@thejoseki/clawform 2.3.0 → 2.3.2

package/src/commands/rollback.js

@@ -1,126 +1,126 @@
-import {
-  DescribeStacksCommand,
-  DescribeStackResourcesCommand,
-} from '@aws-sdk/client-cloudformation';
-import chalk from 'chalk';
-import { logger } from '../lib/logger.js';
-import { cfnClient } from '../lib/aws-client.js';
-import { isDataResource } from '../lib/constants.js';
-import { loadProjectConfig, buildLegacyPrefixRegex, buildAnchoredLegacyPrefixRegex, resolveProjectDir } from '../lib/project-config.js';
-import { assertNoFrozenExports } from '../aws/exports.js';
-
-export default async function rollback({ stack }) {
-  logger.step(`clawform rollback ${stack}`);
-
-  // Legacy-freeze gate (mirrors deploy.js): the freeze applies to recovery,
-  // not just edits. The CLI refuses outright — no override flag. The
-  // documented escape hatch is running the raw aws CLI with a
-  // `# FORCE LEGACY: <reason>` comment, which goes through the PreToolUse
-  // hook, not this CLI. See rules/legacy-freeze.md.
-  const projectCfg = loadProjectConfig({ projectDir: resolveProjectDir() });
-  const legacyRe = buildLegacyPrefixRegex(projectCfg.legacy_prefixes);
-  if (legacyRe && legacyRe.test(stack)) {
-    const list = projectCfg.legacy_prefixes.map((p) => `${p}-*`).join(', ');
-    throw new Error(
-      `Stack "${stack}" matches a legacy prefix (${list}) from your clawform.config.json.\n` +
-      `clawform rollback refuses to suggest recovery commands for legacy stacks. See rules/legacy-freeze.md.\n` +
-      `If recovery is unavoidable, use the raw aws cloudformation CLI with a "# FORCE LEGACY: <reason>" comment on its own line.`,
-    );
-  }
-
-  const client = cfnClient();
-
-  const out = await client.send(new DescribeStacksCommand({ StackName: stack }));
-  const s = out.Stacks?.[0];
-  if (!s) throw new Error(`Stack ${stack} not found.`);
-
-  // C2: frozen-export gate — shared with deploy.js (src/aws/exports.js). A
-  // stack whose NAME isn't frozen may still emit legacy-prefixed EXPORT names;
-  // the freeze applies to recovery too (rules/legacy-freeze.md). Anchored
-  // regex: prefix must lead the export name.
-  assertNoFrozenExports({
-    liveOutputs: s.Outputs,
-    legacyRe: buildAnchoredLegacyPrefixRegex(projectCfg.legacy_prefixes),
-    stackName: stack,
-    action: 'recovery',
-  });
-
-  logger.info(`Status: ${s.StackStatus}`);
-
-  switch (s.StackStatus) {
-    case 'UPDATE_ROLLBACK_FAILED':
-    case 'ROLLBACK_FAILED':
-      await suggestContinueRollback(client, stack);
-      break;
-    case 'CREATE_FAILED':
-    case 'ROLLBACK_COMPLETE':
-      await suggestDelete(client, stack);
-      break;
-    case 'UPDATE_FAILED':
-      logger.info('CFN will normally auto-roll-back to UPDATE_ROLLBACK_COMPLETE. If stuck, wait then re-run /rollback.');
-      break;
-    case 'CREATE_COMPLETE':
-    case 'UPDATE_COMPLETE':
-    case 'UPDATE_ROLLBACK_COMPLETE':
-    case 'IMPORT_COMPLETE':
-      logger.ok('Stack is healthy — nothing to roll back.');
-      break;
-    default:
-      if (/_IN_PROGRESS$/.test(s.StackStatus)) {
-        logger.info('Stack is mid-operation. Wait for terminal status, then re-run /rollback.');
-      } else {
-        logger.warn(`Status ${s.StackStatus} has no automatic recovery suggestion.`);
-      }
-  }
-}
-
-async function suggestContinueRollback(client, stack) {
-  const failed = await fetchFailedResources(client, stack);
-  if (failed.length === 0) {
-    logger.info(chalk.bold('Suggested:'));
-    logger.info(`  aws cloudformation continue-update-rollback --stack-name ${stack}`);
-    return;
-  }
-  logger.info(`Failed resources (${failed.length}): ${failed.join(', ')}`);
-  logger.info(chalk.bold('Suggested:'));
-  logger.info(`  aws cloudformation continue-update-rollback --stack-name ${stack} \\`);
-  logger.info(`    --resources-to-skip ${failed.join(' ')}`);
-  logger.warn('Confirm each skipped resource is acceptable to leave in mixed state before running.');
-}
-
-async function suggestDelete(client, stack) {
-  const out = await client.send(new DescribeStackResourcesCommand({ StackName: stack }));
-  const dataResources = (out.StackResources ?? []).filter((r) => isDataResource(r.ResourceType));
-  if (dataResources.length > 0) {
-    logger.warn(`Stack contains ${dataResources.length} data resource(s):`);
-    for (const r of dataResources) logger.warn(`  ${r.LogicalResourceId} (${r.ResourceType}) → ${r.PhysicalResourceId ?? '(no physical)'}`);
-    logger.info('Delete is unsafe. Options:');
-    logger.info('  1. Verify each data resource has DeletionPolicy: Retain → delete-stack is safe (physical resource survives)');
-    logger.info('  2. Import data resources into a new stack first (see rules/legacy-freeze.md "replace pattern")');
-    return;
-  }
-  logger.ok('No data resources detected.');
-  logger.info(chalk.bold('Suggested:'));
-  logger.info(`  aws cloudformation delete-stack --stack-name ${stack}`);
-  logger.info('Then run: aws cloudformation wait stack-delete-complete --stack-name ' + stack);
-}
-
-export async function fetchFailedResources(client, stack) {
-  // Use DescribeStackResources, not DescribeStackEvents. Two reasons:
-  // 1. (bug_028) DescribeStackResources returns CURRENT per-resource status. The
-  //    previous DescribeStackEvents+filter walked event HISTORY and added any
-  //    resource that had ever-been-FAILED — so a resource that hit UPDATE_FAILED
-  //    early and was then auto-rolled-back to UPDATE_COMPLETE stayed in the
-  //    suggested --resources-to-skip list. AWS rejects continue-update-rollback
-  //    with "resource X is not in a state to be skipped" for those, defeating
-  //    the whole point of the suggestion.
-  // 2. (merged_bug_008) DescribeStackEvents is paginated and capped ~100/page;
-  //    after a long forward update + rollback the original FAILED events scroll
-  //    off page 1. DescribeStackResources avoids the pagination question entirely.
-  // The suggestDelete path already uses DescribeStackResources — this keeps the
-  // file consistent.
-  const out = await client.send(new DescribeStackResourcesCommand({ StackName: stack }));
-  return (out.StackResources ?? [])
-    .filter((r) => /_FAILED$/.test(r.ResourceStatus ?? '') && r.LogicalResourceId)
-    .map((r) => r.LogicalResourceId);
-}
+import {
+  DescribeStacksCommand,
+  DescribeStackResourcesCommand,
+} from '@aws-sdk/client-cloudformation';
+import chalk from 'chalk';
+import { logger } from '../lib/logger.js';
+import { cfnClient } from '../lib/aws-client.js';
+import { isDataResource } from '../lib/constants.js';
+import { loadProjectConfig, buildLegacyPrefixRegex, buildAnchoredLegacyPrefixRegex, resolveProjectDir } from '../lib/project-config.js';
+import { assertNoFrozenExports } from '../aws/exports.js';
+
+export default async function rollback({ stack }) {
+  logger.step(`clawform rollback ${stack}`);
+
+  // Legacy-freeze gate (mirrors deploy.js): the freeze applies to recovery,
+  // not just edits. The CLI refuses outright — no override flag. The
+  // documented escape hatch is running the raw aws CLI with a
+  // `# FORCE LEGACY: <reason>` comment, which goes through the PreToolUse
+  // hook, not this CLI. See rules/legacy-freeze.md.
+  const projectCfg = loadProjectConfig({ projectDir: resolveProjectDir() });
+  const legacyRe = buildLegacyPrefixRegex(projectCfg.legacy_prefixes);
+  if (legacyRe && legacyRe.test(stack)) {
+    const list = projectCfg.legacy_prefixes.map((p) => `${p}-*`).join(', ');
+    throw new Error(
+      `Stack "${stack}" matches a legacy prefix (${list}) from your clawform.config.json.\n` +
+      `clawform rollback refuses to suggest recovery commands for legacy stacks. See rules/legacy-freeze.md.\n` +
+      `If recovery is unavoidable, use the raw aws cloudformation CLI with a "# FORCE LEGACY: <reason>" comment on its own line.`,
+    );
+  }
+
+  const client = cfnClient();
+
+  const out = await client.send(new DescribeStacksCommand({ StackName: stack }));
+  const s = out.Stacks?.[0];
+  if (!s) throw new Error(`Stack ${stack} not found.`);
+
+  // C2: frozen-export gate — shared with deploy.js (src/aws/exports.js). A
+  // stack whose NAME isn't frozen may still emit legacy-prefixed EXPORT names;
+  // the freeze applies to recovery too (rules/legacy-freeze.md). Anchored
+  // regex: prefix must lead the export name.
+  assertNoFrozenExports({
+    liveOutputs: s.Outputs,
+    legacyRe: buildAnchoredLegacyPrefixRegex(projectCfg.legacy_prefixes),
+    stackName: stack,
+    action: 'recovery',
+  });
+
+  logger.info(`Status: ${s.StackStatus}`);
+
+  switch (s.StackStatus) {
+    case 'UPDATE_ROLLBACK_FAILED':
+    case 'ROLLBACK_FAILED':
+      await suggestContinueRollback(client, stack);
+      break;
+    case 'CREATE_FAILED':
+    case 'ROLLBACK_COMPLETE':
+      await suggestDelete(client, stack);
+      break;
+    case 'UPDATE_FAILED':
+      logger.info('CFN will normally auto-roll-back to UPDATE_ROLLBACK_COMPLETE. If stuck, wait then re-run /rollback.');
+      break;
+    case 'CREATE_COMPLETE':
+    case 'UPDATE_COMPLETE':
+    case 'UPDATE_ROLLBACK_COMPLETE':
+    case 'IMPORT_COMPLETE':
+      logger.ok('Stack is healthy — nothing to roll back.');
+      break;
+    default:
+      if (/_IN_PROGRESS$/.test(s.StackStatus)) {
+        logger.info('Stack is mid-operation. Wait for terminal status, then re-run /rollback.');
+      } else {
+        logger.warn(`Status ${s.StackStatus} has no automatic recovery suggestion.`);
+      }
+  }
+}
+
+async function suggestContinueRollback(client, stack) {
+  const failed = await fetchFailedResources(client, stack);
+  if (failed.length === 0) {
+    logger.info(chalk.bold('Suggested:'));
+    logger.info(`  aws cloudformation continue-update-rollback --stack-name ${stack}`);
+    return;
+  }
+  logger.info(`Failed resources (${failed.length}): ${failed.join(', ')}`);
+  logger.info(chalk.bold('Suggested:'));
+  logger.info(`  aws cloudformation continue-update-rollback --stack-name ${stack} \\`);
+  logger.info(`    --resources-to-skip ${failed.join(' ')}`);
+  logger.warn('Confirm each skipped resource is acceptable to leave in mixed state before running.');
+}
+
+async function suggestDelete(client, stack) {
+  const out = await client.send(new DescribeStackResourcesCommand({ StackName: stack }));
+  const dataResources = (out.StackResources ?? []).filter((r) => isDataResource(r.ResourceType));
+  if (dataResources.length > 0) {
+    logger.warn(`Stack contains ${dataResources.length} data resource(s):`);
+    for (const r of dataResources) logger.warn(`  ${r.LogicalResourceId} (${r.ResourceType}) → ${r.PhysicalResourceId ?? '(no physical)'}`);
+    logger.info('Delete is unsafe. Options:');
+    logger.info('  1. Verify each data resource has DeletionPolicy: Retain → delete-stack is safe (physical resource survives)');
+    logger.info('  2. Import data resources into a new stack first (see rules/legacy-freeze.md "replace pattern")');
+    return;
+  }
+  logger.ok('No data resources detected.');
+  logger.info(chalk.bold('Suggested:'));
+  logger.info(`  aws cloudformation delete-stack --stack-name ${stack}`);
+  logger.info('Then run: aws cloudformation wait stack-delete-complete --stack-name ' + stack);
+}
+
+export async function fetchFailedResources(client, stack) {
+  // Use DescribeStackResources, not DescribeStackEvents. Two reasons:
+  // 1. (bug_028) DescribeStackResources returns CURRENT per-resource status. The
+  //    previous DescribeStackEvents+filter walked event HISTORY and added any
+  //    resource that had ever-been-FAILED — so a resource that hit UPDATE_FAILED
+  //    early and was then auto-rolled-back to UPDATE_COMPLETE stayed in the
+  //    suggested --resources-to-skip list. AWS rejects continue-update-rollback
+  //    with "resource X is not in a state to be skipped" for those, defeating
+  //    the whole point of the suggestion.
+  // 2. (merged_bug_008) DescribeStackEvents is paginated and capped ~100/page;
+  //    after a long forward update + rollback the original FAILED events scroll
+  //    off page 1. DescribeStackResources avoids the pagination question entirely.
+  // The suggestDelete path already uses DescribeStackResources — this keeps the
+  // file consistent.
+  const out = await client.send(new DescribeStackResourcesCommand({ StackName: stack }));
+  return (out.StackResources ?? [])
+    .filter((r) => /_FAILED$/.test(r.ResourceStatus ?? '') && r.LogicalResourceId)
+    .map((r) => r.LogicalResourceId);
+}

package/src/commands/status.js

@@ -1,150 +1,150 @@
-// clawform status — a one-command day-2 health board for a project's stacks.
-//
-// For each live stack belonging to the project: its CloudFormation status, when
-// it was last deployed, and its LAST-KNOWN drift status (from the ListStacks
-// summary — this does NOT trigger a fresh drift detection, which costs time and
-// API calls; run `clawform drift <stack>` for that). It also flags whether the
-// project has a monitoring stack covering it, since "no alarms" is the silent
-// gap [[observability]] exists to catch.
-//
-// Read-only. Pure helpers (filterProjectStacks / summarize / monitoringPresent /
-// renderStatus) are unit-tested without AWS; status() is the thin SDK wrapper.
-
-import { ListStacksCommand } from '@aws-sdk/client-cloudformation';
-import chalk from 'chalk';
-import { logger } from '../lib/logger.js';
-import { cfnClient } from '../lib/aws-client.js';
-import { ENVS } from '../lib/constants.js';
+// clawform status — a one-command day-2 health board for a project's stacks.
+//
+// For each live stack belonging to the project: its CloudFormation status, when
+// it was last deployed, and its LAST-KNOWN drift status (from the ListStacks
+// summary — this does NOT trigger a fresh drift detection, which costs time and
+// API calls; run `clawform drift <stack>` for that). It also flags whether the
+// project has a monitoring stack covering it, since "no alarms" is the silent
+// gap [[observability]] exists to catch.
+//
+// Read-only. Pure helpers (filterProjectStacks / summarize / monitoringPresent /
+// renderStatus) are unit-tested without AWS; status() is the thin SDK wrapper.
+
+import { ListStacksCommand } from '@aws-sdk/client-cloudformation';
+import chalk from 'chalk';
+import { logger } from '../lib/logger.js';
+import { cfnClient } from '../lib/aws-client.js';
+import { ENVS } from '../lib/constants.js';
 import { assertLicensed } from '../lib/license.js';
 import { resolveClient as resolveLicenseClient } from '../lib/license-client.js';
-
-// Every status a non-deleted stack can be in. ListStacks with StackStatusFilter
-// returns ONLY the listed statuses, so an omission makes that stack VANISH from
-// the board — and a board that hides DELETE_FAILED (the classic wedged-teardown
-// state) is worse than no board. Named EXISTING (not LIVE) deliberately:
-// src/aws/inventory.js has a different LIVE_STATUSES meaning "stable/deployable",
-// and the two must not be unified.
-const EXISTING_STATUSES = [
-  'CREATE_COMPLETE', 'UPDATE_COMPLETE', 'UPDATE_ROLLBACK_COMPLETE',
-  'IMPORT_COMPLETE', 'ROLLBACK_COMPLETE',
-  'CREATE_FAILED', 'UPDATE_FAILED', 'UPDATE_ROLLBACK_FAILED',
-  'ROLLBACK_FAILED', 'DELETE_FAILED', 'IMPORT_ROLLBACK_FAILED',
-  'CREATE_IN_PROGRESS', 'UPDATE_IN_PROGRESS', 'ROLLBACK_IN_PROGRESS',
-  'DELETE_IN_PROGRESS', 'UPDATE_ROLLBACK_IN_PROGRESS',
-  'UPDATE_COMPLETE_CLEANUP_IN_PROGRESS', 'UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS',
-  'IMPORT_IN_PROGRESS', 'IMPORT_ROLLBACK_IN_PROGRESS',
-  'REVIEW_IN_PROGRESS',
-];
-
-// Hand-rolled pagination (ListStacksCommand + NextToken) instead of
-// paginateListStacks so a plain { send } stub mocks the seam in tests — the
-// generated paginator hard-checks `client instanceof CloudFormationClient`.
-export async function fetchStackSummaries(client) {
-  const out = [];
-  let nextToken;
-  do {
-    const resp = await client.send(new ListStacksCommand({
-      StackStatusFilter: EXISTING_STATUSES,
-      NextToken: nextToken,
-    }));
-    for (const s of resp.StackSummaries ?? []) {
-      out.push({
-        name: s.StackName,
-        status: s.StackStatus,
-        lastUpdatedTime: s.LastUpdatedTime ?? s.CreationTime ?? null,
-        driftStatus: s.DriftInformation?.StackDriftStatus ?? 'NOT_CHECKED',
-      });
-    }
-    nextToken = resp.NextToken;
-  } while (nextToken);
-  return out;
-}
-
-// Stacks belonging to a project: the `<project>` token appears as a hyphen-
-// delimited segment of the name (e.g. d-acme-pri-snet-myproj-zonea → 'myproj').
-// Optional env narrows to names starting `<env>-`.
-export function filterProjectStacks(summaries, { project, env } = {}) {
-  return (summaries ?? []).filter((s) => {
-    const segments = (s.name ?? '').split('-');
-    if (project && !segments.includes(project)) return false;
-    if (env && !(s.name ?? '').startsWith(`${env}-`)) return false;
-    return true;
-  });
-}
-
-// A monitoring stack is present if any stack in the set names the monitoring
-// archetype or carries the cwa (CloudWatch alarm) service token.
-export function monitoringPresent(stacks) {
-  return (stacks ?? []).some((s) => {
-    const segs = (s.name ?? '').split('-');
-    return segs.includes('monitoring') || segs.includes('cwa');
-  });
-}
-
-function healthOf(status) {
-  if (/_FAILED$/.test(status)) return 'failed'; // incl. DELETE_FAILED — a wedged teardown is broken, not gone
-  if (/_IN_PROGRESS$/.test(status)) return 'in-progress';
-  if (status === 'ROLLBACK_COMPLETE') return 'failed';
-  return 'ok';
-}
-
-export function summarize(stacks) {
-  return [...(stacks ?? [])]
-    .map((s) => ({
-      name: s.name,
-      status: s.status,
-      health: healthOf(s.status),
-      updated: s.lastUpdatedTime ? new Date(s.lastUpdatedTime).toISOString().slice(0, 10) : '—',
-      drift: s.driftStatus,
-    }))
-    .sort((a, b) => a.name.localeCompare(b.name));
-}
-
-const HEALTH_COLOR = { ok: chalk.green, failed: chalk.red, 'in-progress': chalk.yellow };
-const DRIFT_COLOR = { DRIFTED: chalk.red, IN_SYNC: chalk.green };
-
-export function renderStatus(rows, meta) {
-  const lines = [];
-  const scope = [meta.env && `env ${meta.env}`, meta.project ? `project ${meta.project}` : 'all projects']
-    .filter(Boolean).join(', ');
-  lines.push(`Stack status — ${scope}`);
-  lines.push('');
-  if (rows.length === 0) {
-    lines.push('  (no matching stacks)');
-    return lines.join('\n');
-  }
-  const w = Math.max(20, ...rows.map((r) => r.name.length));
-  for (const r of rows) {
-    const statusColor = HEALTH_COLOR[r.health] ?? ((s) => s);
-    const driftColor = DRIFT_COLOR[r.drift] ?? chalk.gray;
-    lines.push(
-      `  ${r.name.padEnd(w)}  ${statusColor(r.status.padEnd(24))}  ${r.updated}  ${driftColor(r.drift)}`,
-    );
-  }
-  lines.push('');
-  const failed = rows.filter((r) => r.health === 'failed').length;
-  const drifted = rows.filter((r) => r.drift === 'DRIFTED').length;
-  lines.push(`  ${rows.length} stack(s) · ${failed} failed · ${drifted} drifted`);
-  if (!meta.hasMonitoring) {
-    lines.push(chalk.yellow('  ⚠ No monitoring stack detected for this scope — see observability (templates/monitoring.yaml).'));
-  }
-  lines.push(chalk.gray('  Drift = last known (not re-checked). Run `clawform drift <stack>` for a fresh detection.'));
-  return lines.join('\n');
-}
-
+
+// Every status a non-deleted stack can be in. ListStacks with StackStatusFilter
+// returns ONLY the listed statuses, so an omission makes that stack VANISH from
+// the board — and a board that hides DELETE_FAILED (the classic wedged-teardown
+// state) is worse than no board. Named EXISTING (not LIVE) deliberately:
+// src/aws/inventory.js has a different LIVE_STATUSES meaning "stable/deployable",
+// and the two must not be unified.
+const EXISTING_STATUSES = [
+  'CREATE_COMPLETE', 'UPDATE_COMPLETE', 'UPDATE_ROLLBACK_COMPLETE',
+  'IMPORT_COMPLETE', 'ROLLBACK_COMPLETE',
+  'CREATE_FAILED', 'UPDATE_FAILED', 'UPDATE_ROLLBACK_FAILED',
+  'ROLLBACK_FAILED', 'DELETE_FAILED', 'IMPORT_ROLLBACK_FAILED',
+  'CREATE_IN_PROGRESS', 'UPDATE_IN_PROGRESS', 'ROLLBACK_IN_PROGRESS',
+  'DELETE_IN_PROGRESS', 'UPDATE_ROLLBACK_IN_PROGRESS',
+  'UPDATE_COMPLETE_CLEANUP_IN_PROGRESS', 'UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS',
+  'IMPORT_IN_PROGRESS', 'IMPORT_ROLLBACK_IN_PROGRESS',
+  'REVIEW_IN_PROGRESS',
+];
+
+// Hand-rolled pagination (ListStacksCommand + NextToken) instead of
+// paginateListStacks so a plain { send } stub mocks the seam in tests — the
+// generated paginator hard-checks `client instanceof CloudFormationClient`.
+export async function fetchStackSummaries(client) {
+  const out = [];
+  let nextToken;
+  do {
+    const resp = await client.send(new ListStacksCommand({
+      StackStatusFilter: EXISTING_STATUSES,
+      NextToken: nextToken,
+    }));
+    for (const s of resp.StackSummaries ?? []) {
+      out.push({
+        name: s.StackName,
+        status: s.StackStatus,
+        lastUpdatedTime: s.LastUpdatedTime ?? s.CreationTime ?? null,
+        driftStatus: s.DriftInformation?.StackDriftStatus ?? 'NOT_CHECKED',
+      });
+    }
+    nextToken = resp.NextToken;
+  } while (nextToken);
+  return out;
+}
+
+// Stacks belonging to a project: the `<project>` token appears as a hyphen-
+// delimited segment of the name (e.g. d-acme-pri-snet-myproj-zonea → 'myproj').
+// Optional env narrows to names starting `<env>-`.
+export function filterProjectStacks(summaries, { project, env } = {}) {
+  return (summaries ?? []).filter((s) => {
+    const segments = (s.name ?? '').split('-');
+    if (project && !segments.includes(project)) return false;
+    if (env && !(s.name ?? '').startsWith(`${env}-`)) return false;
+    return true;
+  });
+}
+
+// A monitoring stack is present if any stack in the set names the monitoring
+// archetype or carries the cwa (CloudWatch alarm) service token.
+export function monitoringPresent(stacks) {
+  return (stacks ?? []).some((s) => {
+    const segs = (s.name ?? '').split('-');
+    return segs.includes('monitoring') || segs.includes('cwa');
+  });
+}
+
+function healthOf(status) {
+  if (/_FAILED$/.test(status)) return 'failed'; // incl. DELETE_FAILED — a wedged teardown is broken, not gone
+  if (/_IN_PROGRESS$/.test(status)) return 'in-progress';
+  if (status === 'ROLLBACK_COMPLETE') return 'failed';
+  return 'ok';
+}
+
+export function summarize(stacks) {
+  return [...(stacks ?? [])]
+    .map((s) => ({
+      name: s.name,
+      status: s.status,
+      health: healthOf(s.status),
+      updated: s.lastUpdatedTime ? new Date(s.lastUpdatedTime).toISOString().slice(0, 10) : '—',
+      drift: s.driftStatus,
+    }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+const HEALTH_COLOR = { ok: chalk.green, failed: chalk.red, 'in-progress': chalk.yellow };
+const DRIFT_COLOR = { DRIFTED: chalk.red, IN_SYNC: chalk.green };
+
+export function renderStatus(rows, meta) {
+  const lines = [];
+  const scope = [meta.env && `env ${meta.env}`, meta.project ? `project ${meta.project}` : 'all projects']
+    .filter(Boolean).join(', ');
+  lines.push(`Stack status — ${scope}`);
+  lines.push('');
+  if (rows.length === 0) {
+    lines.push('  (no matching stacks)');
+    return lines.join('\n');
+  }
+  const w = Math.max(20, ...rows.map((r) => r.name.length));
+  for (const r of rows) {
+    const statusColor = HEALTH_COLOR[r.health] ?? ((s) => s);
+    const driftColor = DRIFT_COLOR[r.drift] ?? chalk.gray;
+    lines.push(
+      `  ${r.name.padEnd(w)}  ${statusColor(r.status.padEnd(24))}  ${r.updated}  ${driftColor(r.drift)}`,
+    );
+  }
+  lines.push('');
+  const failed = rows.filter((r) => r.health === 'failed').length;
+  const drifted = rows.filter((r) => r.drift === 'DRIFTED').length;
+  lines.push(`  ${rows.length} stack(s) · ${failed} failed · ${drifted} drifted`);
+  if (!meta.hasMonitoring) {
+    lines.push(chalk.yellow('  ⚠ No monitoring stack detected for this scope — see observability (templates/monitoring.yaml).'));
+  }
+  lines.push(chalk.gray('  Drift = last known (not re-checked). Run `clawform drift <stack>` for a fresh detection.'));
+  return lines.join('\n');
+}
+
 export default async function status({ project, env, profile, region } = {}) {
-  await assertLicensed({ command: 'status', client: resolveLicenseClient() });
-  if (env && !ENVS.includes(env)) {
-    throw new Error(`Invalid --env "${env}". Expected one of: ${ENVS.join(' | ')}`);
-  }
-  const client = cfnClient({
-    ...(profile ? { AWS_PROFILE: profile } : {}),
-    ...(region ? { AWS_REGION: region } : {}),
-  });
-  logger.step(`clawform status${project ? ` — ${project}` : ''}`);
-
-  const all = await fetchStackSummaries(client);
-  const mine = filterProjectStacks(all, { project, env });
-  const rows = summarize(mine);
-  console.log(renderStatus(rows, { project, env, hasMonitoring: monitoringPresent(mine) }));
-}
+  await assertLicensed({ command: 'status', client: resolveLicenseClient() });
+  if (env && !ENVS.includes(env)) {
+    throw new Error(`Invalid --env "${env}". Expected one of: ${ENVS.join(' | ')}`);
+  }
+  const client = cfnClient({
+    ...(profile ? { AWS_PROFILE: profile } : {}),
+    ...(region ? { AWS_REGION: region } : {}),
+  });
+  logger.step(`clawform status${project ? ` — ${project}` : ''}`);
+
+  const all = await fetchStackSummaries(client);
+  const mine = filterProjectStacks(all, { project, env });
+  const rows = summarize(mine);
+  console.log(renderStatus(rows, { project, env, hasMonitoring: monitoringPresent(mine) }));
+}