@go-to-k/cdkd 0.235.0 → 0.236.0

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
-import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as uploadCfnTemplate, a as withRetry, at as resolveApp, b as IAMRoleProvider, bt as resolveBucketRegion, c as computeImplicitDeleteEdges, ct as resolveSkipPrefix, d as isStatefulRecreateTargetSync, dt as resolveUseCdkBootstrapAssets, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as warnDeprecatedNoPrefixCliFlag, g as gray, gt as findLargeInlineResources, h as cyan, ht as MIGRATE_TMP_PREFIX, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefault, m as bold, mt as CFN_TEMPLATE_URL_LIMIT, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveAutoAssetStorage, p as formatResourceLine, pt as CFN_TEMPLATE_BODY_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveCaptureObservedState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveStateBucketWithDefaultAndSource, v as red, vt as AssemblyReader, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-Cbi5IzWV.js";
-import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
+import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
+import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
+import { $ as runDockerStreaming, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerForeground, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as formatDockerLoginError, Y as buildDockerImage, Z as getDockerCmd, _ as green, _t as findLargeInlineResources, a as withRetry, at as getLegacyStateBucketName, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveCaptureObservedState, d as isStatefulRecreateTargetSync, dt as resolveStateBucketWithDefaultAndSource, et as AssetManifestLoader, f as renderStatefulReason, ft as resolveUseCdkBootstrapAssets, g as gray, gt as MIGRATE_TMP_PREFIX, h as cyan, ht as CFN_TEMPLATE_URL_LIMIT, i as withResourceDeadline, it as getDefaultStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveSkipPrefix, m as bold, mt as CFN_TEMPLATE_BODY_LIMIT, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as Synthesizer, o as isRetryableTransientError, ot as resolveApp, p as formatResourceLine, pt as warnDeprecatedNoPrefixCliFlag, q as getBootstrapMarkerKey, r as DeployEngine, rt as synthesisStatusMessage, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveAutoAssetStorage, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getDockerImageBySourceHash, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveStateBucketWithDefault, v as red, vt as uploadCfnTemplate, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveBucketRegion, y as yellow, yt as AssemblyReader, z as WorkGraph } from "./deploy-engine-DqAIXGA_.js";
+import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
+import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -38,9 +40,9 @@ import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
 import { Command, Option } from "commander";
-import { writeFileSync as writeFileSync$1 } from "fs";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
+import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
@@ -608,6 +610,310 @@ const destroyOptions = [
 	allowUnsupportedTypesOption
 ];
 
+//#endregion
+//#region src/cli/commands/bootstrap-destroy.ts
+/**
+* `cdkd bootstrap --destroy` — teardown of cdkd-created account resources
+* (issue #1010, the reverse of `cdkd bootstrap` / `ensureAssetStorage`).
+*
+* Scope per invocation is ONE region's asset storage (`--region`, same
+* option the create side uses): empty + delete the asset bucket, force-
+* delete the container-asset ECR repo, then delete the region's bootstrap
+* marker LAST — the mirror image of the create side's marker-written-last
+* ordering, so a crash mid-teardown leaves the region still consistently
+* opted in (marker present → deploys keep hard-erroring at the missing
+* resources with a re-bootstrap hint, never a silent legacy fallback).
+*
+* The asset bucket / repo NAMES are read from the region's bootstrap
+* marker, NOT recomputed from the naming convention — the marker is the
+* source of truth for names (design §4.1), which keeps this teardown
+* compatible with custom asset-storage names (issue #1011).
+*
+* The state bucket is NOT deleted by default: it is the account's source
+* of truth. `--include-state-bucket` opts in, and even then the deletion
+* is refused while ANY stack state exists in the bucket or any OTHER
+* region is still opted in to asset storage (deleting their markers would
+* silently flip those regions back to legacy mode).
+*/
+/** S3 key prefix for state files — same fixed value the create side uses. */
+const STATE_PREFIX = "cdkd";
+/**
+* Every cdkd state file ends with this suffix, regardless of the
+* `--state-prefix` it was deployed under (`{prefix}/{stack}/{region}/state.json`,
+* or legacy `{prefix}/{stack}/state.json`).
+*/
+const STATE_FILE_SUFFIX = "/state.json";
+/** `us-east-1` / `ap-northeast-1` / `us-gov-west-1` — a region-shaped segment. */
+const REGION_SEGMENT = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+/**
+* List every state file in the bucket — the WHOLE bucket, not just the
+* default `cdkd/` prefix. Other commands accept `--state-prefix`, so live
+* stack state may exist under ANY prefix in this bucket; scoping this
+* listing to the default prefix would let the reference scan and the
+* `--include-state-bucket` guard silently miss those stacks and delete
+* live state.
+*/
+async function listAllStateKeys(stateBackend) {
+	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(STATE_FILE_SUFFIX));
+}
+/**
+* Interactive confirmation for the teardown. Follows the repo's
+* destructive-prompt convention (see `recreate-confirm-prompt.ts`, the
+* same pattern family as `confirm-prompt.ts`): print the deletion plan as
+* a WARN block, `--yes` skips the prompt, a non-TTY stdin without `--yes`
+* is a hard error (never hang / never silently decline in CI), and the
+* prompt itself defaults to NO because the side effect is destructive.
+*/
+async function promptBootstrapDestroyConfirm(input) {
+	const logger = getLogger();
+	logger.warn("");
+	logger.warn("cdkd bootstrap --destroy will delete the following:");
+	for (const line of input.planLines) logger.warn(`  - ${line}`);
+	if (input.yes) return true;
+	if (process.stdin.isTTY !== true) throw new CdkdError("The bootstrap --destroy confirmation prompt cannot run in a non-interactive environment. Pass --yes / -y to confirm the teardown, or run the command from a real terminal.", "NON_INTERACTIVE_CONFIRM");
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const trimmed = (await rl.question("\nContinue? (y/N): ")).trim().toLowerCase();
+		return trimmed === "y" || trimmed === "yes";
+	} finally {
+		rl.close();
+	}
+}
+/**
+* Scan every state file in the state bucket for references to the target
+* region's asset bucket / container repo. A pragmatic string scan of the
+* serialized state (design rationale in issue #1010): asset references
+* appear in many property shapes (`Code.S3Bucket`, `ImageUri`, nested
+* `TemplateURL`, `s3.Asset` env-var URLs, …) but all of them carry the
+* bucket / repo NAME verbatim, so a substring match over the raw JSON body
+* catches every shape — including ones future providers add — with zero
+* per-shape maintenance. Covers both key layouts (region-prefixed and
+* legacy), nested-stack children, and stacks deployed under a custom
+* `--state-prefix` (the listing spans the whole bucket, not just the
+* default `cdkd/` prefix).
+*
+* Returns a human-readable `stack (region)` descriptor per referencing
+* state file.
+*/
+async function scanStateReferences(stateBackend, names) {
+	const stateKeys = await listAllStateKeys(stateBackend);
+	const referencing = [];
+	for (const key of stateKeys) {
+		const body = await stateBackend.getRawObject(key);
+		if (body === null) continue;
+		if (names.some((name) => body.includes(name))) referencing.push(describeStateKey(key));
+	}
+	return referencing;
+}
+/**
+* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
+* `{prefix}/{stack}/state.json` → `stack`. The prefix is arbitrary (custom
+* `--state-prefix` values included), so the stack/region pair is derived
+* from the key's TAIL: the last segment is treated as a region only when
+* it is region-shaped.
+*/
+function describeStateKey(key) {
+	const segments = key.slice(0, -11).split("/");
+	const last = segments[segments.length - 1] ?? key;
+	const secondLast = segments[segments.length - 2];
+	if (secondLast !== void 0 && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
+	return last;
+}
+/**
+* Empty (all versions + delete markers) and delete an S3 bucket, with
+* `ExpectedBucketOwner` pinned on every call — deleting a foreign bucket
+* that squatted the predictable name would be catastrophic, so the same
+* ownership defense as the create side applies in reverse. Returns `false`
+* (skip, info line) when the bucket does not exist — the idempotency
+* mirror of `ensureAssetStorage`.
+*/
+async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger) {
+	try {
+		await s3Client.send(new HeadBucketCommand({
+			Bucket: bucket,
+			ExpectedBucketOwner: accountId
+		}));
+	} catch (error) {
+		const err = error;
+		if (err.name === "NotFound" || err.name === "NoSuchBucket") {
+			logger.info(`${label} ${bucket} does not exist — skipping`);
+			return false;
+		}
+		if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`${label} '${bucket}' exists but is not owned by account ${accountId} (or access is denied). Refusing to delete it.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+		throw normalizeAwsError(error, {
+			bucket,
+			operation: "HeadBucket"
+		});
+	}
+	logger.info(`Emptying ${label.toLowerCase()}: ${bucket}`);
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const page = await s3Client.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			ExpectedBucketOwner: accountId,
+			...keyMarker && { KeyMarker: keyMarker },
+			...versionIdMarker && { VersionIdMarker: versionIdMarker }
+		}));
+		const entries = [...page.Versions ?? [], ...page.DeleteMarkers ?? []].filter((v) => v.Key).map((v) => ({
+			Key: v.Key,
+			...v.VersionId && { VersionId: v.VersionId }
+		}));
+		if (entries.length > 0) {
+			const failures = ((await s3Client.send(new DeleteObjectsCommand({
+				Bucket: bucket,
+				ExpectedBucketOwner: accountId,
+				Delete: {
+					Objects: entries,
+					Quiet: true
+				}
+			}))).Errors ?? []).map((e) => `${e.Key ?? "<unknown>"} (${e.Code ?? "Error"}: ${e.Message ?? ""})`);
+			if (failures.length > 0) throw new CdkdError(`Failed to delete ${failures.length} object(s) from ${label.toLowerCase()} '${bucket}': ${failures.join("; ")}`, "BUCKET_EMPTY_FAILED");
+		}
+		keyMarker = page.IsTruncated ? page.NextKeyMarker : void 0;
+		versionIdMarker = page.IsTruncated ? page.NextVersionIdMarker : void 0;
+	} while (keyMarker || versionIdMarker);
+	await s3Client.send(new DeleteBucketCommand({
+		Bucket: bucket,
+		ExpectedBucketOwner: accountId
+	}));
+	logger.info(`✓ Deleted ${label.toLowerCase()}: ${bucket}`);
+	return true;
+}
+/**
+* Force-delete the container-asset ECR repository. Missing repo is an
+* idempotent skip with an info line.
+*/
+async function deleteContainerRepo(containerRepo, region, profile, logger) {
+	const ecrClient = new ECRClient({
+		region,
+		...profile && { profile }
+	});
+	try {
+		await ecrClient.send(new DeleteRepositoryCommand({
+			repositoryName: containerRepo,
+			force: true
+		}));
+		logger.info(`✓ Deleted container-asset ECR repository: ${containerRepo}`);
+	} catch (error) {
+		if (error.name === "RepositoryNotFoundException") logger.info(`Container-asset repository ${containerRepo} does not exist — skipping`);
+		else throw normalizeAwsError(error, { operation: "DeleteRepository" });
+	} finally {
+		ecrClient.destroy();
+	}
+}
+/**
+* List OTHER regions that still have a bootstrap marker in the state
+* bucket (i.e. are still opted in to cdkd asset storage).
+*/
+async function listOtherBootstrapRegions(stateBackend, region) {
+	return (await stateBackend.listRawKeys(BOOTSTRAP_MARKER_PREFIX)).filter((k) => k.endsWith(".json")).map((k) => k.slice(BOOTSTRAP_MARKER_PREFIX.length, -5)).filter((r) => r.length > 0 && r !== region);
+}
+/**
+* `cdkd bootstrap --destroy` implementation. Dispatched from the bootstrap
+* command action when `--destroy` is passed.
+*/
+async function bootstrapDestroyCommand(options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	logger.info("Starting cdkd bootstrap --destroy...");
+	logger.debug("Options:", options);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region
+	});
+	const awsClients = new AwsClients({
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile }
+	});
+	setAwsClients(awsClients);
+	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
+	const markerS3Client = new S3Client({
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	const stateBackend = new S3StateBackend(markerS3Client, {
+		bucket: bucketName,
+		prefix: STATE_PREFIX
+	}, {
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	try {
+		const markerKey = getBootstrapMarkerKey(region);
+		let markerBody;
+		try {
+			markerBody = await stateBackend.getRawObject(markerKey);
+		} catch (error) {
+			if (error.name === "NoSuchBucket") {
+				logger.info(`State bucket '${bucketName}' does not exist — this account/region was never bootstrapped; nothing to delete.`);
+				return;
+			}
+			throw error;
+		}
+		let marker;
+		if (markerBody === null) {
+			logger.info(`No bootstrap marker for region '${region}' (${markerKey}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
+			if (!options.includeStateBucket) {
+				logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
+				return;
+			}
+		} else marker = parseBootstrapMarker(markerBody, markerKey);
+		if (marker && !options.force) {
+			logger.info("Scanning stack state for references to the asset storage...");
+			const referencing = await scanStateReferences(stateBackend, [marker.assetBucket, marker.containerRepo]);
+			if (referencing.length > 0) throw new CdkdError(`Refusing to destroy asset storage for region '${region}': ${referencing.length} deployed stack(s) still reference '${marker.assetBucket}' / '${marker.containerRepo}':\n` + referencing.map((s) => `  - ${s}`).join("\n") + "\nDestroy (or re-deploy off the storage) these stacks first, or pass --force to delete anyway.", "ASSET_STORAGE_IN_USE");
+		}
+		if (options.includeStateBucket) {
+			const stateKeys = await listAllStateKeys(stateBackend);
+			if (stateKeys.length > 0) {
+				const listing = stateKeys.map((k) => `  - ${describeStateKey(k)}  [${k}]`).join("\n");
+				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
+			}
+			const otherRegions = await listOtherBootstrapRegions(stateBackend, region);
+			if (otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+		}
+		const planLines = [];
+		if (marker) {
+			planLines.push(`Asset bucket: s3://${marker.assetBucket} (region ${region}, all contents)`);
+			planLines.push(`Container-asset ECR repository: ${marker.containerRepo} (region ${region}, all images)`);
+			planLines.push(`Bootstrap marker: s3://${bucketName}/${markerKey} (deleted last)`);
+		}
+		if (options.includeStateBucket) planLines.push(`State bucket: s3://${bucketName} (ALL contents, including all versions)`);
+		if (!await promptBootstrapDestroyConfirm({
+			planLines,
+			yes: options.yes
+		})) {
+			logger.info("Bootstrap teardown cancelled — nothing deleted.");
+			return;
+		}
+		if (marker) {
+			await emptyAndDeleteBucket(awsClients.s3, marker.assetBucket, accountId, "Asset bucket", logger);
+			await deleteContainerRepo(marker.containerRepo, region, options.profile, logger);
+			await stateBackend.deleteRawObjects([markerKey]);
+			logger.info(`✓ Deleted bootstrap marker (${markerKey})`);
+			logger.info(`\ncdkd asset storage is now OFF for region ${region}: future deploys in this region fall back to legacy mode (CDK bootstrap destinations) unless the region is bootstrapped again.`);
+		}
+		if (options.includeStateBucket) {
+			const rebuiltStateBucketClient = await rebuildClientForBucketRegion(awsClients.s3, bucketName, { ...options.profile && { profile: options.profile } });
+			try {
+				await emptyAndDeleteBucket(rebuiltStateBucketClient ?? awsClients.s3, bucketName, accountId, "State bucket", logger);
+			} finally {
+				rebuiltStateBucketClient?.destroy();
+			}
+		}
+		logger.info("\n✓ Bootstrap teardown completed");
+	} finally {
+		markerS3Client.destroy();
+		awsClients.destroy();
+	}
+}
+
 //#endregion
 //#region src/cli/commands/bootstrap.ts
 /**
@@ -651,7 +957,10 @@ async function bootstrapCommand(options) {
 	try {
 		let bucketExists = false;
 		try {
-			await stateBucketS3.send(new HeadBucketCommand({ Bucket: bucketName }));
+			await stateBucketS3.send(new HeadBucketCommand({
+				Bucket: bucketName,
+				ExpectedBucketOwner: accountId
+			}));
 			bucketExists = true;
 			logger.info(`Bucket ${bucketName} already exists`);
 		} catch (error) {
@@ -682,12 +991,14 @@ async function bootstrapCommand(options) {
 			logger.debug("Enabling bucket versioning...");
 			await stateBucketS3.send(new PutBucketVersioningCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				VersioningConfiguration: { Status: "Enabled" }
 			}));
 			logger.info("✓ Enabled bucket versioning");
 			logger.debug("Enabling bucket encryption...");
 			await stateBucketS3.send(new PutBucketEncryptionCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				ServerSideEncryptionConfiguration: { Rules: [{
 					ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 					BucketKeyEnabled: true
@@ -708,6 +1019,7 @@ async function bootstrapCommand(options) {
 			};
 			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				Policy: JSON.stringify(bucketPolicy)
 			}));
 			logger.info("✓ Set bucket policy (deny external access)");
@@ -764,7 +1076,24 @@ async function bootstrapCommand(options) {
 * Create bootstrap command
 */
 function createBootstrapCommand() {
-	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating the S3 state bucket plus cdkd-owned asset storage (asset bucket + container-asset ECR repo) for the region").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Force reconfiguration of existing bucket", false).option("--no-assets", "Skip cdkd asset storage (asset bucket / ECR repo / marker) — deploys keep publishing assets to the CDK bootstrap bucket/repo").addOption(new Option("--region <region>", "AWS region in which to create the state bucket (defaults to AWS_REGION env or us-east-1)")).action(withErrorHandling(bootstrapCommand));
+	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating the S3 state bucket plus cdkd-owned asset storage (asset bucket + container-asset ECR repo) for the region. With --destroy, tear down the region's asset storage instead (issue #1010).").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Create: force reconfiguration of an existing bucket. Destroy: delete the asset storage even when deployed stacks still reference it", false).option("--no-assets", "Skip cdkd asset storage (asset bucket / ECR repo / marker) — deploys keep publishing assets to the CDK bootstrap bucket/repo").option("--destroy", "Tear down the region's cdkd asset storage (empty + delete the asset bucket, force-delete the container-asset ECR repo, then delete the bootstrap marker last). The state bucket is kept unless --include-state-bucket is also passed", false).option("--include-state-bucket", "With --destroy: also delete the S3 state bucket. Refused while any stack state exists or any other region is still opted in to asset storage", false).addOption(new Option("--region <region>", "AWS region in which to create the state bucket (defaults to AWS_REGION env or us-east-1)")).action(withErrorHandling(async (options) => {
+		if (options.destroy) {
+			if (!options.assets) throw new CdkdError("--no-assets cannot be combined with --destroy. The teardown scope is the asset storage itself; use --include-state-bucket to also delete the state bucket.", "INVALID_OPTIONS");
+			await bootstrapDestroyCommand({
+				...options.stateBucket && { stateBucket: options.stateBucket },
+				...options.region && { region: options.region },
+				...options.profile && { profile: options.profile },
+				...options.roleArn && { roleArn: options.roleArn },
+				force: options.force,
+				includeStateBucket: options.includeStateBucket,
+				yes: options.yes,
+				verbose: options.verbose
+			});
+			return;
+		}
+		if (options.includeStateBucket) throw new CdkdError("--include-state-bucket requires --destroy (it opts the state bucket into the teardown).", "INVALID_OPTIONS");
+		await bootstrapCommand(options);
+	}));
 	commonOptions.forEach((opt) => cmd.addOption(opt));
 	return cmd;
 }
@@ -1526,7 +1855,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.235.0";
+	return "0.236.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -2157,6 +2486,14 @@ var ExportIndexStore = class {
 	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
 	* is skipped and the original client is used unchanged.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call (squatting
+	* hardening — see src/utils/expected-bucket-owner.ts). Best-effort:
+	* resolves to an empty object for non-standard clients (test doubles).
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async ensureClientForBucket() {
 		if (this.clientResolved) return;
 		if (this.resolveInFlight) return this.resolveInFlight;
@@ -2302,6 +2639,7 @@ var ExportIndexStore = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
+				...await this.ownerParam(),
 				Key: this.indexKey()
 			}));
 			return {
@@ -2318,6 +2656,7 @@ var ExportIndexStore = class {
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
+			...await this.ownerParam(),
 			Key: this.indexKey(),
 			Body: body,
 			ContentLength: Buffer.byteLength(body),
@@ -41938,6 +42277,8 @@ async function stateMigrateCommand(options) {
 					await newS3.send(new CopyObjectCommand({
 						Bucket: newBucket,
 						Key: obj.Key,
+						...await expectedOwnerParam(newS3),
+						ExpectedSourceBucketOwner: accountId,
 						CopySource: encodeURIComponent(`${legacyBucket}/${obj.Key}`)
 					}));
 					copied++;
@@ -41951,7 +42292,10 @@ async function stateMigrateCommand(options) {
 					logger.info(`Emptying source bucket ${legacyBucket} (all versions + delete markers)...`);
 					await emptyBucketAllVersions(legacyS3, legacyBucket);
 					logger.info(`Deleting source bucket ${legacyBucket}...`);
-					await legacyS3.send(new DeleteBucketCommand({ Bucket: legacyBucket }));
+					await legacyS3.send(new DeleteBucketCommand({
+						Bucket: legacyBucket,
+						...await expectedOwnerParam(legacyS3)
+					}));
 					logger.info(`✓ Deleted source bucket: ${legacyBucket}`);
 				} else logger.info(`Source bucket ${legacyBucket} kept. Pass --remove-legacy on a future run to delete it.`);
 				logger.info(`✓ Migration complete: ${legacyBucket} -> ${newBucket}`);
@@ -41967,7 +42311,10 @@ async function stateMigrateCommand(options) {
 }
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new HeadBucketCommand({
+			Bucket: bucketName,
+			...await expectedOwnerParam(s3)
+		}));
 		return true;
 	} catch (error) {
 		const err = error;
@@ -41983,6 +42330,7 @@ async function listAllObjects(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...continuationToken && { ContinuationToken: continuationToken }
 		}));
 		if (resp.Contents) all.push(...resp.Contents);
@@ -42025,10 +42373,12 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	logger.info(`✓ Created destination bucket: ${bucketName}`);
 	await s3.send(new PutBucketVersioningCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		VersioningConfiguration: { Status: "Enabled" }
 	}));
 	await s3.send(new PutBucketEncryptionCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		ServerSideEncryptionConfiguration: { Rules: [{
 			ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 			BucketKeyEnabled: true
@@ -42036,6 +42386,7 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	}));
 	await s3.send(new PutBucketPolicyCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		Policy: JSON.stringify({
 			Version: "2012-10-17",
 			Statement: [{
@@ -42062,6 +42413,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectVersionsCommand({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...keyMarker && { KeyMarker: keyMarker },
 			...versionIdMarker && { VersionIdMarker: versionIdMarker }
 		}));
@@ -42078,6 +42430,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 			const batch = ids.slice(i, i + 1e3);
 			await s3.send(new DeleteObjectsCommand({
 				Bucket: bucket,
+				...await expectedOwnerParam(s3),
 				Delete: {
 					Objects: batch,
 					Quiet: true
@@ -45314,7 +45667,10 @@ function formatBucketSource(source) {
 */
 async function detectBucketRegion(awsClients, bucket) {
 	try {
-		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({ Bucket: bucket }))).LocationConstraint;
+		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({
+			Bucket: bucket,
+			...await expectedOwnerParam(awsClients.s3)
+		}))).LocationConstraint;
 		if (!constraint) return "us-east-1";
 		if (constraint === "EU") return "eu-west-1";
 		return constraint;
@@ -45362,7 +45718,8 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 	try {
 		const resp = await awsClients.s3.send(new GetObjectCommand({
 			Bucket: bucket,
-			Key: keys[0]
+			Key: keys[0],
+			...await expectedOwnerParam(awsClients.s3)
 		}));
 		if (!resp.Body) return "unknown";
 		const body = await resp.Body.transformToString();
@@ -45397,7 +45754,8 @@ async function listAssetStorageMarkers(awsClients, bucket) {
 		try {
 			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
 				Bucket: bucket,
-				Key: key
+				Key: key,
+				...await expectedOwnerParam(awsClients.s3)
 			}))).Body?.transformToString() ?? "", key);
 			entries.push({
 				region,
@@ -56046,7 +56404,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.235.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.236.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());