as Option5 } from "commander";
 import {
   GetBucketLocationCommand as GetBucketLocationCommand2,
   GetObjectCommand as GetObjectCommand4,
@@ -30786,8 +31034,8 @@ import {
 init_aws_clients();
 
 // src/cli/commands/state-migrate.ts
-import * as readline2 from "node:readline/promises";
-import { Command as Command9 } from "commander";
+import * as readline3 from "node:readline/promises";
+import { Command as Command10 } from "commander";
 import {
   CopyObjectCommand,
   CreateBucketCommand as CreateBucketCommand4,
@@ -31061,7 +31309,7 @@ async function emptyBucketAllVersions(s3, bucket) {
   } while (keyMarker || versionIdMarker);
 }
 async function confirmPrompt(prompt) {
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -31070,7 +31318,7 @@ async function confirmPrompt(prompt) {
   }
 }
 function createStateMigrateCommand() {
-  const cmd = new Command9("migrate").description(
+  const cmd = new Command10("migrate").description(
     "Migrate state from the legacy region-suffixed bucket (cdkd-state-{account}-{region}) to the new region-free default (cdkd-state-{account}). Source bucket is kept by default; pass --remove-legacy to delete it after a successful migration."
   ).option(
     "--region <region>",
@@ -31228,7 +31476,7 @@ async function stateListCommand(options) {
   }
 }
 function createStateListCommand() {
-  const cmd = new Command10("list").alias("ls").description("List stacks registered in the cdkd state bucket").option("-l, --long", "Show resource count, last-modified time, and lock status", false).option("--json", "Output as JSON", false).action(withErrorHandling(stateListCommand));
+  const cmd = new Command11("list").alias("ls").description("List stacks registered in the cdkd state bucket").option("-l, --long", "Show resource count, last-modified time, and lock status", false).option("--json", "Output as JSON", false).action(withErrorHandling(stateListCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31332,7 +31580,7 @@ function formatLockSummary(lockInfo) {
   return `locked by ${lockInfo.owner}${opStr}, ${expiresStr}`;
 }
 function createStateResourcesCommand() {
-  const cmd = new Command10("resources").description("List resources recorded in a stack's state").argument("<stack>", "Stack name (physical CloudFormation name)").option("-l, --long", "Include dependencies and attributes per resource", false).option("--json", "Output as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateResourcesCommand));
+  const cmd = new Command11("resources").description("List resources recorded in a stack's state").argument("<stack>", "Stack name (physical CloudFormation name)").option("-l, --long", "Include dependencies and attributes per resource", false).option("--json", "Output as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateResourcesCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31420,17 +31668,17 @@ async function stateShowCommand(stackName, options) {
   }
 }
 function createStateShowCommand() {
-  const cmd = new Command10("show").description("Show the full cdkd state record for a stack (metadata, outputs, resources)").argument("<stack>", "Stack name (physical CloudFormation name)").option("--json", "Output the raw state and lock as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateShowCommand));
+  const cmd = new Command11("show").description("Show the full cdkd state record for a stack (metadata, outputs, resources)").argument("<stack>", "Stack name (physical CloudFormation name)").option("--json", "Output the raw state and lock as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(stateShowCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
 }
-async function stateRmCommand(stackArgs, options) {
+async function stateOrphanCommand(stackArgs, options) {
   const logger = getLogger();
   if (options.verbose)
     logger.setLevel("debug");
   if (stackArgs.length === 0) {
-    throw new Error("Stack name is required. Usage: cdkd state rm <stack> [<stack>...]");
+    throw new Error("Stack name is required. Usage: cdkd state orphan <stack> [<stack>...]");
   }
   const setup = await setupStateBackend(options);
   try {
@@ -31468,7 +31716,7 @@ Use 'cdkd destroy ${stackName}' if you want to delete the actual resources.
 
 `
         );
-        const rl = readline3.createInterface({
+        const rl = readline4.createInterface({
           input: process.stdin,
           output: process.stdout
         });
@@ -31502,8 +31750,10 @@ function stackRegionOption() {
     "Region of the stack record to operate on. Required when the same stack name has state in multiple regions."
   );
 }
-function createStateRmCommand() {
-  const cmd = new Command10("rm").description("Remove cdkd state for one or more stacks (does NOT delete AWS resources)").argument("<stacks...>", "Stack name(s) to remove from state").option("-f, --force", "Skip confirmation and remove even if the stack is locked", false).addOption(stackRegionOption()).action(withErrorHandling(stateRmCommand));
+function createStateOrphanCommand() {
+  const cmd = new Command11("orphan").description(
+    "Orphan one or more stacks from cdkd state (removes the state record; does NOT delete AWS resources)"
+  ).argument("<stacks...>", "Stack name(s) to orphan from state").option("-f, --force", "Skip confirmation and remove even if the stack is locked", false).addOption(stackRegionOption()).action(withErrorHandling(stateOrphanCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -31553,7 +31803,7 @@ WARNING: This destroys ${stackNames.length} stack(s) and removes their state rec
 `);
       }
       process.stdout.write("\n");
-      const rl = readline3.createInterface({
+      const rl = readline4.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -31628,8 +31878,8 @@ Preparing to destroy stack: ${stackName}${ref.region ? ` (${ref.region})` : ""}`
   }
 }
 function createStateDestroyCommand() {
-  const cmd = new Command10("destroy").description(
-    "Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state rm'."
+  const cmd = new Command11("destroy").description(
+    "Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'."
   ).argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").option("--all", "Destroy every stack in the state bucket", false).addOption(stackRegionOption()).addHelpText(
     "after",
     [
@@ -31641,7 +31891,7 @@ function createStateDestroyCommand() {
       "  cdkd state destroy MyStack --state-bucket cdkd-state-test",
       "  cdkd state destroy MyStack --stack-region us-west-2",
       "",
-      "For removing only the state record (keeping AWS resources intact), use 'cdkd state rm'."
+      "For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'."
     ].join("\n")
   ).action(withErrorHandling(stateDestroyCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
@@ -31760,19 +32010,19 @@ async function stateInfoCommand(options) {
   }
 }
 function createStateInfoCommand() {
-  const cmd = new Command10("info").description(
+  const cmd = new Command11("info").description(
     "Show cdkd state bucket info (bucket name, region, source, schema version, stack count)"
   ).option("--json", "Output as JSON", false).action(withErrorHandling(stateInfoCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   return cmd;
 }
 function createStateCommand() {
-  const cmd = new Command10("state").description("Manage cdkd state stored in S3");
+  const cmd = new Command11("state").description("Manage cdkd state stored in S3");
   cmd.addCommand(createStateInfoCommand());
   cmd.addCommand(createStateListCommand());
   cmd.addCommand(createStateResourcesCommand());
   cmd.addCommand(createStateShowCommand());
-  cmd.addCommand(createStateRmCommand());
+  cmd.addCommand(createStateOrphanCommand());
   cmd.addCommand(createStateDestroyCommand());
   cmd.addCommand(createStateMigrateCommand());
   return cmd;
@@ -31780,8 +32030,8 @@ function createStateCommand() {
 
 // src/cli/commands/import.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import * as readline4 from "node:readline/promises";
-import { Command as Command11 } from "commander";
+import * as readline5 from "node:readline/promises";
+import { Command as Command12 } from "commander";
 init_aws_clients();
 async function importCommand(stackArg, options) {
   const logger = getLogger();
@@ -32077,7 +32327,7 @@ function formatOutcome(outcome) {
   }
 }
 async function confirmPrompt2(prompt) {
-  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -32086,7 +32336,7 @@ async function confirmPrompt2(prompt) {
   }
 }
 function createImportCommand() {
-  const cmd = new Command11("import").description(
+  const cmd = new Command12("import").description(
     "Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies; uses the aws:cdk:path tag (or explicit --resource overrides) to find each resource in AWS."
   ).argument(
     "[stack]",
@@ -32122,6 +32372,7 @@ var SUBCOMMANDS = /* @__PURE__ */ new Set([
   "deploy",
   "diff",
   "destroy",
+  "orphan",
   "import",
   "publish-assets",
   "force-unlock",
@@ -32138,14 +32389,15 @@ function reorderArgs(argv) {
   return [...prefix, ...cmdAndAfter, ...beforeCmd];
 }
 async function main() {
-  const program = new Command12();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.17.1");
+  const program = new Command13();
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.18.1");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());
   program.addCommand(createDeployCommand());
   program.addCommand(createDiffCommand());
   program.addCommand(createDestroyCommand());
+  program.addCommand(createOrphanCommand());
   program.addCommand(createImportCommand());
   program.addCommand(createPublishAssetsCommand());
   program.addCommand(createForceUnlockCommand());