@go-to-k/cdkd 0.284.29 → 0.284.31

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-CE-tOz2d.js";
+import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-DYdEWX-s.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DzbiUvJi.js";
+import { t as ASGProvider } from "./asg-provider-DJvcY8lj.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -77,6 +77,162 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
+//#region src/cli/commands/state-file-keys.ts
+/**
+* Shared helpers for enumerating and describing cdkd state-bucket keys.
+*
+* Extracted from `bootstrap-destroy.ts` (issue #1010) so that `cdkd gc`
+* (issue #1012) reuses the exact same whole-bucket state-file discovery
+* instead of duplicating it — the "scan the WHOLE bucket, not just the
+* default `cdkd/` prefix" rule was a review blocker once already (PR #1018)
+* and must not drift between the two commands.
+*/
+/**
+* Every cdkd state file ends with this suffix, regardless of the
+* `--state-prefix` it was deployed under (`{prefix}/{stack}/{region}/state.json`,
+* or legacy `{prefix}/{stack}/state.json`).
+*/
+const STATE_FILE_SUFFIX = "/state.json";
+/**
+* The prefix `cdkd bootstrap` writes under, and the one `gc` /
+* `bootstrap --destroy` configure their own state backend with.
+*
+* Shared here rather than spelled per command for the same reason this module
+* exists at all: `bootstrap-destroy.ts` and `gc.ts` each held their own copy,
+* and it is now also the `knownPrefix` argument to {@link describeStateKey},
+* where a copy that drifted from the backend's actual prefix would silently
+* send every key back to the shape heuristic instead of the exact depth rule.
+*
+* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
+* the whole-bucket listings deliberately do not scope to it.
+*/
+const DEFAULT_STATE_PREFIX = "cdkd";
+/**
+* Segments left under a known prefix for the legacy `{prefix}/{stack}` layout.
+*
+* The twin of `S3StateBackend`'s `LEGACY_KEY_DEPTH`, which counts the
+* `state.json` segment as well; this one counts what remains after the prefix
+* and the suffix are stripped, so it is that value minus one. Fenced against it
+* by a unit test rather than imported, because a value import from
+* `s3-state-backend.js` breaks the suites that mock that module.
+*/
+const LEGACY_SEGMENTS_UNDER_PREFIX = 1;
+/**
+* Every cdkd stack lock ends with this suffix — the lock lives next to the
+* state file (`{prefix}/{stack}/{region}/lock.json`, or the legacy region-less
+* `{prefix}/{stack}/lock.json` that `lock-manager.ts` still writes for a
+* pre-v2 stack).
+*/
+const LOCK_FILE_SUFFIX = "/lock.json";
+/**
+* `us-east-1` / `ap-northeast-1` / `us-gov-west-1` — a region-shaped segment.
+*
+* The first token is `[a-z]{2}` OR the literal `eusc` (issue #2001). Every
+* region AWS ships has a two-letter first token except the European Sovereign
+* Cloud partition's, which is four — `eusc-de-east-1` — and the old
+* `^[a-z]{2}` rejected that whole partition. Enumerated from
+* `aws-cdk-lib/region-info` and `@aws-sdk/util-endpoints`: 46 REAL regions,
+* first tokens all two letters or `eusc`, none three. (A count of 53 includes
+* the `aws-global` / `aws-iso-*-global` PSEUDO-regions, whose first token is
+* `aws`; they carry no trailing `-<digits>`, so this pattern rejects them and
+* so did the old one — no behavioural difference, but at 53 the "two letters
+* or eusc" claim is false as stated.)
+*
+* **The exception is enumerated rather than widened, and that is the whole
+* design.** The obvious fix — relaxing the bound to `{2,4}` — was written
+* first and review measured what it cost: `api-prod-1`, `demo-app-1`,
+* `dev-api-1`, `core-api-1`, `test-stack-2` all become region-shaped under it.
+* Those are idiomatic STACK names, and in the legacy region-less layout a
+* stack name sits exactly where a region would, so the pattern would report
+* the key's PREFIX as the stack for each of them — the same wrong answer this
+* issue is about, arriving from the other side and at a far higher rate. A
+* length class cannot separate `eusc` from `demo`; only naming the partition
+* can.
+*
+* The cost of enumerating is that a future partition with a new non-two-letter
+* token needs this line updated. That is the same failure this issue fixed, it
+* is a one-token change, and it fails in the recoverable direction (a region
+* read as a stack name) rather than corrupting ordinary stack names.
+*
+* It stays SHAPE-based and deliberately does not reuse `isClientSafeRegion`
+* from `intrinsic-function-resolver.ts`: that predicate is charset-based (its
+* job is to keep a value inside a hostname label, so it accepts anything
+* lowercase-alphanumeric) and would classify almost every stack name as a
+* region. This one has the opposite job — telling a region segment apart from
+* a stack name in the same position — so it must constrain the shape.
+*
+* A two-letter STACK name like `db-prod-1` is still misread in the legacy
+* layout; that is pre-existing (`main` does the same) and is what the
+* `knownPrefix` depth rule below repairs for callers that can supply one.
+*/
+const REGION_SEGMENT = /^(?:[a-z]{2}|eusc)(-[a-z]+)+-\d+$/;
+/**
+* List every state file in the bucket — the WHOLE bucket, not just the
+* default `cdkd/` prefix. Other commands accept `--state-prefix`, so live
+* stack state may exist under ANY prefix in this bucket; scoping this
+* listing to the default prefix would let reference scans and teardown
+* guards silently miss those stacks and delete live data.
+*/
+async function listAllStateKeys(stateBackend) {
+	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(STATE_FILE_SUFFIX));
+}
+/**
+* List every stack lock file in the bucket — same whole-bucket rule as
+* {@link listAllStateKeys}. A lock under ANY prefix means a deploy /
+* destroy may be in flight for that stack.
+*/
+async function listAllLockKeys(stateBackend) {
+	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(LOCK_FILE_SUFFIX));
+}
+/**
+* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
+* `{prefix}/{stack}/state.json` → `stack`. Pass {@link LOCK_FILE_SUFFIX} to
+* describe lock keys.
+*
+* The shape heuristic below cannot be made exact, and it errs in BOTH
+* directions -- a region it fails to recognise is reported AS the stack name,
+* while a region-shaped STACK name in the legacy layout makes it report the
+* key's PREFIX as the stack. Neither is safe: `cdkd gc`'s corrupt-state abort
+* turns whichever answer it gets into a `cdkd state show ...` recovery
+* command, so a wrong one is handed to the user as a command to run.
+*
+* `knownPrefix` narrows it where a caller can: a key with exactly one segment
+* under a prefix we know is the legacy `{stack}` layout by construction,
+* whatever the stack is named, so no shape test is needed there at all. That
+* repairs the pre-existing two-letter case (`cdkd/db-prod-1/state.json`, which
+* `main` describes as `cdkd (db-prod-1)`).
+*
+* **It is a narrowing, not a safety net for the pattern above.** A first cut
+* treated it as one — widening `REGION_SEGMENT` to `{2,4}` and relying on this
+* rule to undo the damage — and review measured that the damage is repo-wide
+* while this rule reaches only keys under the ONE prefix a caller names. The
+* listing deliberately spans the whole bucket, so foreign and nested prefixes
+* are in scope and unreachable from here; six shapes regressed against `main`
+* that way. The pattern must be right on its own.
+*
+* **It deliberately does NOT claim the two-segment case.** A first cut did, on
+* the reasoning that at that depth the last segment must be the region -- and
+* review found `--state-prefix cdkd/team-a`, which nests inside the default
+* prefix, so `cdkd/team-a/MyStack/state.json` is a LEGACY key two segments
+* deep and would have been mis-split as `team-a (MyStack)` where `main` said
+* `MyStack`. Depth cannot tell that apart from a real `{stack}/{region}`; only
+* the shape of the tail can, so the heuristic keeps that case.
+*/
+function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
+	const body = key.slice(0, -suffix.length);
+	const prefix = knownPrefix?.replace(/\/+$/, "");
+	if (prefix !== void 0 && prefix !== "" && key.startsWith(`${prefix}/`)) {
+		const rest = body.slice(prefix.length + 1).split("/");
+		if (rest.length === LEGACY_SEGMENTS_UNDER_PREFIX && rest[0]) return rest[0];
+	}
+	const segments = body.split("/");
+	const last = segments[segments.length - 1] ?? key;
+	const secondLast = segments[segments.length - 2];
+	if (secondLast !== void 0 && secondLast !== "" && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
+	return last;
+}
+
+//#endregion
 //#region src/cli/options.ts
 /**
 * Parse context key=value pairs from CLI arguments into a Record
@@ -152,7 +308,7 @@ const appOptions = [new Option("-a, --app <command>", "CDK app command (e.g., \"
 * --state-bucket is optional: falls back to CDKD_STATE_BUCKET env var,
 * then cdk.json context.cdkd.stateBucket
 */
-const stateOptions = [new Option("--state-bucket <bucket>", "S3 bucket for state storage. Falls back to CDKD_STATE_BUCKET env or cdk.json"), new Option("--state-prefix <prefix>", "S3 key prefix for state files").default("cdkd")];
+const stateOptions = [new Option("--state-bucket <bucket>", "S3 bucket for state storage. Falls back to CDKD_STATE_BUCKET env or cdk.json"), new Option("--state-prefix <prefix>", "S3 key prefix for state files").default(DEFAULT_STATE_PREFIX)];
 /**
 * Stack options
 */
@@ -1025,91 +1181,9 @@ function regionNeedsReconciliation(effective) {
 	return effective.region !== LEGACY_DEFAULT_REGION;
 }
 
-//#endregion
-//#region src/cli/commands/state-file-keys.ts
-/**
-* Shared helpers for enumerating and describing cdkd state-bucket keys.
-*
-* Extracted from `bootstrap-destroy.ts` (issue #1010) so that `cdkd gc`
-* (issue #1012) reuses the exact same whole-bucket state-file discovery
-* instead of duplicating it — the "scan the WHOLE bucket, not just the
-* default `cdkd/` prefix" rule was a review blocker once already (PR #1018)
-* and must not drift between the two commands.
-*/
-/**
-* Every cdkd state file ends with this suffix, regardless of the
-* `--state-prefix` it was deployed under (`{prefix}/{stack}/{region}/state.json`,
-* or legacy `{prefix}/{stack}/state.json`).
-*/
-const STATE_FILE_SUFFIX = "/state.json";
-/**
-* Every cdkd stack lock ends with this suffix — the lock lives next to the
-* state file (`{prefix}/{stack}/{region}/lock.json`).
-*/
-const LOCK_FILE_SUFFIX = "/lock.json";
-/** `us-east-1` / `ap-northeast-1` / `us-gov-west-1` — a region-shaped segment. */
-const REGION_SEGMENT = /^[a-z]{2}(-[a-z]+)+-\d+$/;
-/**
-* List every state file in the bucket — the WHOLE bucket, not just the
-* default `cdkd/` prefix. Other commands accept `--state-prefix`, so live
-* stack state may exist under ANY prefix in this bucket; scoping this
-* listing to the default prefix would let reference scans and teardown
-* guards silently miss those stacks and delete live data.
-*/
-async function listAllStateKeys(stateBackend) {
-	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(STATE_FILE_SUFFIX));
-}
-/**
-* List every stack lock file in the bucket — same whole-bucket rule as
-* {@link listAllStateKeys}. A lock under ANY prefix means a deploy /
-* destroy may be in flight for that stack.
-*/
-async function listAllLockKeys(stateBackend) {
-	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(LOCK_FILE_SUFFIX));
-}
-/**
-* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
-* `{prefix}/{stack}/state.json` → `stack`. The prefix is arbitrary (custom
-* `--state-prefix` values included), so the stack/region pair is derived
-* from the key's TAIL: the last segment is treated as a region only when
-* it is region-shaped. Pass {@link LOCK_FILE_SUFFIX} to describe lock keys.
-*/
-function describeStateKey(key, suffix = STATE_FILE_SUFFIX) {
-	const segments = key.slice(0, -suffix.length).split("/");
-	const last = segments[segments.length - 1] ?? key;
-	const secondLast = segments[segments.length - 2];
-	if (secondLast !== void 0 && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
-	return last;
-}
-
 //#endregion
 //#region src/cli/commands/bootstrap-destroy.ts
 /**
-* `cdkd bootstrap --destroy` — teardown of cdkd-created account resources
-* (issue #1010, the reverse of `cdkd bootstrap` / `ensureAssetStorage`).
-*
-* Scope per invocation is ONE region's asset storage (`--region`, same
-* option the create side uses): empty + delete the asset bucket, force-
-* delete the container-asset ECR repo, then delete the region's bootstrap
-* marker LAST — the mirror image of the create side's marker-written-last
-* ordering, so a crash mid-teardown leaves the region still consistently
-* opted in (marker present → deploys keep hard-erroring at the missing
-* resources with a re-bootstrap hint, never a silent legacy fallback).
-*
-* The asset bucket / repo NAMES are read from the region's bootstrap
-* marker, NOT recomputed from the naming convention — the marker is the
-* source of truth for names (design §4.1), which keeps this teardown
-* compatible with custom asset-storage names (issue #1011).
-*
-* The state bucket is NOT deleted by default: it is the account's source
-* of truth. `--include-state-bucket` opts in, and even then the deletion
-* is refused while ANY stack state exists in the bucket or any OTHER
-* region is still opted in to asset storage (deleting their markers would
-* silently flip those regions back to legacy mode).
-*/
-/** S3 key prefix for state files — same fixed value the create side uses. */
-const STATE_PREFIX = "cdkd";
-/**
 * Interactive confirmation for the teardown. Follows the repo's
 * destructive-prompt convention (see `recreate-confirm-prompt.ts`, the
 * same pattern family as `confirm-prompt.ts`): print the deletion plan as
@@ -1157,7 +1231,7 @@ async function scanStateReferences(stateBackend, names) {
 	for (const key of stateKeys) {
 		const body = await stateBackend.getRawObject(key);
 		if (body === null) continue;
-		if (names.some((name) => body.includes(name))) referencing.push(describeStateKey(key));
+		if (names.some((name) => body.includes(name))) referencing.push(describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX));
 	}
 	return referencing;
 }
@@ -1332,7 +1406,7 @@ async function bootstrapDestroyCommand(options) {
 			...options.profile && { profile: options.profile }
 		}), {
 			bucket: bucketName,
-			prefix: STATE_PREFIX
+			prefix: DEFAULT_STATE_PREFIX
 		}, {
 			region: effective.region,
 			...options.profile && { profile: options.profile }
@@ -1361,7 +1435,7 @@ async function bootstrapDestroyCommand(options) {
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
-		prefix: STATE_PREFIX
+		prefix: DEFAULT_STATE_PREFIX
 	}, {
 		region,
 		...options.profile && { profile: options.profile }
@@ -1413,7 +1487,7 @@ async function bootstrapDestroyCommand(options) {
 		if (options.includeStateBucket) {
 			const stateKeys = await listAllStateKeys(stateBackend);
 			if (stateKeys.length > 0) {
-				const listing = stateKeys.map((k) => `  - ${describeStateKey(k)}  [${k}]`).join("\n");
+				const listing = stateKeys.map((k) => `  - ${describeStateKey(k, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
 				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
 			}
 			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
@@ -1509,7 +1583,7 @@ async function bootstrapCommand(options) {
 			...options.profile && { profile: options.profile }
 		}), {
 			bucket: bucketName,
-			prefix: "cdkd"
+			prefix: DEFAULT_STATE_PREFIX
 		}, {
 			region: effective.region,
 			...options.profile && { profile: options.profile }
@@ -1610,7 +1684,7 @@ async function bootstrapCommand(options) {
 			});
 			const stateBackend = new S3StateBackend(markerS3Client, {
 				bucket: bucketName,
-				prefix: "cdkd"
+				prefix: DEFAULT_STATE_PREFIX
 			}, {
 				region,
 				...options.profile && { profile: options.profile }
@@ -64081,6 +64155,30 @@ function stripWalk(value) {
 //#endregion
 //#region src/cli/commands/drift.ts
 /**
+* Route one outcome to the handler for its variant.
+*
+* The mechanism issue [#2135](https://github.com/go-to-k/cdkd/issues/2135) asks
+* for, and the reason every consumer in this file goes through it rather than
+* filtering on `o.kind === '...'`: `handlers` is a MAPPED TYPE over
+* `DriftOutcome['kind']`, so it must name EVERY variant. Adding a member to the
+* union turns every call site that has not been updated into a compile error
+* ("property '<kind>' is missing"), instead of leaving it to fall through to
+* whatever it happened to do before. A `.filter()` predicate cannot do that —
+* it keeps compiling and silently stops matching the new state.
+*
+* A handler that deliberately does nothing with a variant still has to be
+* written out, which is the point: the author of the next variant has to decide,
+* per consumer, what it means there.
+*
+* Exported, with {@link DriftOutcome} and {@link NotComparedCause}, so
+* `tests/unit/cli/drift-outcome.test-d.ts` can fence the mapped type itself:
+* relaxing it to a `Partial` record would silently un-fence every consumer in
+* this file while changing no runtime behaviour, so no runtime test can see it.
+*/
+function matchOutcome(outcome, handlers) {
+	return handlers[outcome.kind](outcome);
+}
+/**
 * Distinguish "drift detected" (exit 1) from "command crashed" (exit 1
 * via the default handler) so the drift command can fail fast and the
 * top-level handler doesn't add a stack trace for the expected case.
@@ -64105,18 +64203,19 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
 * for nobody, which can never clear on a re-run, and which this change did not
 * create. Exiting non-zero for them would break `cdkd drift` in CI forever over
-* an unrelated defect, so the exit reads `comparisonRefused` and the report
-* reads `referencesUnresolved`. See that field's note.
+* an unrelated defect, so the exit reads the `refused` cause alone while the
+* report covers both. See `NotComparedCause` and `outcomeExitSignal`.
 *
 * WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
 * Pre-#2108 that population resolved the reference in the WRONG region, the
 * baseline could never equal what AWS held, and the resource was reported
 * `drifted` -- so `cdkd drift` exited 1 and every CI gate keyed on the exit code
 * fired. #2108 correctly stopped comparing against a foreign region's plaintext,
-* which made the same population report `clean`; without this the command would
-* exit 0 and print `no drift detected` for a stack whose secret-bearing
-* properties were never looked at. Round 1 of that change surfaced the refusal
-* in `--json` (`notCompared`) and in the human report, but the exit code -- the
+* which made the same population report `notCompared`; without this the
+* command would exit 0 and print `no drift detected` for a stack whose
+* secret-bearing properties were never looked at. Round 1 of that change
+* surfaced the refusal in `--json` (`notCompared`) and in the human report,
+* but the exit code -- the
 * signal most CI gates actually read -- still said "pass".
 *
 * WHY EXIT 2 RATHER THAN 1. `2` is this repo's established "work completed but
@@ -64153,32 +64252,56 @@ var DriftComparisonRefusedError = class DriftComparisonRefusedError extends Cdkd
 	}
 };
 /**
-* Every outcome on one report that was only PARTIALLY compared -- `drifted` or
-* `clean`, carrying `referencesUnresolved` (issue #2108).
+* Every outcome on one report that was only PARTIALLY compared -- the
+* `notCompared` variant, plus a `drifted` one whose `notComparedCause` is set
+* (issues #2108 / #2135).
+*
+* ONE spelling, because TWO renderings must agree about the same run: the
+* `--json` `notCompared` roll-up and the human report's `PARTIALLY compared`
+* block (whose count is also what the `N of M fully checked` line subtracts).
+* A roll-up spelled per reader is how the payload and the human summary come to
+* disagree.
 *
-* ONE spelling, because there are now THREE readers that must agree: the
-* `--json` `notCompared` roll-up, the human report's `PARTIALLY compared` block,
-* and the EXIT CODE. A predicate spelled per reader is how the payload and the
-* exit code come to disagree about the same run.
+* The EXIT CODE deliberately does NOT read this — see {@link outcomeExitSignal}
+* and {@link NotComparedCause} for why it is scoped to refusals alone.
 */
 function notComparedOutcomes(report) {
-	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.referencesUnresolved);
+	return report.outcomes.flatMap((o) => matchOutcome(o, {
+		drifted: (d) => d.notComparedCause === void 0 ? [] : [d],
+		notCompared: (n) => [n],
+		clean: () => [],
+		unsupported: () => [],
+		skipped: () => []
+	}));
 }
 /**
-* Every outcome whose comparison cdkd DELIBERATELY REFUSED (issue #2108) — the
-* strict subset of {@link notComparedOutcomes} that drives the EXIT CODE.
-*
-* Deliberately NOT the same predicate, and the asymmetry is the point: the
-* REPORT covers everything that was not compared, because as information both
-* populations matter equally, while the exit code covers only the population
-* this change created. Driving it off `referencesUnresolved` would exit
-* non-zero forever for every stack holding an `{{resolve:ssm-secure:...}}`
-* reference — permanent, unclearable, and unrelated to this issue. See the
-* `comparisonRefused` field note, and issue
-* [#2135](https://github.com/go-to-k/cdkd/issues/2135) for the structural fix.
-*/
-function refusedComparisonOutcomes(report) {
-	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.comparisonRefused);
+* What one outcome contributes to the run's EXIT CODE (issues #2108 / #2135).
+*
+* The exit-code CONSUMER, kept as an exhaustive `matchOutcome` so a new outcome
+* variant cannot inherit `none` by omission — reporting a resource cdkd never
+* compared as a pass is precisely the round-2 defect #2135 exists to make
+* impossible.
+*
+* `refused` is a STRICT SUBSET of what {@link notComparedOutcomes} rolls up, and
+* the asymmetry is the point: the REPORT covers everything that was not
+* compared, because as information both causes matter equally, while the exit
+* code covers only the population #2108 created. Exiting non-zero on
+* `unresolvedToken` would break `cdkd drift` in CI forever for every stack
+* holding an `{{resolve:ssm-secure:...}}` reference — permanent, unclearable,
+* and unrelated. See {@link NotComparedCause}.
+*
+* A `drifted` outcome reports `drifted` even when its own comparison was
+* refused: drift is the stronger, actionable signal and the caller ranks it
+* first, so a consumer gating on `1` loses nothing it gets today.
+*/
+function outcomeExitSignal(outcome) {
+	return matchOutcome(outcome, {
+		drifted: () => "drifted",
+		notCompared: (n) => n.notComparedCause === "refused" ? "refused" : "none",
+		clean: () => "none",
+		unsupported: () => "none",
+		skipped: () => "none"
+	});
 }
 /**
 * `cdkd drift [<stack>...]` command implementation.
@@ -64248,8 +64371,9 @@ async function driftCommand(stacks, options) {
 		}
 		if (options.json) writeJsonReport(reports);
 		else writeHumanReport(reports);
-		const drifted = reports.some((r) => r.outcomes.some((o) => o.kind === "drifted"));
-		const anyRefused = reports.some((r) => refusedComparisonOutcomes(r).length > 0);
+		const signals = reports.flatMap((r) => r.outcomes.map(outcomeExitSignal));
+		const drifted = signals.includes("drifted");
+		const anyRefused = signals.includes("refused");
 		if (!options.accept && !options.revert) {
 			if (drifted) throw new DriftDetectedError();
 			if (anyRefused) throw new DriftComparisonRefusedError();
@@ -64953,14 +65077,17 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				unionWalkObjects: useObserved,
 				unorderedPaths
 			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
-			const referencesUnresolved = secretResolutionFailed || unresolvedTokens.size > 0;
-			const comparisonRefused = secretResolutionFailed;
-			if (reported.changes.length === 0) outcomes.push({
-				kind: "clean",
+			const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+			if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
+				kind: "notCompared",
 				logicalId,
 				resourceType: resource.resourceType,
-				referencesUnresolved,
-				comparisonRefused
+				notComparedCause
+			});
+			else outcomes.push({
+				kind: "clean",
+				logicalId,
+				resourceType: resource.resourceType
 			});
 			else outcomes.push({
 				kind: "drifted",
@@ -64969,8 +65096,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				...reported,
 				awsProperties: aws,
 				secrets,
-				referencesUnresolved,
-				comparisonRefused
+				notComparedCause
 			});
 		}
 		return {
@@ -65067,7 +65193,13 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 	const lockManager = new LockManager(awsClients.s3, stateConfig);
 	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 	for (const report of reports) {
-		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
+		const driftedOutcomes = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept");
 		try {
@@ -65685,7 +65817,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	let totalSucceeded = 0;
 	let totalUnresolvable = 0;
 	for (const report of reports) {
-		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
+		const driftedOutcomes = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
@@ -65836,7 +65974,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 */
 function printAcceptPlan(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
+		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (drifted.length === 0) continue;
 		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
@@ -65859,7 +66003,13 @@ function printAcceptPlan(reports) {
 */
 function printRevertPlan(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
+		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (drifted.length === 0) continue;
 		process.stdout.write(`\nPlan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
@@ -65869,7 +66019,7 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				const cannotMaskKeys = o.referencesUnresolved;
+				const cannotMaskKeys = o.notComparedCause !== void 0;
 				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				if (!cannotMaskKeys && preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
@@ -65881,7 +66031,7 @@ function printRevertPlan(reports) {
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (o.referencesUnresolved && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.notComparedCause !== void 0 && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
@@ -65923,28 +66073,44 @@ async function confirmPrompt$5(prompt) {
 }
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
-		const drifted = r.outcomes.filter((o) => o.kind === "drifted").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType,
-			changes: o.changes,
-			referencesUnresolved: o.referencesUnresolved
-		}));
-		const clean = r.outcomes.filter((o) => o.kind === "clean").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType,
-			referencesUnresolved: o.referencesUnresolved
-		}));
+		const drifted = [];
+		const clean = [];
+		const notSupported = [];
+		const skipped = [];
+		for (const o of r.outcomes) matchOutcome(o, {
+			drifted: (d) => {
+				drifted.push({
+					logicalId: d.logicalId,
+					type: d.resourceType,
+					changes: d.changes,
+					referencesUnresolved: d.notComparedCause !== void 0
+				});
+			},
+			clean: (c) => {
+				clean.push({
+					logicalId: c.logicalId,
+					type: c.resourceType,
+					referencesUnresolved: false
+				});
+			},
+			notCompared: () => {},
+			unsupported: (u) => {
+				notSupported.push({
+					logicalId: u.logicalId,
+					type: u.resourceType
+				});
+			},
+			skipped: (sk) => {
+				skipped.push({
+					logicalId: sk.logicalId,
+					type: sk.resourceType
+				});
+			}
+		});
 		const notCompared = notComparedOutcomes(r).map((o) => ({
 			logicalId: o.logicalId,
-			type: o.resourceType
-		}));
-		const notSupported = r.outcomes.filter((o) => o.kind === "unsupported").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType
-		}));
-		const skipped = r.outcomes.filter((o) => o.kind === "skipped").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType
+			type: o.resourceType,
+			referencesUnresolved: true
 		}));
 		return {
 			stack: r.stackName,
@@ -65960,10 +66126,27 @@ function writeJsonReport(reports) {
 }
 function writeHumanReport(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
-		const unsupported = report.outcomes.filter((o) => o.kind === "unsupported");
-		const skippedCount = report.outcomes.filter((o) => o.kind === "skipped").length;
-		const inspected = report.outcomes.length - skippedCount;
+		const drifted = [];
+		const unsupported = [];
+		let inspectedCount = 0;
+		for (const o of report.outcomes) matchOutcome(o, {
+			drifted: (d) => {
+				drifted.push(d);
+				inspectedCount += 1;
+			},
+			unsupported: (u) => {
+				unsupported.push(u);
+				inspectedCount += 1;
+			},
+			skipped: () => {},
+			clean: () => {
+				inspectedCount += 1;
+			},
+			notCompared: () => {
+				inspectedCount += 1;
+			}
+		});
+		const inspected = inspectedCount;
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
 		if (drifted.length === 0) if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked (${notCompared.length} only partially compared, ${unsupported.length} unsupported)\n`);
@@ -71646,8 +71829,8 @@ async function rollbackCommand(stackArg, options) {
 		try {
 			await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
 		} catch (error) {
-			unforwardSigterm();
 			process.removeListener("SIGINT", sigintHandler);
+			unforwardSigterm();
 			throw error;
 		}
 		try {
@@ -71792,11 +71975,14 @@ async function rollbackCommand(stackArg, options) {
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${stackName}' (${region}) complete.`);
 		} finally {
-			unforwardSigterm();
-			process.removeListener("SIGINT", sigintHandler);
-			await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-				logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
-			});
+			try {
+				await setup.lockManager.releaseLock(stackName, region).catch((err) => {
+					logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
+				});
+			} finally {
+				process.removeListener("SIGINT", sigintHandler);
+				unforwardSigterm();
+			}
 		}
 	} finally {
 		if (stackAwsClients) {
@@ -72919,7 +73105,7 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 		try {
 			parsed = JSON.parse(body);
 		} catch (error) {
-			const described = describeStateKey(key);
+			const described = describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
 			const regionMatch = /^(\S+) \((\S+)\)$/.exec(described);
 			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
 		}
@@ -73124,7 +73310,7 @@ async function gcCommand(options) {
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
-		prefix: "cdkd"
+		prefix: DEFAULT_STATE_PREFIX
 	}, {
 		region: effective.region,
 		...options.profile && { profile: options.profile }
@@ -73170,7 +73356,7 @@ async function gcCommand(options) {
 		const marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
-			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX)}  [${k}]`).join("\n");
+			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
 			throw new CdkdError(`Refusing to gc while ${lockKeys.length} stack(s) hold an active lock (a deploy in flight may have published assets whose state write has not landed yet):\n${listing}\nWait for the operation(s) to finish — or clear a stale lock with 'cdkd force-unlock <stack>' — then re-run 'cdkd gc'.`, "GC_LOCKED");
 		}
 		const refs = await scanReferencedAssets(stateBackend, marker, logger);
@@ -84972,7 +85158,7 @@ async function promptConfirm(message) {
 * callers get the standard exit-code-2 routing.
 */
 function createMigrateCommand() {
-	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default("cdkd")).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
+	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default(DEFAULT_STATE_PREFIX)).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
 }
 
 //#endregion
@@ -84995,7 +85181,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.29");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.31");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;