@go-to-k/cdkd 0.284.37 → 0.284.39

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $t as buildAssetRedirectMap, A as renderStatefulReason, An as resolveStateBucketWithDefaultAndSource, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isRetryableTransientError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveCaptureObservedState, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveAutoAssetStorage, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as red, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as clearOnUpdateRemoval, Kn as resolveBucketRegion, Kt as LockManager, L as yellow, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as bold, Mn as stateBucketExistenceConfirmed, Mt as classifyReplaySecretRegion, N as cyan, Nn as warnDeprecatedNoPrefixCliFlag, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveSkipPrefix, Ot as maskSecretsInError, P as gray, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as CdkdError, Qt as WorkGraph, R as collectDeclaredOutputNames, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as synthesisStatusMessage, Sr as isMarkedNonRetryable, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as resolveApp, Tr as markNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as AssemblyReader, Ut as withRetry, V as isExportAliasCollision, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as processStackMessages, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as setAwsClients, Xt as AssetPublisher, Y as findSilentDropProperties, Yn as resetAwsClients, Yt as shouldRetainResource, Z as endCommandInterruptScope, Zt as stringifyValue, _ as computeImplicitDeleteEdges, _n as runDockerForeground, _t as replayWarn, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalMigrateError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as getDockerImageBySourceHash, br as normalizeAwsError, bt as requireConfigString, c as replayFailedOperations, cn as getBootstrapMarkerKey, cr as MissingCdkCliError, ct as refStateLookupFromResource, d as updatePartialReason, dn as validateAssetBucketName, dr as ProvisioningError, dt as resolveExplicitPhysicalId, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateContainerRepoName, fr as ResourceTimeoutError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getDockerCmd, gt as readConfigString, h as maskingRetryLogger, hn as formatDockerLoginError, hr as StackTerminationProtectionError, ht as configStringRefusal, i as DeploymentEventsReader, in as stripControlChars, ir as LocalInvokeBuildError$1, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveUseCdkBootstrapAssets, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveStateBucketWithDefault, kt as maskSecretsInText, l as replayRollback, ln as parseBootstrapMarker, lr as NestedStackChildDirectDestroyError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDockerImage, mr as StackHasActiveImportsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as disableInstanceApiTermination, o as planFailedOps, on as BOOTSTRAP_MARKER_PREFIX, or as LocalStartServiceError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as buildDenyExternalAccessPolicy, pr as ResourceUpdateNotSupportedError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as DynamicReferenceRegionAmbiguousError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as ensureAssetStorage, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as readBootstrapMarkerBody, ur as PartialFailureError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerStreaming, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getLegacyStateBucketName, wr as isThrottlingError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as Synthesizer, xr as withErrorHandling, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetManifestLoader, yt as requireConfigObject, z as collectPublishedOutputNames, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-C62UGXid.js";
+import { $ as startInterruptWatch, $n as CdkdError, $t as WorkGraph, A as renderStatefulReason, An as resolveStateBucketWithDefault, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as expectedOwnerParam, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as synthesisStatusMessage, Cr as isMarkedNonRetryable, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveAutoAssetStorage, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveApp, Er as markNonRetryable, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_BODY_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as processStackMessages, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as canonicalizeRegion, Ht as describeTypeWithThrottleRetry, I as red, In as CFN_TEMPLATE_URL_LIMIT, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as AwsClients, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kt as LockManager, L as yellow, Ln as MIGRATE_TMP_PREFIX, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveUseCdkBootstrapAssets, Mt as classifyReplaySecretRegion, N as cyan, Nn as stateBucketExistenceConfirmed, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveCaptureObservedState, Ot as maskSecretsInError, P as gray, Pn as warnDeprecatedNoPrefixCliFlag, Pt as s3BucketArn, Q as isInterruptedWaitError, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as findLargeInlineResources, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as Synthesizer, Sr as withErrorHandling, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as getLegacyStateBucketName, Tr as isThrottlingError, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as derivePartitionAndUrlSuffix, Ut as withRetry, V as isExportAliasCollision, Vn as PARTITION_TABLE, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as AssemblyReader, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as resetAwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as getAwsClients, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as setAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as getDockerCmd, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as LocalInvokeBuildError$1, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as AssetManifestLoader, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as PartialFailureError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as ProvisioningError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as formatDockerLoginError, gr as StackTerminationProtectionError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as StackHasActiveImportsError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, ir as DynamicReferenceRegionAmbiguousError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveStateBucketWithDefaultAndSource, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveSkipPrefix, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as MissingCdkCliError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ResourceUpdateNotSupportedError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as LocalMigrateError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as ResourceTimeoutError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as resolveBucketRegion, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as DeployCancelledError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalStartServiceError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CrossAccountSecretRefusalError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ur as NestedStackChildDirectDestroyError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerForeground, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getDefaultStateBucketName, wr as isRetryableTransientError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerImageBySourceHash, xr as normalizeAwsError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as runDockerStreaming, yt as requireConfigObject, z as collectPublishedOutputNames, zn as uploadCfnTemplate, zt as applyRoleArnIfSet } from "./deploy-engine-rKBFVifY.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BbWubpjP.js";
+import { t as ASGProvider } from "./asg-provider-Db6lnsaA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -77,6 +77,23 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
+//#region src/state/state-prefix.ts
+/**
+* The default S3 key prefix for cdkd state.
+*
+* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
+* (which re-exports it, so its four existing importers are unchanged) because
+* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
+* hint should spell `--state-prefix` at all, and a `src/state/**` module
+* importing from `src/cli/commands/**` inverts the layering — the CLI sits
+* ABOVE the state layer in the 7-layer architecture, not below it.
+*
+* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
+* whole-bucket listings deliberately do not scope to it.
+*/
+const DEFAULT_STATE_PREFIX = "cdkd";
+
+//#endregion
 //#region src/cli/commands/state-file-keys.ts
 /**
 * Shared helpers for enumerating and describing cdkd state-bucket keys.
@@ -94,20 +111,6 @@ import { WebSocketServer } from "ws";
 */
 const STATE_FILE_SUFFIX = "/state.json";
 /**
-* The prefix `cdkd bootstrap` writes under, and the one `gc` /
-* `bootstrap --destroy` configure their own state backend with.
-*
-* Shared here rather than spelled per command for the same reason this module
-* exists at all: `bootstrap-destroy.ts` and `gc.ts` each held their own copy,
-* and it is now also the `knownPrefix` argument to {@link describeStateKey},
-* where a copy that drifted from the backend's actual prefix would silently
-* send every key back to the shape heuristic instead of the exact depth rule.
-*
-* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
-* the whole-bucket listings deliberately do not scope to it.
-*/
-const DEFAULT_STATE_PREFIX = "cdkd";
-/**
 * Segments left under a known prefix for the legacy `{prefix}/{stack}` layout.
 *
 * The twin of `S3StateBackend`'s `LEGACY_KEY_DEPTH`, which counts the
@@ -58162,6 +58165,104 @@ var ECRProvider = class {
 	}
 };
 
+//#endregion
+//#region src/state/lock-contention-message.ts
+/**
+* The message every fail-fast lock-contention site raises.
+*
+* Issue #2161 made six commands throw on `acquireLock` returning `false`
+* instead of running under a foreign lock. Issue #2170 is the follow-up: the
+* message those sites raise asked the user to decide "is another process
+* active?" while printing none of the evidence that would answer it, and the
+* recovery command it suggested could resolve against the wrong AWS account.
+*
+* Both matter more than they look, because of WHICH locks reach this message.
+* `LockManager.acquireLock` reaps an EXPIRED foreign lock and retries, so a
+* `false` return means the lock is LIVE — in practice a running `cdkd deploy`.
+* The user who follows a bare `cdkd force-unlock <stack>` suggestion therefore
+* deletes a live owner's lock and reproduces issue #2161's harm by hand, which
+* is the outcome #2161 exists to prevent.
+*
+* Centralising the text here also settles the third finding: the nine sites
+* had drifted to three spellings (`for stack` / `for nested stack` /
+* `for nested-stack child`), so a user grepping CI logs for one of them found
+* two of three. `subject` now varies only the noun.
+*/
+/**
+* Stand-in for a value with nothing renderable left after sanitization. Named
+* rather than inlined so the message and the command-suppression branch cannot
+* disagree about what "unrenderable" looks like.
+*/
+const UNRENDERABLE = "<unrenderable>";
+/** Render `expiresIn` without implying more precision than a clock skew allows. */
+function formatRemaining(ms) {
+	if (!Number.isFinite(ms)) return "at an unknown time";
+	if (ms <= 0) return "already expired";
+	const minutes = Math.round(ms / 6e4);
+	if (minutes < 1) return "in under a minute";
+	return `in ~${minutes}m`;
+}
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* The `cdkd force-unlock ...` line, carrying every flag that decides which
+* lock object it resolves to.
+*/
+function buildForceUnlockCommand(stackName, region, recovery) {
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const stackIsExact = safeStack === stackName;
+	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
+	if (!safeStack || safeRegion === "" || !stackIsExact || !(region === void 0 || safeRegion === region)) return "";
+	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
+	if (recovery?.profile) parts.push(`--profile ${shellQuote(recovery.profile)}`);
+	if (recovery?.stateBucket) parts.push(`--state-bucket ${shellQuote(recovery.stateBucket)}`);
+	if (recovery?.statePrefix && recovery.statePrefix !== "cdkd") parts.push(`--state-prefix ${shellQuote(recovery.statePrefix)}`);
+	return parts.join(" ");
+}
+/**
+* The force-quit banner's recovery sentence.
+*
+* Exported so the two `destroy-runner.ts` banners do not each decide what to
+* say when {@link buildForceUnlockCommand} suppresses — a banner ending in a
+* bare `run: ` is the shape the review found, and two copies of the branch is
+* how the next one drifts. Returns a leading-space clause so the caller can
+* concatenate it unconditionally.
+*/
+function forceQuitRecoveryClause(stackName, region, recovery) {
+	const command = buildForceUnlockCommand(stackName, region, recovery);
+	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+}
+/**
+* Build the contention message, reading the holder's identity best-effort.
+*
+* The `getLockInfo` read is one GetObject and is deliberately NOT allowed to
+* fail the command: the caller is already on its way to throwing, and turning
+* a contention refusal into an S3 error would lose the reason. A failed or
+* absent read degrades to the evidence-free wording rather than to a crash.
+*/
+async function buildLockContentionMessage(args) {
+	const { lockManager, stackName, region, subject = "stack", recovery, heldClause, suffix } = args;
+	let held = heldClause ?? "another cdkd process holds it";
+	let sawHolder = false;
+	try {
+		const info = await lockManager.getLockInfo(stackName, region);
+		if (info) {
+			const operation = info.operation ? `, operation: ${displaySafe(info.operation)}` : "";
+			const expires = formatRemaining(info.expiresAt - Date.now());
+			const owner = displaySafe(info.owner);
+			const holder = owner ? `held by ${owner}${operation}` : `held by an unnamed holder`;
+			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, expires ${expires}`;
+			if (owner) sawHolder = true;
+		}
+	} catch {}
+	const advice = sawHolder ? `That process is still running — wait for it to finish. Only if you are certain it is gone` : `Wait for it to finish, or if you are certain no other process is active`;
+	const recoveryCommand = buildForceUnlockCommand(stackName, region, recovery);
+	const head = `Could not acquire lock for ${subject} '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) — ${held}.` + (suffix ? ` ${suffix}` : "");
+	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: the name or region recorded for this lock contains characters that cannot be reproduced safely on a command line, so any command shown here would address a different lock — inspect the lock object directly.`;
+	return `${head} ${advice}, run: ${recoveryCommand}`;
+}
+
 //#endregion
 //#region src/cli/commands/destroy-runner.ts
 /**
@@ -58298,9 +58399,64 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const regionForState = state.region ?? ctx.baseRegion;
 	if (resourceCount === 0) {
 		logger.info(`Stack ${stackName} has no resources, cleaning up state...`);
-		await ctx.stateBackend.deleteState(stackName, regionForState);
-		logger.info(`${green("✓")} State deleted`);
+		let emptyLockHeld = false;
+		let emptyInterrupted = false;
+		const emptySigintHandler = () => {
+			if (emptyInterrupted) {
+				if (emptyLockHeld) {
+					ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
+					process.stderr.write(`\nForce-quit: stack lock may not be released.${forceQuitRecoveryClause(stackName, regionForState, {
+						profile: ctx.profile,
+						stateBucket: ctx.stateBucket,
+						statePrefix: ctx.statePrefix
+					})}\n`);
+				}
+				process.exit(130);
+			}
+			emptyInterrupted = true;
+			try {
+				process.stderr.write(`\nInterrupt received - finishing the state cleanup for ${stackName} (press Ctrl-C again to force-quit)\n`);
+			} catch {}
+		};
+		process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
+		process.on("SIGINT", emptySigintHandler);
+		let emptyAcquired;
+		try {
+			emptyAcquired = await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+		} catch (acquireErr) {
+			process.removeListener("SIGINT", emptySigintHandler);
+			throw acquireErr;
+		}
+		if (!emptyAcquired) {
+			process.removeListener("SIGINT", emptySigintHandler);
+			throw new Error(await buildLockContentionMessage({
+				lockManager: ctx.lockManager,
+				stackName,
+				region: regionForState,
+				recovery: {
+					profile: ctx.profile,
+					stateBucket: ctx.stateBucket,
+					statePrefix: ctx.statePrefix
+				}
+			}));
+		}
+		emptyLockHeld = true;
+		try {
+			const recheck = await ctx.stateBackend.getState(stackName, regionForState);
+			if (!(!recheck || Object.keys(recheck.state.resources).length === 0)) throw new Error(`Stack '${stackName}' (${regionForState}) was empty when this run started but now has ${Object.keys(recheck.state.resources).length} resource(s) — another cdkd process deployed into it. Re-run the destroy to act on the current state.`);
+			await ctx.stateBackend.deleteState(stackName, regionForState);
+			logger.info(`${green("✓")} State deleted`);
+		} finally {
+			try {
+				await ctx.lockManager.releaseLock(stackName, regionForState);
+			} catch (releaseErr) {
+				logger.warn(`Failed to release lock after empty-state cleanup: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+			} finally {
+				process.removeListener("SIGINT", emptySigintHandler);
+			}
+		}
 		result.skippedEmpty = true;
+		result.interrupted ||= emptyInterrupted;
 		return result;
 	}
 	const needsStrongRefCheck = !!(state.outputs && Object.keys(state.outputs).length > 0);
@@ -58335,19 +58491,40 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stackRegion = state.region;
 	let destroyProviderRegistry = ctx.providerRegistry;
 	let destroyAwsClients;
+	let regionSwitched = false;
+	const restoreBaseRegionAndClients = () => {
+		if (!regionSwitched) return;
+		regionSwitched = false;
+		const switchedClients = destroyAwsClients;
+		destroyAwsClients = void 0;
+		process.env["AWS_REGION"] = ctx.baseRegion;
+		process.env["AWS_DEFAULT_REGION"] = ctx.baseRegion;
+		setAwsClients(ctx.baseAwsClients);
+		try {
+			switchedClients?.destroy();
+		} catch (destroyError) {
+			logger.debug(`Failed to destroy region-scoped AWS clients: ${destroyError instanceof Error ? destroyError.message : String(destroyError)}`);
+		}
+	};
 	if (stackRegion && stackRegion !== ctx.baseRegion) {
 		logger.info(`Stack region: ${stackRegion}`);
 		process.env["AWS_REGION"] = stackRegion;
 		process.env["AWS_DEFAULT_REGION"] = stackRegion;
-		destroyAwsClients = new AwsClients({
-			region: stackRegion,
-			...ctx.profile && { profile: ctx.profile }
-		});
-		setAwsClients(destroyAwsClients);
-		destroyProviderRegistry = new ProviderRegistry();
-		registerAllProviders(destroyProviderRegistry);
-		destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
-		if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
+		regionSwitched = true;
+		try {
+			destroyAwsClients = new AwsClients({
+				region: stackRegion,
+				...ctx.profile && { profile: ctx.profile }
+			});
+			setAwsClients(destroyAwsClients);
+			destroyProviderRegistry = new ProviderRegistry();
+			registerAllProviders(destroyProviderRegistry);
+			destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
+			if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
+		} catch (setupError) {
+			restoreBaseRegionAndClients();
+			throw setupError;
+		}
 	}
 	const renderer = getLiveRenderer();
 	let draining = false;
@@ -58356,7 +58533,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 		if (draining) {
 			if (lockHeld) {
 				ctx.lockManager.releaseLock(stackName, regionForState).catch(() => {});
-				process.stderr.write(`\nForce-quit: stack lock may not be released. If the next run reports a lock, run: cdkd force-unlock ${stackName}\n`);
+				process.stderr.write(`\nForce-quit: stack lock may not be released.${forceQuitRecoveryClause(stackName, regionForState, {
+					profile: ctx.profile,
+					stateBucket: ctx.stateBucket,
+					statePrefix: ctx.statePrefix
+				})}\n`);
 			}
 			process.exit(130);
 		}
@@ -58367,10 +58548,20 @@ async function runDestroyForStack(stackName, state, ctx) {
 	};
 	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
 	process.on("SIGINT", sigintHandler);
-	logger.info(`\nAcquiring lock for stack ${stackName}...`);
 	try {
-		await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+		logger.info(`\nAcquiring lock for stack ${stackName}...`);
+		if (!await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy")) throw new Error(await buildLockContentionMessage({
+			lockManager: ctx.lockManager,
+			stackName,
+			region: regionForState,
+			recovery: {
+				profile: ctx.profile,
+				stateBucket: ctx.stateBucket,
+				statePrefix: ctx.statePrefix
+			}
+		}));
 	} catch (error) {
+		restoreBaseRegionAndClients();
 		process.removeListener("SIGINT", sigintHandler);
 		throw error;
 	}
@@ -58382,6 +58573,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			} catch (releaseErr) {
 				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
 			}
+			restoreBaseRegionAndClients();
 			process.removeListener("SIGINT", sigintHandler);
 		};
 		let consumers;
@@ -58422,8 +58614,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 		});
 	};
-	renderer.start();
 	try {
+		renderer.start();
 		logger.info("Building dependency graph...");
 		const template = {
 			AWSTemplateFormatVersion: "2010-09-09",
@@ -58693,14 +58885,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 			await ctx.lockManager.releaseLock(stackName, regionForState);
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
+			restoreBaseRegionAndClients();
 		}
 		result.interrupted ||= draining;
-		if (destroyAwsClients) {
-			destroyAwsClients.destroy();
-			process.env["AWS_REGION"] = ctx.baseRegion;
-			process.env["AWS_DEFAULT_REGION"] = ctx.baseRegion;
-			setAwsClients(ctx.baseAwsClients);
-		}
 	}
 	return result;
 }
@@ -58966,6 +59153,7 @@ var NestedStackProvider = class {
 			skipConfirmation: true,
 			...ctx.exportIndexStore && { exportIndexStore: ctx.exportIndexStore },
 			...ctx.destroyOptions?.profile && { profile: ctx.destroyOptions.profile },
+			...ctx.destroyOptions?.statePrefix !== void 0 && { statePrefix: ctx.destroyOptions.statePrefix },
 			...deleteContext?.removeProtection === true && { removeProtection: true },
 			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
@@ -59887,7 +60075,7 @@ async function deployCommand(stacks, options) {
 	let deployInterrupted = false;
 	const topLevelSigintHandler = () => {
 		if (deployInterrupted) {
-			process.stderr.write("\nForce-quit: stack locks may not be released. If the next run reports a lock, run: cdkd force-unlock <stackName>\n");
+			process.stderr.write("\nForce-quit: stack locks may not be released. If the next run reports a lock, run this for EACH stack it names (the region-qualified form — see the message that run prints): cdkd force-unlock <stackName> --stack-region <region>\n");
 			process.exit(130);
 		}
 		process.stderr.write("\nInterrupted — waiting for in-progress operations to complete...\n");
@@ -60154,6 +60342,10 @@ async function deployCommand(stacks, options) {
 					dagBuilder,
 					diffCalculator,
 					options: deployEngineOptions,
+					destroyOptions: {
+						statePrefix: options.statePrefix,
+						...options.profile && { profile: options.profile }
+					},
 					...assetRedirect && { assetRedirect }
 				}, () => stackDeployEngine.deploy(stackInfo.stackName, stackInfo.template));
 				logger.info(`\n${bold("Deployment Summary:")}`);
@@ -66124,6 +66316,11 @@ function setAtPath(target, path, value) {
 */
 async function runAccept(reports, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
+	const lockRecovery = {
+		profile: options.profile,
+		stateBucket: stateConfig.bucket,
+		statePrefix: stateConfig.prefix
+	};
 	printAcceptPlan(reports);
 	if (options.dryRun) {
 		logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
@@ -66146,7 +66343,12 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			skipped: () => []
 		}));
 		if (driftedOutcomes.length === 0) continue;
-		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept");
+		if (!await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept")) throw new Error(await buildLockContentionMessage({
+			lockManager,
+			stackName: report.stackName,
+			region: report.region,
+			recovery: lockRecovery
+		}));
 		try {
 			const resources = { ...report.state.resources };
 			for (const outcome of driftedOutcomes) {
@@ -66743,6 +66945,11 @@ function deepEqualUnordered(a, b) {
 */
 async function runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
+	const lockRecovery = {
+		profile: options.profile,
+		stateBucket: stateConfig.bucket,
+		statePrefix: stateConfig.prefix
+	};
 	printRevertPlan(reports);
 	if (options.dryRun) {
 		logger.info("--dry-run: AWS will NOT be modified. Re-run without --dry-run to apply.");
@@ -66770,11 +66977,16 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 			skipped: () => []
 		}));
 		if (driftedOutcomes.length === 0) continue;
-		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
+		if (!await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert")) throw new Error(await buildLockContentionMessage({
+			lockManager,
+			stackName: report.stackName,
+			region: report.region,
+			recovery: lockRecovery
+		}));
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
-		const revertSecretResolvers = new DriftSecretResolvers(report.region);
-		const revertProducerRegions = producerRegionsFromState(report.state);
 		try {
+			const revertSecretResolvers = new DriftSecretResolvers(report.region);
+			const revertProducerRegions = producerRegionsFromState(report.state);
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
 				if (!stateResource) {
@@ -67397,6 +67609,7 @@ async function destroyCommand(stackArgs, options) {
 					exportIndexStore,
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
+						statePrefix: options.statePrefix,
 						...options.removeProtection === true && { removeProtection: true },
 						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -67412,6 +67625,7 @@ async function destroyCommand(stackArgs, options) {
 					baseRegion: region,
 					...options.profile && { profile: options.profile },
 					stateBucket,
+					statePrefix: options.statePrefix,
 					skipConfirmation: options.yes || options.force,
 					removeProtection: options.removeProtection === true,
 					skipFinalSnapshot: options.skipFinalSnapshot === true,
@@ -68985,6 +69199,11 @@ async function exportCommand(stackArg, options) {
 			bucket: stateBucket,
 			prefix: options.statePrefix
 		};
+		const lockRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile }
@@ -69060,7 +69279,12 @@ async function exportCommand(stackArg, options) {
 		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
-			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName}' if you are certain no other process is active.`);
+			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(await buildLockContentionMessage({
+				lockManager,
+				stackName: resolvedStackName,
+				region: targetRegion,
+				recovery: lockRecovery
+			}));
 		}
 		try {
 			if (nestedStackRows.length > 0) {
@@ -69080,6 +69304,7 @@ async function exportCommand(stackArg, options) {
 				if (missingNested.length > 0) throw new Error(`Template requires parameter(s) without defaults: ${missingNested.join(", ")}. Pass each one as --parameter Key=Value (or set a Default in the CDK code).`);
 				const childOverrides = parseCfnChildStackNameOverrides(options.cfnChildStackName);
 				if ((await runPerStackImportLoop({
+					lockRecovery,
 					rootStackName: resolvedStackName,
 					rootRegion: targetRegion,
 					rootStackInfoNestedTemplates: rootNestedTemplatePaths,
@@ -70976,7 +71201,15 @@ async function runPerStackImportLoop(args) {
 			try {
 				await deps.lockManager.acquireLockWithRetry(node.stackName, node.region, deps.lockOwner, "export", CHILD_LOCK_RETRY_MAX_ATTEMPTS, CHILD_LOCK_RETRY_DELAY_MS);
 			} catch (err) {
-				throw new Error(`Could not acquire lock for nested-stack child '${node.stackName}' (${node.region}) — another cdkd process held it through the retry window. Wait for it to finish, or run 'cdkd force-unlock ${node.stackName}' if you are certain no other process is active. No CloudFormation changeset has been submitted; cdkd state is unchanged.`, { cause: err instanceof Error ? err : void 0 });
+				throw new Error(await buildLockContentionMessage({
+					lockManager: deps.lockManager,
+					stackName: node.stackName,
+					region: node.region,
+					subject: "nested-stack child",
+					heldClause: "another cdkd process held it through the retry window",
+					recovery: args.lockRecovery,
+					suffix: "No CloudFormation changeset has been submitted; cdkd state is unchanged."
+				}), { cause: err instanceof Error ? err : void 0 });
 			}
 			acquiredChildLocks.push({
 				stackName: node.stackName,
@@ -71912,8 +72145,12 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.force) {
 				for (const target of targets) if (await setup.lockManager.isLocked(stackName, target.region)) {
-					const where = target.region ?? "(legacy)";
-					throw new Error(`Stack '${stackName}' (${where}) is locked. Run 'cdkd force-unlock ${stackName}${target.region ? ` --stack-region ${target.region}` : ""}' first, or pass --force to remove anyway.`);
+					const where = target.region ? displaySafe(target.region, { asciiOnly: true }) || "<unrenderable>" : "(legacy)";
+					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. Run: ${buildForceUnlockCommand(stackName, target.region, {
+						profile: options.profile,
+						stateBucket: setup.bucket,
+						statePrefix: options.statePrefix
+					}) || "a command cdkd cannot show safely: the recorded name or region would not survive a command line intact, so inspect the lock object directly"} first, or pass --force to remove anyway.`);
 				}
 			}
 			if (!options.yes && !options.force) {
@@ -71933,9 +72170,13 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			for (const target of targets) {
 				if (target.region) {
+					await warnOnLiveForeignLock(setup.lockManager, stackName, target.region, logger);
 					await setup.stateBackend.deleteState(stackName, target.region);
 					await setup.lockManager.forceReleaseLock(stackName, target.region);
-				} else await setup.lockManager.forceReleaseLock(stackName, void 0);
+				} else {
+					await warnOnLiveForeignLock(setup.lockManager, stackName, void 0, logger);
+					await setup.lockManager.forceReleaseLock(stackName, void 0);
+				}
 				logger.info(`✓ Removed state for stack: ${formatStackRef(target)}`);
 			}
 		}
@@ -72067,6 +72308,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					exportIndexStore: setup.exportIndexStore,
 					destroyOptions: {
 						...options.profile && { profile: options.profile },
+						statePrefix: options.statePrefix,
 						...options.removeProtection === true && { removeProtection: true },
 						...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -72082,6 +72324,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					baseRegion: setup.region,
 					...options.profile && { profile: options.profile },
 					stateBucket: setup.bucket,
+					statePrefix: options.statePrefix,
 					skipConfirmation: options.yes || options.all === true,
 					removeProtection: options.removeProtection === true,
 					skipFinalSnapshot: options.skipFinalSnapshot === true,
@@ -72443,7 +72686,12 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			if (!target.region) throw new Error(`Stack '${target.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${target.stackName}' (or any cdkd write) first to migrate it to the region-scoped layout, then re-run refresh-observed.`);
 			const counts = await refreshObservedForStack(target.stackName, target.region, setup.stateBackend, setup.lockManager, providerRegistry, {
 				dryRun: options.dryRun ?? false,
-				logger
+				logger,
+				lockRecovery: {
+					profile: options.profile,
+					stateBucket: setup.bucket,
+					statePrefix: options.statePrefix
+				}
 			});
 			totalRefreshed += counts.refreshed;
 			totalUnsupported += counts.unsupported;
@@ -72470,6 +72718,34 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 */
 const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 /**
+* Warn before `cdkd state orphan` force-releases a lock that is still LIVE.
+*
+* `forceReleaseLock` is unconditional by design — a stuck lock must never make
+* a state record unremovable — but it deletes an in-flight `cdkd deploy`'s lock
+* just as readily as a stale one, and it did so silently (issue #2171). The
+* write it enables has already happened by the time anyone notices, so the
+* only useful thing is to name the owner at the moment of the release.
+*
+* Best-effort in both directions: an expired lock is not worth a line, and a
+* failed read must not block the removal the user asked for.
+*
+* (Issue #2171's own text called this command `cdkd state rm`; no such command
+* exists -- this file registers it as `orphan`.)
+*/
+async function warnOnLiveForeignLock(lockManager, stackName, region, logger) {
+	try {
+		const info = await lockManager.getLockInfo(stackName, region);
+		if (!info) return;
+		const expiryKnown = Number.isFinite(info.expiresAt);
+		if (expiryKnown && info.expiresAt <= Date.now()) return;
+		const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+		const where = region ? `${safeStack} (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"})` : `${safeStack} (legacy lock key)`;
+		const owner = info.owner;
+		const operation = info.operation ? `, operation: ${info.operation}` : "";
+		logger.warn(`Force-releasing a LIVE lock on ${where} ${owner ? `held by ${owner}${operation}` : "held by an unnamed holder"}. ` + (owner && expiryKnown ? `That process is still running and will keep writing; its next state write ` : expiryKnown ? `The lock has not expired, so a process may still be writing; its next state write ` : `The lock records no readable expiry, so a process may still be writing; its next state write `) + `may recreate the record being removed here.`);
+	} catch {}
+}
+/**
 * Refresh the `observedProperties` of every resource in one stack
 * record. Returns counts so the caller can aggregate across `--all`.
 *
@@ -72479,7 +72755,7 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 * for the underlying SDK reads.
 */
 async function refreshObservedForStack(stackName, region, stateBackend, lockManager, providerRegistry, opts) {
-	const { logger } = opts;
+	const { logger, lockRecovery } = opts;
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	const { state, etag, migrationPending } = result;
@@ -72517,7 +72793,12 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		};
 	}
 	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-	await lockManager.acquireLock(stackName, region, owner, "state-refresh-observed");
+	if (!await lockManager.acquireLock(stackName, region, owner, "state-refresh-observed")) throw new Error(await buildLockContentionMessage({
+		lockManager,
+		stackName,
+		region,
+		recovery: lockRecovery
+	}));
 	try {
 		let refreshed = 0;
 		let unsupported = 0;
@@ -72860,7 +73141,10 @@ async function rollbackCommand(stackArg, options) {
 						awsClients: setup.awsClients,
 						stateBucket: setup.bucket,
 						exportIndexStore: setup.exportIndexStore,
-						destroyOptions: { ...options.profile && { profile: options.profile } }
+						destroyOptions: {
+							...options.profile && { profile: options.profile },
+							statePrefix: options.statePrefix
+						}
 					}, () => withStackName(stackName, async () => {
 						let failedOpFailures = 0;
 						let failedOpWarnings = 0;
@@ -74896,7 +75180,18 @@ async function orphanCommand(pathArgs, options) {
 		const targetRegion = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
 		logger.info(`Target: ${stackInfo.stackName} (${targetRegion}); orphaning ${orphanLogicalIds.length} resource(s): ${orphanLogicalIds.join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-		if (!options.dryRun) await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "orphan");
+		if (!options.dryRun) {
+			if (!await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "orphan")) throw new Error(await buildLockContentionMessage({
+				lockManager,
+				stackName: stackInfo.stackName,
+				region: targetRegion,
+				recovery: {
+					profile: options.profile,
+					stateBucket,
+					statePrefix: options.statePrefix
+				}
+			}));
+		}
 		try {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
@@ -75381,6 +75676,11 @@ async function importCommand(stackArg, options) {
 			bucket: stateBucket,
 			prefix: options.statePrefix
 		};
+		const lockRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile }
@@ -75481,7 +75781,16 @@ async function importCommand(stackArg, options) {
 		}
 		for (const overrideId of overrides.keys()) if (!templateLogicalIds.has(overrideId)) throw new Error(`--resource / --resource-mapping references logical ID '${overrideId}' which is not in the synthesized template for stack '${stackInfo.stackName}'. Available IDs: ${[...templateLogicalIds].join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-		await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "import");
+		if (!await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "import")) throw new Error(await buildLockContentionMessage({
+			lockManager,
+			stackName: stackInfo.stackName,
+			region: targetRegion,
+			recovery: {
+				profile: options.profile,
+				stateBucket,
+				statePrefix: options.statePrefix
+			}
+		}));
 		try {
 			const rows = [];
 			for (const { logicalId, resource } of resources) {
@@ -75545,6 +75854,7 @@ async function importCommand(stackArg, options) {
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
 			logger.info(`  ${importedRows.length} resource(s) imported. Run 'cdkd diff' to see how the imported state lines up with the template.`);
 			if (migrationCfnStackName && migrationTree && accountIdForNestedSynth) await importNestedStackChildrenRecursive({
+				lockRecovery,
 				parentStackName: stackInfo.stackName,
 				parentRegion: targetRegion,
 				parentNestedTemplates: stackInfo.nestedTemplates ?? {},
@@ -76210,7 +76520,13 @@ async function importNestedStackChildrenRecursive(args) {
 			const childRewritten = rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 			if (childRewritten > 0) logger.info(`Note: ${childRewritten} asset reference(s) in nested stack ${childStackName} are recorded in state at their pre-rewrite (CDK bootstrap) values, so the next 'cdkd deploy' repoints any resource that still holds them to cdkd asset storage.`);
 		}
-		await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import");
+		if (!await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import")) throw new Error(await buildLockContentionMessage({
+			lockManager,
+			stackName: childStackName,
+			region: childRegion,
+			subject: "nested stack",
+			recovery: args.lockRecovery
+		}));
 		try {
 			const childResources = collectImportableResources(childTemplate);
 			const childTemplateLogicalIds = new Set(childResources.map((r) => r.logicalId));
@@ -76252,6 +76568,7 @@ async function importNestedStackChildrenRecursive(args) {
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
+				lockRecovery: args.lockRecovery,
 				parentStackName: childStackName,
 				parentRegion: childRegion,
 				parentNestedTemplates: indexGrandchildTemplatePaths(childTemplate, childTemplatePath),
@@ -86125,7 +86442,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.37");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.39");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;