@go-to-k/cdkd 0.284.53 → 0.284.55

package/dist/{program-9yMSf-LQ.js → program-CTreQYc-.js}

@@ -1,7 +1,7 @@
-import { $ as startInterruptWatch, $n as AwsClients, $t as shouldRetainResource, A as renderStatefulReason, An as getLegacyStateBucketName, Ar as isThrottlingError, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as CFN_TEMPLATE_BODY_LIMIT, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as runDockerForeground, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as Synthesizer, Dr as withErrorHandling, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDockerImageBySourceHash, Er as normalizeAwsError, Et as errorCauseChain, F as green, Fn as resolveStateBucketWithDefault, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as expectedOwnerParam, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as MIGRATE_TMP_PREFIX, Ht as describeTypeWithThrottleRetry, I as red, In as resolveStateBucketWithDefaultAndSource, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as derivePartitionAndUrlSuffix, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as PARTITION_TABLE, Kt as LockManager, L as yellow, Ln as resolveUseCdkBootstrapAssets, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveAutoAssetStorage, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveCaptureObservedState, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as synthesisStatusMessage, Or as isMarkedNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveSkipPrefix, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resolveBucketRegion, Qt as importableOutputs, R as collectDeclaredOutputNames, Rn as stateBucketExistenceConfirmed, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as partitionSensitiveEnv, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as AssetManifestLoader, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as findLargeInlineResources, Ut as withRetry, V as isExportAliasCollision, Vn as CFN_TEMPLATE_URL_LIMIT, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as uploadCfnTemplate, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as processStackMessages, Xt as exportNamesCarriedFrom, Y as findSilentDropProperties, Yn as AssemblyReader, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zt as importableOutputKeys, _ as computeImplicitDeleteEdges, _n as buildDenyExternalAccessPolicy, _r as ProvisioningError, _t as replayWarn, a as DeploymentEventsStore, an as loadPublishableAssetManifest, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as formatDockerLoginError, br as StackHasActiveImportsError, bt as requireConfigString, c as replayFailedOperations, cn as stripControlChars, cr as DeployCancelledError, ct as refStateLookupFromResource, d as updatePartialReason, dn as ensureAssetStorage, dr as LocalMigrateError, dt as resolveExplicitPhysicalId, en as AssetPublisher, er as getAwsClients, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as getBootstrapMarkerKey, fr as LocalStartServiceError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as validateContainerRepoName, gr as PartialFailureError, gt as readConfigString, h as maskingRetryLogger, hn as validateAssetBucketName, hr as NestedStackChildDirectDestroyError, ht as configStringRefusal, i as DeploymentEventsReader, in as createAssetRedirectResolver, ir as CdkdError, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveApp, jr as markNonRetryable, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as getDefaultStateBucketName, kr as isRetryableTransientError, kt as maskSecretsInText, l as replayRollback, ln as AssetModeResolver, lr as DynamicReferenceRegionAmbiguousError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as readBootstrapMarkerBody, mr as MissingCdkCliError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as WorkGraph, nr as setAwsClients, nt as disableInstanceApiTermination, o as planFailedOps, on as rewriteTemplateAssetReferences, or as CrossAccountSecretRefusalError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as parseBootstrapMarker, pt as coerceCfnBoolean, q as ProviderRegistry, qn as canonicalizeRegion, qt as displaySafe, r as DeployEngine, rn as buildAssetRedirectMap, rt as isTerminationProtectionPropagationError, s as planRollback, sn as escapeRegExp, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stringifyValue, tr as resetAwsClients, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as BOOTSTRAP_MARKER_PREFIX, ur as LocalInvokeBuildError$1, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as buildDockerImage, vr as ResourceTimeoutError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as runDockerStreaming, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as getDockerCmd, xr as StackTerminationProtectionError, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as dockerSpawnEnvWithSensitive, yr as ResourceUpdateNotSupportedError, yt as requireConfigObject, z as collectPublishedOutputNames, zn as warnDeprecatedNoPrefixCliFlag, zt as applyRoleArnIfSet } from "./deploy-engine-DOP4V6eK.js";
+import { $ as endCommandInterruptScope, $n as processStackMessages, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as Synthesizer, Ar as withErrorHandling, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveUseCdkBootstrapAssets, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as formatDockerLoginError, Cr as StackHasActiveImportsError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as runDockerStreaming, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as runDockerForeground, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as resolveAutoAssetStorage, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as MIGRATE_TMP_PREFIX, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as warnDeprecatedNoPrefixCliFlag, Ht as applyRoleArnIfSet, I as red, In as resolveCaptureObservedState, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as expectedOwnerParam, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as findLargeInlineResources, Kt as withRetry, L as yellow, Ln as resolveSkipPrefix, Lt as s3BucketArn, M as bold, Mn as getDefaultStateBucketName, Mr as isRetryableTransientError, Mt as maskSecretsInText, N as cyan, Nn as getLegacyStateBucketName, Nr as isThrottlingError, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as AssetManifestLoader, Ot as dynamicReferenceTokens, P as gray, Pn as resolveApp, Pr as markNonRetryable, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as AssemblyReader, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefault, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as dockerSpawnEnvWithSensitive, Sr as ResourceUpdateNotSupportedError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as partitionSensitiveEnv, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_BODY_LIMIT, Ut as DiffCalculator, V as isExportAliasCollision, Vn as stateBucketExistenceConfirmed, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as CFN_TEMPLATE_URL_LIMIT, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as canonicalizeRegion, Xt as displaySafe, Y as findSilentDropProperties, Yn as PARTITION_TABLE, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as derivePartitionAndUrlSuffix, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as readBootstrapMarkerBody, _r as MissingCdkCliError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as setAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as buildDenyExternalAccessPolicy, br as ProvisioningError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as DeployCancelledError, dt as refStateLookupFromResource, en as importableOutputKeys, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, fr as DynamicReferenceRegionAmbiguousError, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as parseBootstrapMarker, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as getBootstrapMarkerKey, hr as LocalStartServiceError, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as resetAwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as synthesisStatusMessage, jr as isMarkedNonRetryable, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as getDockerImageBySourceHash, kr as normalizeAwsError, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CrossAccountSecretRefusalError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as ensureAssetStorage, mr as LocalMigrateError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nr as AwsClients, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as LocalInvokeBuildError$1, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as uploadCfnTemplate, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as CdkdError, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as resolveBucketRegion, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateAssetBucketName, vr as NestedStackChildDirectDestroyError, vt as configStringRefusal, w as refusesFinalSnapshot, wn as getDockerCmd, wr as StackTerminationProtectionError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as buildDockerImage, xr as ResourceTimeoutError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as validateContainerRepoName, yr as PartialFailureError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveStateBucketWithDefaultAndSource, zt as s3BucketDualStackDomainName } from "./deploy-engine-B1tSPv8F.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-CaIqvSUG.js";
-import { t as ASGProvider } from "./asg-provider-Ciurx_UV.js";
+import { t as getCdkdVersion } from "./version-DD5yHFTJ.js";
+import { t as ASGProvider } from "./asg-provider-nddX-RVm.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -77,23 +77,6 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
-//#region src/state/state-prefix.ts
-/**
-* The default S3 key prefix for cdkd state.
-*
-* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
-* (which re-exports it, so its four existing importers are unchanged) because
-* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
-* hint should spell `--state-prefix` at all, and a `src/state/**` module
-* importing from `src/cli/commands/**` inverts the layering — the CLI sits
-* ABOVE the state layer in the 7-layer architecture, not below it.
-*
-* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
-* whole-bucket listings deliberately do not scope to it.
-*/
-const DEFAULT_STATE_PREFIX = "cdkd";
-
-//#endregion
 //#region src/cli/commands/state-file-keys.ts
 /**
 * Shared helpers for enumerating and describing cdkd state-bucket keys.
@@ -2072,6 +2055,15 @@ function createListCommand() {
 */
 function forwardSigtermToSigint() {
 	beginCommandInterruptScope();
+	try {
+		return installSigtermForwarder();
+	} catch (error) {
+		endCommandInterruptScope();
+		throw error;
+	}
+}
+/** The registration half of {@link forwardSigtermToSigint}, after its scope is open. */
+function installSigtermForwarder() {
 	const handler = () => {
 		if (process.listenerCount("SIGINT") === 0) process.exit(143);
 		process.emit("SIGINT", "SIGINT");
@@ -2082,6 +2074,117 @@ function forwardSigtermToSigint() {
 		endCommandInterruptScope();
 	};
 }
+/**
+* Register a command-scoped SIGINT handler for the destroy commands
+* (issue #2117).
+*
+* `cdkd deploy` has had one of these since issue #1348 (`deploy.ts`'s
+* `topLevelSigintHandler`). The destroy side had none, so the ONLY channel
+* carrying "the user interrupted" from `runDestroyForStack` back to the
+* `--all` loop was `DestroyRunResult.interrupted` — a boolean assigned ONCE,
+* inside the runner's `try`, after its level loop. Every instant where the
+* runner's `draining` flag flips AFTER that assignment is an instant where
+* `cdkd destroy --all` went on to delete the NEXT stack after the user asked
+* it to stop.
+*
+* The runner's outer `finally` re-syncs `result.interrupted ||= draining` to
+* cover the widest such window (renderer teardown, state flush, lock release),
+* and that line is marked TACTICAL in its own comment: it narrows the window
+* rather than removing it. Two gaps survive it, and neither is reachable from
+* inside the runner at all:
+*
+* 1. The runner removes its SIGINT listener in its inner `finally`, BEFORE the
+*    re-sync line and its `return`, so from there on nothing of the runner's is
+*    armed. This watch covers that stretch — by RECORDING once a graceful owner
+*    is gone and the stack is done, and by QUITTING in the mirror-image window
+*    at the START of a stack, where the runner has not armed yet and could not
+*    act on a recorded flag (see `gracefulOwnerArmed` below).
+* 2. Everything the `--all` loop itself does between two stacks — the
+*    `RUN_FINISHED` event, `eventRecorder.finalize`, `purgeEventsAfterDestroy`
+*    — runs with no runner handler armed at all.
+*
+* A handler that lives for the whole command closes both, because it is armed
+* in every window rather than in the ones the runner happens to span. The two
+* flags answer different questions and both are kept: `result.interrupted` is
+* the PER-STACK outcome (it decides that stack's state preservation, its
+* summary line and its `--purge-events` skip), while this one is the
+* COMMAND-level "stop" the loop wants.
+*
+* Note on the counterpart contract: `deploy-engine.ts` removes its own SIGINT
+* handler before releasing its lock, which is safe only because `deploy.ts`'s
+* top-level handler outlives it. The destroy side now has the same property
+* for the same reason — `destroy-runner.ts`'s `process.removeListener('SIGINT',
+* sigintHandler)` is no longer the last handler standing, because this one is
+* disposed only in the command's outermost `finally`.
+*
+* @param opts.command the user-facing command name used in the force-quit
+*   notice (`cdkd destroy` / `cdkd state destroy`).
+*/
+function watchCommandInterrupt(opts) {
+	let interrupted = false;
+	let stacksInFlight = 0;
+	/**
+	* Is some OTHER listener going to handle this signal gracefully?
+	*
+	* Being inside `runStack` is NOT the same question, and assuming it was is a
+	* regression this fix already shipped once: `runDestroyForStack` registers
+	* its own handler about two hundred lines in, AFTER the strong-reference
+	* pre-flight scan (an S3 LIST plus a GET per stack) and the per-stack
+	* confirm prompt. Staying silent across that window swallowed the signal
+	* outright — no notice, no exit, no escalation on a repeat — and because
+	* this watch IS a listener, `interrupt-watch.ts`'s last-listener force-quit
+	* could no longer fire there either. The runner then began with `draining`
+	* false and destroyed the whole stack the user had just asked to stop, which
+	* is issue #2117's own defect one window further in.
+	*
+	* Counting listeners answers the real question, and the two exclusions are
+	* what make the count mean "graceful owner":
+	*
+	*  - our own handler, which is not an answer to itself;
+	*  - `interrupt-watch.ts`'s shared handler, which is a LATCH rather than a
+	*    graceful owner — deferring to it is exactly the swallow above.
+	*
+	* A provider's transient wait listener (CustomResource / ACM / CloudFront /
+	* Route53) does count, and that is correct rather than a false positive:
+	* those exist only DURING a provider wait, which is strictly inside the
+	* runner handler's own lifetime, so one cannot be present while the runner's
+	* is absent.
+	*/
+	function gracefulOwnerArmed() {
+		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
+	}
+	const handler = () => {
+		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
+			interrupted = true;
+			return;
+		}
+		if (interrupted) {
+			process.stderr.write("\nForce-quit.\n");
+			process.exit(130);
+		}
+		interrupted = true;
+		if (stacksInFlight > 0) {
+			process.stderr.write(`\nInterrupted before ${opts.command} armed its per-stack teardown — quitting now. Nothing was deleted and no stack lock is held.\n`);
+			process.exit(130);
+		}
+		process.stderr.write(`\nInterrupted — ${opts.command} will stop before starting another stack (press Ctrl-C again to force-quit)...\n`);
+	};
+	process.on("SIGINT", handler);
+	return {
+		interrupted: () => interrupted,
+		async runStack(fn) {
+			stacksInFlight += 1;
+			try {
+				return await fn();
+			} finally {
+				stacksInFlight -= 1;
+			}
+		},
+		dispose: () => {
+			process.removeListener("SIGINT", handler);
+		}
+	};
+}
 
 //#endregion
 //#region src/deployment/recreate-targets.ts
@@ -68228,7 +68331,14 @@ async function destroyCommand(stackArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const unforwardSigterm = forwardSigtermToSigint();
+	const interruptWatch = watchCommandInterrupt({ command: "cdkd destroy" });
+	let unforwardSigterm;
+	try {
+		unforwardSigterm = forwardSigtermToSigint();
+	} catch (error) {
+		interruptWatch.dispose();
+		throw error;
+	}
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -68288,6 +68398,7 @@ async function destroyCommand(stackArgs, options) {
 		let totalErrors = 0;
 		let totalSkipped = 0;
 		let interrupted = false;
+		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stackNames;
 		if (options.all) stackNames = candidateStacks.map((s) => s.stackName);
 		else if (stackPatterns.length > 0) stackNames = matchStacks(candidateStacks, stackPatterns).map((s) => s.stackName);
@@ -68364,6 +68475,7 @@ async function destroyCommand(stackArgs, options) {
 				totalErrors++;
 				continue;
 			}
+			if (runInterrupted()) break;
 			const eventRecorder = startRunRecorder({
 				backend: stateBackend,
 				stackName,
@@ -68372,7 +68484,7 @@ async function destroyCommand(stackArgs, options) {
 			});
 			let destroyRunResult = "SUCCEEDED";
 			try {
-				const result = await withNestedStackContext({
+				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend,
 					lockManager,
 					providerRegistry,
@@ -68411,7 +68523,7 @@ async function destroyCommand(stackArgs, options) {
 					...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs },
 					eventRecorder
-				}));
+				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
@@ -68438,15 +68550,16 @@ async function destroyCommand(stackArgs, options) {
 			await purgeEventsAfterDestroy(new DeploymentEventsReader(stateBackend), stackName, stackTargetRegion, {
 				purgeEvents: options.purgeEvents,
 				runResult: destroyRunResult,
-				interrupted
+				interrupted: runInterrupted()
 			}, logger);
-			if (interrupted) break;
+			if (runInterrupted()) break;
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
+		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
+		interruptWatch.dispose();
 		awsClients.destroy();
 	}
 }
@@ -73014,7 +73127,14 @@ async function stateDestroyCommand(stackArgs, options) {
 	registerAllProviders(providerRegistry);
 	providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 	if (options.allowUnsupportedTypes?.length) providerRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
-	const unforwardSigterm = forwardSigtermToSigint();
+	const interruptWatch = watchCommandInterrupt({ command: "cdkd state destroy" });
+	let unforwardSigterm;
+	try {
+		unforwardSigterm = forwardSigtermToSigint();
+	} catch (error) {
+		interruptWatch.dispose();
+		throw error;
+	}
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -73050,6 +73170,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		let totalErrors = 0;
 		let totalSkipped = 0;
 		let interrupted = false;
+		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		for (const stackName of stackNames) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
@@ -73071,7 +73192,8 @@ async function stateDestroyCommand(stackArgs, options) {
 					logger.warn(`No state found for stack ${stackName}${ref.region ? ` in ${ref.region}` : ""}, skipping`);
 					continue;
 				}
-				const result = await withNestedStackContext({
+				if (runInterrupted()) break;
+				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend: setup.stateBackend,
 					lockManager: setup.lockManager,
 					providerRegistry,
@@ -73109,19 +73231,20 @@ async function stateDestroyCommand(stackArgs, options) {
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
 					...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
-				}));
+				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
-				if (interrupted) break;
+				if (runInterrupted()) break;
 			}
-			if (interrupted) break;
+			if (runInterrupted()) break;
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
+		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd state destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
+		interruptWatch.dispose();
 		setup.dispose();
 	}
 }
@@ -74705,9 +74828,19 @@ function looksLikeEcrHostWithForeignSuffix(imageUri) {
 *
 * - Names come from the region's bootstrap marker, never recomputed from
 *   the naming convention (custom-name compatibility, issue #1011). No
-*   marker → the region is not opted in; friendly no-op. CDK bootstrap
+*   marker → no ASSET storage in scope; since issue #2052 the run continues
+*   to the state-bucket placeholder sweep rather than ending, and is a
+*   friendly no-op only when neither side has anything. CDK bootstrap
 *   storage (`cdk-hnb659fds-*`) is never touched — that stays `cdk gc`'s
 *   job.
+* - Abandoned `custom-resource-responses/{requestId}.json` placeholders in
+*   the STATE bucket are collected too (issue #2052). Two things make that
+*   the one arm needing its own guard: it is gc's only DESTRUCTIVE call
+*   against the state bucket, and it is ACCOUNT-scoped where every other arm
+*   is region-scoped (the keys carry no region). It matches the producer's
+*   own key shape rather than sweeping the prefix by age alone, so a stack
+*   deployed with a colliding `--state-prefix` cannot have its `state.json`
+*   collected.
 * - The reference scan lists EVERY state file in the WHOLE state bucket
 *   (any `--state-prefix`), and a state file that fails to JSON-parse
 *   aborts the whole run — deleting on partial knowledge is how a live
@@ -75162,12 +75295,98 @@ async function listS3Candidates(s3Client, bucket, accountId, refs, cutoffMs, log
 	return candidates;
 }
 /**
-* Describe the container repo's images (paginated) and pick the deletion
-* candidates: an image is REFERENCED when any of its tags OR its digest is
-* in the referenced set; candidates are unreferenced AND strictly older
-* than the cutoff. Images with no `imagePushedAt` are kept (treated as
-* new). A missing repo is an idempotent skip.
-*/
+* List abandoned custom-resource response placeholders (issue #2052).
+*
+* `CustomResourceProvider` PUTs an empty object at
+* `custom-resource-responses/{requestId}.json` before each invocation so the
+* handler has a pre-signed URL to write to. The happy paths clean up after
+* themselves — the issue #2033 replay path via `cleanupResponseObject`, and the
+* FAILED-response arm via `getCustomResourceResponse` / `pollS3Response` — but
+* three shapes leave the key behind and NOTHING collected them:
+*
+*  - an interrupted deploy (Ctrl-C / SIGTERM / a cancelled CI job) between the
+*    PUT and any cleanup;
+*  - any throw on a path that does not reach a cleanup call;
+*  - a LATE handler PUT, landing after cdkd stopped polling. This is the only
+*    one with CONTENT: an empty body is a storage leak, but a real
+*    CloudFormation `Data` payload sitting at a key nothing collects is also a
+*    data-retention question.
+*
+* ## Why age alone is a sufficient staleness rule here
+*
+* The requirement is that a key belonging to an IN-FLIGHT concurrent run is
+* never collected, and two independent things already guarantee it:
+*
+*  1. gc refuses outright while ANY stack holds a lock (the lock guard in
+*     `gcCommand`), and every deploy that can write one of these keys holds
+*     one for its whole duration. A concurrent run does not get this far.
+*  2. `--older-than` (default 30d) is applied to each object's own
+*     `LastModified`, which for a placeholder is the moment of the PUT that
+*     opened the invocation.
+*
+* So this deliberately adds no clock of its own. The two are not ranked, and an
+* earlier version of this note wrongly said (1) was the one that mattered: for
+* a deploy that STARTS between the lock scan and this listing, (1) has already
+* run and only (2) covers it. They close different windows.
+*
+* ## What this widens, stated rather than implied
+*
+* This is gc's first DESTRUCTIVE call against the state bucket — until now it
+* only ever read from it. And unlike every other arm of this command it is
+* ACCOUNT-scoped, not region-scoped: placeholder keys carry no region, so
+* `cdkd gc --region us-east-1` collects ones written by deploys into any
+* region. Both are deliberate (the objects are cdkd's own transient scratch,
+* and a region-scoped sweep could never reach most of them), and both are why
+* the key-shape filter below is not optional.
+*
+* ## Scope
+*
+* Only the DEFAULT prefix. `ProviderRegistry` can be configured with another
+* `responsePrefix`, and nothing persists which one a past deploy used, so gc
+* cannot discover a non-default layout — under-collecting, which is the safe
+* direction, and the reason the constant is shared with the producer rather
+* than re-spelled here.
+*/
+/**
+* The only key shape `CustomResourceProvider` can mint under the prefix.
+*
+* `getResponseKey` builds `{prefix}/{requestId}.json` from
+* `cdkd-${Date.now()}-${Math.random().toString(36).substring(7)}`.
+*
+* The trailing group is `*`, NOT `+`, and that is a measurement rather than
+* caution: `substring(7)` returns the EMPTY string whenever the base-36
+* rendering is shorter than eight characters (`(0.5).toString(36)` is `'0.i'`),
+* so `cdkd-1756180000000-.json` is a real key this provider writes. A `+` here
+* would skip exactly those and the sweep would silently under-collect — a
+* shape filter defeating the sweep it is meant to protect.
+*
+* Why filter at all: `--state-prefix` is free-form and unvalidated, so a stack
+* deployed with `--state-prefix custom-resource-responses` puts its
+* `state.json`, `lock.json`, `rollback-journal.json` and `deployments/*` INSIDE
+* this prefix. gc builds its own backend on `DEFAULT_STATE_PREFIX` and cannot
+* see that collision, so an age-only sweep would delete live state and orphan
+* every resource in the stack. Matching the producer's own shape is what keeps
+* this command's "bias every ambiguity toward NOT deleting" posture true on the
+* one path that deletes from the STATE bucket.
+*/
+const RESPONSE_PLACEHOLDER_KEY = /^cdkd-\d+-[0-9a-z]*\.json$/;
+async function listResponsePlaceholderCandidates(stateBackend, cutoffMs, logger) {
+	const objects = await stateBackend.listRawObjects(`${CUSTOM_RESOURCE_RESPONSE_PREFIX}/`);
+	const candidates = [];
+	for (const obj of objects) {
+		const leaf = obj.key.slice(`${CUSTOM_RESOURCE_RESPONSE_PREFIX}/`.length);
+		if (!RESPONSE_PLACEHOLDER_KEY.test(leaf)) {
+			logger.debug(`gc: keeping ${obj.key} — not a cdkd response placeholder`);
+			continue;
+		}
+		if (obj.lastModified.getTime() >= cutoffMs) {
+			logger.debug(`gc: keeping ${obj.key} — newer than the --older-than cutoff`);
+			continue;
+		}
+		candidates.push(obj);
+	}
+	return candidates;
+}
 async function listEcrCandidates(ecrClient, repositoryName, refs, cutoffMs, logger) {
 	const candidates = [];
 	let nextToken;
@@ -75235,7 +75454,7 @@ function formatAge(date) {
 async function promptGcConfirm(input) {
 	const logger = getLogger();
 	logger.warn("");
-	logger.warn(`cdkd gc will delete the following unreferenced assets in ${input.region}:`);
+	logger.warn(`cdkd gc will delete the following (region: ${input.region}):`);
 	for (const line of input.planLines) logger.warn(`  - ${line}`);
 	if (input.yes) return true;
 	if (process.stdin.isTTY !== true) throw new CdkdError("The gc confirmation prompt cannot run in a non-interactive environment. Pass --yes / -y to confirm the deletion, or run the command from a real terminal.", "NON_INTERACTIVE_CONFIRM");
@@ -75351,32 +75570,47 @@ async function gcCommand(options) {
 			}
 			throw error;
 		}
-		if (markerBody === null) {
-			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
-			logger.info(`No bootstrap marker for region '${region}' (${probed}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
-			return;
-		}
-		const marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
 			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
 			throw new CdkdError(`Refusing to gc while ${lockKeys.length} stack(s) hold an active lock (a deploy in flight may have published assets whose state write has not landed yet):\n${listing}\nWait for the operation(s) to finish — or clear a stale lock with 'cdkd force-unlock <stack>' — then re-run 'cdkd gc'.`, "GC_LOCKED");
 		}
-		const refs = await scanReferencedAssets(stateBackend, marker, logger);
 		const cutoffMs = Date.now() - options.olderThan;
-		const s3Candidates = await listS3Candidates(awsClients.s3, marker.assetBucket, accountId, refs, cutoffMs, logger);
-		const ecrCandidates = await listEcrCandidates(ecrClient, marker.containerRepo, refs, cutoffMs, logger);
-		if (s3Candidates.length === 0 && ecrCandidates.length === 0) {
-			logger.info(`Nothing to garbage-collect in region '${region}': every object in ${marker.assetBucket} / image in ${marker.containerRepo} is either referenced by a deployed stack or newer than the --older-than cutoff.`);
+		const responseCandidates = await listResponsePlaceholderCandidates(stateBackend, cutoffMs, logger);
+		if (markerBody === null) {
+			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
+			if (responseCandidates.length === 0) {
+				logger.info(`No bootstrap marker for region '${region}' (${probed}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
+				return;
+			}
+			logger.info(`No bootstrap marker for region '${region}' (${probed}) — the region is not opted in to cdkd asset storage, so no assets are in scope. (CDK bootstrap storage is 'cdk gc' territory.) Continuing with the state bucket's abandoned custom-resource response placeholders.`);
+		}
+		const marker = markerBody === null ? null : parseBootstrapMarker(markerBody, resolvedMarkerKey);
+		let s3Candidates = [];
+		let ecrCandidates = [];
+		if (marker !== null) {
+			const refs = await scanReferencedAssets(stateBackend, marker, logger);
+			s3Candidates = await listS3Candidates(awsClients.s3, marker.assetBucket, accountId, refs, cutoffMs, logger);
+			ecrCandidates = await listEcrCandidates(ecrClient, marker.containerRepo, refs, cutoffMs, logger);
+		}
+		if (marker !== null && s3Candidates.length === 0 && ecrCandidates.length === 0 && responseCandidates.length === 0) {
+			logger.info(`Nothing to garbage-collect in region '${region}': every object in ${marker.assetBucket} / image in ${marker.containerRepo} is either referenced by a deployed stack or newer than the --older-than cutoff, and no abandoned custom-resource response placeholder is older than it either.`);
 			return;
 		}
 		const s3Bytes = s3Candidates.reduce((sum, c) => sum + c.size, 0);
 		const ecrBytes = ecrCandidates.reduce((sum, c) => sum + c.size, 0);
-		const planLines = [...s3Candidates.map((c) => `s3://${marker.assetBucket}/${c.key} (${formatBytes(c.size)}, ${formatAge(c.lastModified)})`), ...ecrCandidates.map((c) => `${marker.containerRepo}${c.tags.length > 0 ? `:${c.tags.join(",")}` : ""}@${c.digest} (${formatBytes(c.size)}, ${formatAge(c.pushedAt)})`)];
-		const totals = `Total: ${s3Candidates.length} S3 object(s) (${formatBytes(s3Bytes)}) + ${ecrCandidates.length} ECR image(s) (${formatBytes(ecrBytes)}) = ${formatBytes(s3Bytes + ecrBytes)} reclaimable`;
+		const responseBytes = responseCandidates.reduce((sum, c) => sum + c.size, 0);
+		const assetBucket = marker !== null ? marker.assetBucket : "";
+		const containerRepo = marker !== null ? marker.containerRepo : "";
+		const planLines = [
+			...s3Candidates.map((c) => `s3://${assetBucket}/${c.key} (${formatBytes(c.size)}, ${formatAge(c.lastModified)})`),
+			...ecrCandidates.map((c) => `${containerRepo}${c.tags.length > 0 ? `:${c.tags.join(",")}` : ""}@${c.digest} (${formatBytes(c.size)}, ${formatAge(c.pushedAt)})`),
+			...responseCandidates.map((c) => `s3://${bucketName}/${c.key} (${formatBytes(c.size)}, ${formatAge(c.lastModified)}) [abandoned custom-resource response]`)
+		];
+		const totals = `Total: ${s3Candidates.length} S3 object(s) (${formatBytes(s3Bytes)}) + ${ecrCandidates.length} ECR image(s) (${formatBytes(ecrBytes)}) + ${responseCandidates.length} custom-resource response placeholder(s) (${formatBytes(responseBytes)}) = ${formatBytes(s3Bytes + ecrBytes + responseBytes)} reclaimable`;
 		if (options.dryRun) {
 			logger.info("");
-			logger.info(`Dry run — the following unreferenced assets in ${region} would be deleted:`);
+			logger.info(`Dry run — the following would be deleted in ${region}:`);
 			for (const line of planLines) logger.info(`  - ${line}`);
 			logger.info(totals);
 			logger.info("Dry run: nothing deleted. Re-run without --dry-run to delete.");
@@ -75390,15 +75624,23 @@ async function gcCommand(options) {
 			logger.info("gc cancelled — nothing deleted.");
 			return;
 		}
-		if (s3Candidates.length > 0) {
+		if (marker !== null && s3Candidates.length > 0) {
 			await deleteS3Candidates(awsClients.s3, marker.assetBucket, accountId, s3Candidates);
 			logger.info(`✓ Deleted ${s3Candidates.length} object(s) (${formatBytes(s3Bytes)}) from ${marker.assetBucket}`);
 		}
-		if (ecrCandidates.length > 0) {
+		if (marker !== null && ecrCandidates.length > 0) {
 			await deleteEcrCandidates(ecrClient, marker.containerRepo, ecrCandidates);
 			logger.info(`✓ Deleted ${ecrCandidates.length} image(s) (${formatBytes(ecrBytes)}) from ${marker.containerRepo}`);
 		}
-		logger.info(`\n✓ gc completed: ${formatBytes(s3Bytes + ecrBytes)} reclaimed`);
+		if (responseCandidates.length > 0) {
+			try {
+				await stateBackend.deleteRawObjects(responseCandidates.map((c) => c.key));
+			} catch (deleteError) {
+				throw new CdkdError(`Failed to delete ${responseCandidates.length} abandoned custom-resource response placeholder(s) from ${bucketName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, "GC_DELETE_FAILED");
+			}
+			logger.info(`✓ Deleted ${responseCandidates.length} abandoned custom-resource response placeholder(s) (${formatBytes(responseBytes)}) from ${bucketName}`);
+		}
+		logger.info(`\n✓ gc completed: ${formatBytes(s3Bytes + ecrBytes + responseBytes)} reclaimed`);
 	} finally {
 		ecrClient.destroy();
 		markerS3Client.destroy();
@@ -75409,7 +75651,7 @@ async function gcCommand(options) {
 * Create the `cdkd gc` command (upstream `cdk gc` parity naming).
 */
 function createGcCommand() {
-	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc for that).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION, then AWS_DEFAULT_REGION, then your AWS profile's region, then us-east-1)")).action(withErrorHandling(async (options) => {
+	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo), plus abandoned custom-resource response placeholders in the state bucket (account-wide). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION, then AWS_DEFAULT_REGION, then your AWS profile's region, then us-east-1)")).action(withErrorHandling(async (options) => {
 		await gcCommand(options);
 	}));
 	commonOptions.forEach((opt) => cmd.addOption(opt));
@@ -87262,4 +87504,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-9yMSf-LQ.js.map
+//# sourceMappingURL=program-CTreQYc-.js.map