@go-to-k/cdkd 0.284.24 → 0.284.26

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as disableInstanceApiTermination, $n as NestedStackChildDirectDestroyError, $t as ensureAssetStorage, A as isStatefulRecreateTargetSync, An as uploadCfnTemplate, At as s3BucketWebsiteUrl, B as collectPublishedOutputNames, Bn as getAwsClients, Bt as rebuildClientForBucketRegion, C as createPreDeleteFinalSnapshot, Cn as resolveUseCdkBootstrapAssets, Ct as maskSecretsInText, D as makeCanonicalizePropertiesFn, Dn as CFN_TEMPLATE_URL_LIMIT, Dt as s3BucketDomainName, E as unsupportedFinalSnapshotError, En as CFN_TEMPLATE_BODY_LIMIT, Et as s3BucketArn, F as gray, Fn as AssemblyReader, Ft as withRetry, G as IAMRoleProvider, Gt as buildAssetRedirectMap, H as isExportAliasCollision, Hn as setAwsClients, Ht as AssetPublisher, I as green, In as processStackMessages, It as DagBuilder, J as ProviderRegistry, Jn as LocalInvokeBuildError$1, Jt as rewriteTemplateAssetReferences, K as collectInlinePolicyNamesManagedBySiblings, Kt as createAssetRedirectResolver, L as red, Lt as TemplateParser, M as formatResourceLine, Mn as PARTITION_TABLE, Mt as DiffCalculator, N as bold, Nn as canonicalizeRegion, Nt as INTRINSIC_KEYS, O as extractDeploymentEventError, On as MIGRATE_TMP_PREFIX, Ot as s3BucketDualStackDomainName, P as cyan, Pn as derivePartitionAndUrlSuffix, Pt as describeTypeWithThrottleRetry, Q as slowCcOperationTimeoutMs, Qn as MissingCdkCliError, Qt as BOOTSTRAP_MARKER_PREFIX, R as yellow, Rn as resolveBucketRegion, Rt as LockManager, S as ccRoutedFinalSnapshotError, Sn as resolveStateBucketWithDefaultAndSource, St as isSingleDynamicReferenceToken, T as refusesFinalSnapshot, Tn as warnDeprecatedNoPrefixCliFlag, Tt as scrubResourceRecord, U as secretBearingStateKeyWarning, Ut as stringifyValue, V as exportAliasCollisionScrubWarning, Vn as resetAwsClients, Vt as shouldRetainResource, W as stateKeySecretExposure, Wn as CdkdError, Wt as WorkGraph, X as findSilentDropProperties, Xn as LocalStartServiceError, Xt as stripControlChars, Y as findActionableSilentDrops, Yn as LocalMigrateError, Yt as escapeRegExp, Z as CloudControlProvider, Zt as AssetModeResolver, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as resolveApp, _t as STATE_SOURCED_CROSS_GENERATION_RULES, a as DeploymentEventsStore, an as buildDenyExternalAccessPolicy, ar as StackTerminationProtectionError, at as WAFv2WebACLProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bn as resolveSkipPrefix, bt as createSecretMasker, c as producerRegionsFromState, cn as getDockerCmd, ct as assertRegionMatch, d as updatePartialMessage, dn as AssetManifestLoader, dr as withErrorHandling, dt as configStringRefusal, en as getBootstrapMarkerKey, er as PartialFailureError, et as isTerminationProtectionPropagationError, f as updatePartialReason, fn as getDockerImageBySourceHash, fr as isMarkedNonRetryable, ft as readConfigString, g as maskingRetryLogger, gn as getLegacyStateBucketName, gt as requireConfigString, h as withResourceDeadline, hn as getDefaultStateBucketName, hr as markNonRetryable, ht as requireConfigObject, i as DeploymentEventsReader, in as validateContainerRepoName, ir as StackHasActiveImportsError, it as refStateLookupFromResource, j as renderStatefulReason, jn as expectedOwnerParam, jt as applyRoleArnIfSet, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as findLargeInlineResources, kt as s3BucketRegionalDomainName, l as replayFailedOperations, ln as runDockerForeground, lt as coerceCfnBoolean, m as deleteSkipReason, mn as synthesisStatusMessage, mr as isThrottlingError, mt as requireConfigArray, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as readBootstrapMarkerBody, nr as ResourceTimeoutError, nt as cfnRefValueFromPhysicalId, o as planFailedOps, on as buildDockerImage, ot as normalizeAwsTagsToCfn, p as UNSPECIFIED_SKIP_REASON, pn as Synthesizer, pr as isRetryableTransientError, pt as replayWarn, q as clearOnUpdateRemoval, qn as DeployCancelledError, qt as loadPublishableAssetManifest, r as DeployEngine, rn as validateAssetBucketName, rr as ResourceUpdateNotSupportedError, rt as getAccountInfo, s as planRollback, sn as formatDockerLoginError, st as resolveExplicitPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as parseBootstrapMarker, tr as ProvisioningError, tt as IntrinsicFunctionResolver, u as replayRollback, un as runDockerStreaming, ur as normalizeAwsError, ut as configBooleanRefusal, v as computeImplicitDeleteEdges, vn as resolveAutoAssetStorage, vt as STATE_SOURCED_READBACK_RULES, w as isFinalSnapshotError, wn as stateBucketExistenceConfirmed, wt as redactSecretsForState, x as buildFinalSnapshotIdentifier, xn as resolveStateBucketWithDefault, xt as dynamicReferenceTokens, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as resolveCaptureObservedState, yt as TEMPLATE_SOURCED_RULES, z as collectDeclaredOutputNames, zn as AwsClients, zt as S3StateBackend } from "./deploy-engine-BJQbni1s.js";
+import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-DNCs229s.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Bh0odlSk.js";
+import { t as ASGProvider } from "./asg-provider-CS5j-5z6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -865,6 +865,165 @@ function namedCliRegion(optionRegion) {
 function rawCliRegion(optionRegion) {
 	return optionRegion || process.env["AWS_REGION"] || void 0;
 }
+/**
+* The region a command OPERATES on.
+*
+* Order: `--region` -> `AWS_REGION` -> `AWS_DEFAULT_REGION` -> the region the
+* AWS SDK's own chain resolves (i.e. the selected profile's `region =` line)
+* -> `us-east-1`.
+*
+* The profile step is what issue
+* [#2029](https://github.com/go-to-k/cdkd/issues/2029) adds, and it removes an
+* incoherence rather than adding a preference. cdkd ALREADY consulted the
+* profile: every command builds its pre-flight bag as
+* `new AwsClients({ ...(options.region && { region }) })`, so with no flag the
+* bag is region-less and the SDK resolves the profile. Only the region VALUE -
+* the one that keys the state file, keys the bootstrap marker and answers
+* `AWS::Region` in every user template - fell back to the literal. Measured on
+* an env-agnostic stack with `region = ap-northeast-1` in the profile and no
+* flag or env var:
+*
+* ```text
+* State bucket '...' is in 'us-east-1' (client was 'ap-northeast-1'); rebuilding S3 client.
+* Getting state for stack: CdkdBasicExample (us-east-1)
+* Resolved Ref to pseudo parameter: AWS::Region -> us-east-1
+* ```
+*
+* One command, two regions: the pre-flight talked to the profile's region
+* while the resources, their ARNs and their state landed in us-east-1. Only an
+* ENV-AGNOSTIC stack is affected - a stack with `env: { region }` pinned in CDK
+* carries its own region through the Cloud Assembly and never reaches this
+* fallback (`assembly-reader.ts` maps CDK's `unknown-region` to `undefined`).
+*
+* `AWS_DEFAULT_REGION` sits between `AWS_REGION` and the profile because the
+* AWS CLI honours it and the JS SDK does NOT (measured: with only that variable
+* set, `STSClient({}).config.region()` returns the PROFILE's region, not the
+* variable's). Reading it here is what stops cdkd disagreeing with the CLI a
+* user just ran.
+*
+* Returning the SOURCE, not just the region, is what lets a caller tell "the
+* user asked for this region" from "we inferred it" - which is the difference
+* that decides whether the reconciliation in
+* {@link reconcileRegionWithLegacyDefault} may move the answer back.
+*/
+async function resolveEffectiveRegion(options) {
+	const flag = canonicalizeRegion(options.region);
+	if (flag) return {
+		region: flag,
+		source: "flag"
+	};
+	const awsRegion = canonicalizeRegion(process.env["AWS_REGION"]);
+	if (awsRegion) return {
+		region: awsRegion,
+		source: "env"
+	};
+	const defaultRegionEnv = canonicalizeRegion(process.env["AWS_DEFAULT_REGION"]);
+	if (defaultRegionEnv) return {
+		region: defaultRegionEnv,
+		source: "default-env"
+	};
+	const fromProfile = canonicalizeRegion(await resolveSdkDefaultRegion(options.profile));
+	if (fromProfile) return {
+		region: fromProfile,
+		source: "profile"
+	};
+	return {
+		region: LEGACY_DEFAULT_REGION,
+		source: "default"
+	};
+}
+/**
+* The region cdkd used to fall back to before issue #2029, and still falls
+* back to when nothing at all answers.
+*
+* Named rather than inlined because the reconciliation below has to ask
+* "is there state under the OLD default?", and that question only means
+* something while the two are the same constant.
+*/
+const LEGACY_DEFAULT_REGION = "us-east-1";
+/**
+* Ask the AWS SDK's own chain which region it would use.
+*
+* A throwaway client, sampled once and destroyed: `src/utils/aws-clients.ts`
+* is explicit that a region-less bag's lazy members resolve independently and
+* need not agree with each other, so nothing here is reused for real work.
+* Returns `undefined` rather than throwing when the chain answers nothing -
+* a client with no resolvable region REJECTS, and that rejection is the normal
+* "no region configured" signal rather than an error worth surfacing.
+*/
+async function resolveSdkDefaultRegion(profile) {
+	const { STSClient } = await import("@aws-sdk/client-sts");
+	let client;
+	try {
+		client = new STSClient({ ...profile && { profile } });
+		return await client.config.region() || void 0;
+	} catch {
+		return;
+	} finally {
+		client?.destroy?.();
+	}
+}
+/**
+* The marker-key twin of {@link reconcileRegionWithLegacyDefault}.
+*
+* `cdkd bootstrap` WRITES `cdkd-bootstrap/{region}.json`; `cdkd gc` and
+* `cdkd bootstrap --destroy` READ it. Issue
+* [#2029](https://github.com/go-to-k/cdkd/issues/2029) moves what `{region}`
+* resolves to when the user names none, and a previous attempt at it moved the
+* READ side alone — which silently broke that pairing: for a user with a
+* non-us-east-1 profile, `cdkd gc` reported "not opted in" and the teardown
+* "nothing to delete" while the asset bucket and ECR repo stayed alive and
+* billing. So all three commands resolve through THIS function, and the pairing
+* holds by construction rather than by three call sites agreeing.
+*
+* The reconciliation itself is the same rule as the state-key one: an inferred
+* region yields to an existing marker under the old default, a named region
+* never does, and a first bootstrap goes to the profile's region because there
+* is nothing to strand.
+*
+* Note this is deliberately NOT `readBootstrapMarkerBody`: that helper answers
+* "read the marker for THIS region, trying both spellings", which is a
+* different question and would conflate a case difference with a region
+* difference. Here both probes use the canonical key, because the question is
+* only which REGION owns a marker.
+*/
+async function reconcileMarkerRegionWithLegacyDefault(input) {
+	const { effective, probe, markerKeyFor, logger } = input;
+	if (!regionNeedsReconciliation(effective)) return effective.region;
+	const markerExists = async (region) => {
+		try {
+			return await probe.getRawObject(markerKeyFor(region)) !== null;
+		} catch (error) {
+			if (error.name !== "NoSuchBucket") throw error;
+			logger.debug(`[region] no state bucket yet, so no bootstrap marker for ${region} (first bootstrap).`);
+			return false;
+		}
+	};
+	if (await markerExists(effective.region)) {
+		logger.debug(`[region] asset storage exists in ${effective.region} (from your AWS profile); using it.`);
+		return effective.region;
+	}
+	if (!await markerExists("us-east-1")) return effective.region;
+	logger.info(`cdkd asset storage exists in ${LEGACY_DEFAULT_REGION}, but your AWS profile resolves ${effective.region}. Continuing to use ${LEGACY_DEFAULT_REGION} so the existing storage is not orphaned. Pass '--region ${effective.region}' to target your profile's region, or '--region ${LEGACY_DEFAULT_REGION}' to silence this message.`);
+	return LEGACY_DEFAULT_REGION;
+}
+/**
+* Whether {@link resolveEffectiveRegion}'s answer is subject to the
+* reconciliation — i.e. whether cdkd INFERRED it rather than being told.
+*
+* `flag` and `env` (`AWS_REGION`) are the user speaking, and are obeyed as
+* given. `default-env` (`AWS_DEFAULT_REGION`) is NOT: cdkd never read that
+* variable before, so acting on it is a new inference. `default` is already
+* the legacy region, so there is nothing to reconcile against.
+*
+* Exported so a caller can skip CONSTRUCTING a probe client it will not use —
+* the reconciliation functions return early on the same condition, but by then
+* the caller has already paid for an S3 client and a state backend.
+*/
+function regionNeedsReconciliation(effective) {
+	if (effective.source === "flag" || effective.source === "env") return false;
+	return effective.region !== LEGACY_DEFAULT_REGION;
+}
 
 //#endregion
 //#region src/cli/commands/state-file-keys.ts
@@ -1159,15 +1318,43 @@ async function bootstrapDestroyCommand(options) {
 		roleArn: options.roleArn,
 		region: namedCliRegion(options.region)
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	const effective = await resolveEffectiveRegion(options);
+	const accountClients = new AwsClients({
+		region: effective.region,
+		...options.profile && { profile: options.profile }
+	});
+	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
+	let region = effective.region;
+	if (regionNeedsReconciliation(effective)) {
+		const probeBackend = new S3StateBackend(new S3Client({
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		}), {
+			bucket: bucketName,
+			prefix: STATE_PREFIX
+		}, {
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		});
+		try {
+			region = await reconcileMarkerRegionWithLegacyDefault({
+				effective,
+				probe: probeBackend,
+				markerKeyFor: getBootstrapMarkerKey,
+				logger
+			});
+		} finally {
+			probeBackend.destroyClient();
+		}
+	}
 	const rawRegion = rawCliRegion(options.region) ?? region;
-	const awsClients = new AwsClients({
+	const awsClients = region === effective.region ? accountClients : new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
 	});
+	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
-	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
-	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
 		region,
 		...options.profile && { profile: options.profile }
@@ -1291,19 +1478,19 @@ async function bootstrapCommand(options) {
 	if (options.verbose) logger.setLevel("debug");
 	logger.info("Starting cdkd bootstrap...");
 	logger.debug("Options:", options);
-	const rawRegion = rawCliRegion(options.region) ?? "us-east-1";
+	const rawRegion = rawCliRegion(options.region);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+	const effective = await resolveEffectiveRegion(options);
+	let awsClients = new AwsClients({
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const s3Client = awsClients.s3;
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	let s3Client = awsClients.s3;
 	let bucketName;
 	let accountId;
 	if (options.stateBucket) {
@@ -1315,6 +1502,39 @@ async function bootstrapCommand(options) {
 		bucketName = getDefaultStateBucketName(accountId);
 		logger.info(`Using default state bucket: ${bucketName}`);
 	}
+	let region = effective.region;
+	if (regionNeedsReconciliation(effective)) {
+		const probeBackend = new S3StateBackend(new S3Client({
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		}), {
+			bucket: bucketName,
+			prefix: "cdkd"
+		}, {
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		});
+		try {
+			region = await reconcileMarkerRegionWithLegacyDefault({
+				effective,
+				probe: probeBackend,
+				markerKeyFor: getBootstrapMarkerKey,
+				logger
+			});
+		} finally {
+			probeBackend.destroyClient();
+		}
+	}
+	if (region !== effective.region) {
+		const held = new AwsClients({
+			region,
+			...options.profile && { profile: options.profile }
+		});
+		awsClients.destroy();
+		awsClients = held;
+		setAwsClients(awsClients);
+		s3Client = awsClients.s3;
+	}
 	const rebuiltStateBucketClient = await rebuildClientForBucketRegion(s3Client, bucketName, { ...options.profile && { profile: options.profile } });
 	const stateBucketS3 = rebuiltStateBucketClient ?? s3Client;
 	try {
@@ -1401,7 +1621,7 @@ async function bootstrapCommand(options) {
 					ecrClient,
 					stateBackend,
 					accountId,
-					region: rawRegion,
+					region: rawRegion ?? region,
 					force: options.force,
 					...options.assetBucket && { assetBucketName: options.assetBucket },
 					...options.containerRepo && { containerRepoName: options.containerRepo }
@@ -1774,6 +1994,7 @@ function createListCommand() {
 * handler of its own).
 */
 function forwardSigtermToSigint() {
+	beginCommandInterruptScope();
 	const handler = () => {
 		if (process.listenerCount("SIGINT") === 0) process.exit(143);
 		process.emit("SIGINT", "SIGINT");
@@ -1781,6 +2002,7 @@ function forwardSigtermToSigint() {
 	process.on("SIGTERM", handler);
 	return () => {
 		process.removeListener("SIGTERM", handler);
+		endCommandInterruptScope();
 	};
 }
 
@@ -14839,28 +15061,37 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
 	const budgetWait = opts.budgetWait;
+	const watch = startInterruptWatch(`index settle wait on ${tableName}`);
 	let attempt = 0;
-	while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
-		attempt += 1;
-		try {
-			if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isThrottlingError(err)) {
-				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-				await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-				continue;
+	try {
+		while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+			attempt += 1;
+			if (watch.isInterrupted()) {
+				logger.debug(`Interrupted while waiting for indexes on ${tableName} (${logicalId}) after ${attempt - 1} DescribeTable polls; ${proceedNote}`);
+				return;
 			}
-			if (err instanceof ResourceNotFoundException$1) {
-				logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+			try {
+				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				if (isThrottlingError(err)) {
+					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+					continue;
+				}
+				if (err instanceof ResourceNotFoundException$1) {
+					logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+					return;
+				}
+				const errorName = err instanceof Error ? err.name : typeof err;
+				logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
+				logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
 				return;
 			}
-			const errorName = err instanceof Error ? err.name : typeof err;
-			logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
-			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
-			return;
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
-		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+	} finally {
+		watch.dispose();
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
 	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
@@ -14965,24 +15196,31 @@ function indexBusyRetryWarning(opts) {
 */
 async function deleteTableWithIndexBusyRetry(opts) {
 	let deleteAttempts = 0;
-	await withRetry(async () => {
-		if (deleteAttempts++ > 0) {
-			if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
-				typeLabel: opts.typeLabel,
-				logicalId: opts.logicalId,
-				physicalId: opts.physicalId,
-				attemptNumber: deleteAttempts,
-				maxRetries: opts.maxRetries
-			}));
-			await opts.reArm();
-		}
-		await opts.deleteTable();
-	}, opts.logicalId, {
-		maxRetries: opts.maxRetries,
-		isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
-		logger: opts.logger,
-		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
-	});
+	const watch = startInterruptWatch(`DynamoDB ${opts.typeLabel} ${opts.logicalId} delete`);
+	try {
+		await withRetry(async () => {
+			if (deleteAttempts++ > 0) {
+				if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+					typeLabel: opts.typeLabel,
+					logicalId: opts.logicalId,
+					physicalId: opts.physicalId,
+					attemptNumber: deleteAttempts,
+					maxRetries: opts.maxRetries
+				}));
+				await opts.reArm();
+			}
+			await opts.deleteTable();
+		}, opts.logicalId, {
+			maxRetries: opts.maxRetries,
+			isRetryable: (message) => isIndexBusyDeleteError(message) && (opts.shouldKeepRetrying?.() ?? true),
+			logger: opts.logger,
+			isInterrupted: watch.isInterrupted,
+			onInterrupted: watch.onInterrupted,
+			sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+		});
+	} finally {
+		watch.dispose();
+	}
 }
 
 //#endregion
@@ -18658,94 +18896,111 @@ var DynamoDBGlobalTableProvider = class {
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
 		if (!oldEnabled && !newEnabled) return;
-		if (newEnabled) {
-			const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
-			const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
-			if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
-				warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
+		try {
+			if (newEnabled) {
+				const minCapacity = Number(newSettings["MinCapacity"] ?? 0);
+				const maxCapacity = Number(newSettings["MaxCapacity"] ?? 0);
+				if (!Number.isFinite(minCapacity) || !Number.isFinite(maxCapacity)) {
+					warn(`Cannot apply auto-scaling diff on ${tableName} (${dimension}): MinCapacity / MaxCapacity must be numbers, got ${maskSecrets(String(newSettings["MinCapacity"]))} / ${maskSecrets(String(newSettings["MaxCapacity"]))}`);
+					return;
+				}
+				try {
+					await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						MinCapacity: minCapacity,
+						MaxCapacity: maxCapacity
+					})), `${resourceId} (${dimension})`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
+					return;
+				}
+				const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
+				const targetValue = Number(tttCfg["TargetValue"]);
+				if (!Number.isFinite(targetValue)) {
+					warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
+					return;
+				}
+				const targetTrackingConfig = {
+					PredefinedMetricSpecification: { PredefinedMetricType: metricType },
+					TargetValue: targetValue
+				};
+				if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
+				if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
+				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
+				try {
+					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
+						PolicyName: policyName,
+						ServiceNamespace: "dynamodb",
+						ResourceId: resourceId,
+						ScalableDimension: dimension,
+						PolicyType: "TargetTrackingScaling",
+						TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
+					})), `${policyName}`, {
+						isRetryable: (_message, error) => isThrottlingError(error),
+						maxRetries: asMaxRetries,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted,
+						...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
+					});
+					this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				} catch (err) {
+					if (isInterruptedWaitError(err)) throw err;
+					warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				}
 				return;
 			}
+			const isObjectNotFound = (err) => {
+				if (!(err instanceof Error)) return false;
+				const name = err.name ?? "";
+				const msg = err.message ?? "";
+				return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
+			};
 			try {
-				await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
+				await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
+					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					MinCapacity: minCapacity,
-					MaxCapacity: maxCapacity
+					ScalableDimension: dimension
 				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
 			} catch (err) {
-				warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
-				return;
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
-			const targetValue = Number(tttCfg["TargetValue"]);
-			if (!Number.isFinite(targetValue)) {
-				warn(`Auto-scaling target registered on ${tableName} (${dimension}) but TargetValue is missing or non-numeric — skipping PutScalingPolicy. Provide TargetTrackingScalingPolicyConfiguration.TargetValue in the template.`);
-				return;
-			}
-			const targetTrackingConfig = {
-				PredefinedMetricSpecification: { PredefinedMetricType: metricType },
-				TargetValue: targetValue
-			};
-			if (tttCfg["ScaleInCooldown"] !== void 0) targetTrackingConfig["ScaleInCooldown"] = Number(tttCfg["ScaleInCooldown"]);
-			if (tttCfg["ScaleOutCooldown"] !== void 0) targetTrackingConfig["ScaleOutCooldown"] = Number(tttCfg["ScaleOutCooldown"]);
-			if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 			try {
-				await withRetry(() => asClient.send(new PutScalingPolicyCommand({
-					PolicyName: policyName,
+				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
-					ScalableDimension: dimension,
-					PolicyType: "TargetTrackingScaling",
-					TargetTrackingScalingPolicyConfiguration: targetTrackingConfig
-				})), `${policyName}`, {
+					ScalableDimension: dimension
+				})), `${resourceId} (${dimension})`, {
 					isRetryable: (_message, error) => isThrottlingError(error),
 					maxRetries: asMaxRetries,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
-				this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
+				this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 			} catch (err) {
-				warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+				if (isInterruptedWaitError(err)) throw err;
+				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
-			return;
-		}
-		const isObjectNotFound = (err) => {
-			if (!(err instanceof Error)) return false;
-			const name = err.name ?? "";
-			const msg = err.message ?? "";
-			return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
-		};
-		try {
-			await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
-				PolicyName: policyName,
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
-		}
-		try {
-			await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
-				ServiceNamespace: "dynamodb",
-				ResourceId: resourceId,
-				ScalableDimension: dimension
-			})), `${resourceId} (${dimension})`, {
-				isRetryable: (_message, error) => isThrottlingError(error),
-				maxRetries: asMaxRetries,
-				...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
-			});
-			this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
-		} catch (err) {
-			if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+		} finally {
+			watch.dispose();
 		}
 	}
 	/**
@@ -18943,6 +19198,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		} catch (describeErr) {
 			if (describeErr instanceof ProvisioningError) throw describeErr;
+			if (isInterruptedWaitError(describeErr)) throw describeErr;
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
 				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeErr instanceof Error ? describeErr.message : String(describeErr)}`, resourceType, logicalId, physicalId, cause);
@@ -19654,12 +19910,20 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB replica ${region} teardown on ${tableName}`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				try {
+					if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		throw new ProvisioningError(`Replica ${region} for table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
@@ -19679,12 +19943,23 @@ var DynamoDBGlobalTableProvider = class {
 	*/
 	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget) {
 		const wait = beginDeleteWait(maxAttempts, budget);
-		while (wait.nextPoll()) try {
-			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
-			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
-		} catch (err) {
-			if (err instanceof ResourceNotFoundException$1) return;
-			throw err;
+		const watch = startInterruptWatch(`DynamoDB table ${tableName} deletion wait`);
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) {
+					this.logger.warn(`DynamoDB GlobalTable ${logicalId}: interrupted while waiting for ${tableName} to disappear. AWS ACCEPTED the DeleteTable and will finish it; cdkd stopped watching.`);
+					return;
+				}
+				try {
+					await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return;
+					throw err;
+				}
+			}
+		} finally {
+			watch.dispose();
 		}
 		if (wait.cutShort) {
 			this.logger.warn(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${tableName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`);
@@ -35399,13 +35674,23 @@ var ELBv2Provider = class {
 			try {
 				const listenerAttributes = this.normalizeAttributes(properties["ListenerAttributes"]);
 				if (listenerAttributes.length > 0) {
-					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-						ListenerArn: listenerArn,
-						Attributes: listenerAttributes
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+					try {
+						await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+							ListenerArn: listenerArn,
+							Attributes: listenerAttributes
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and neither rollback nor destroy could reach it. If that delete does not complete, remove it manually: aws elbv2 delete-listener --listener-arn ${listenerArn}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
@@ -35442,10 +35727,19 @@ var ELBv2Provider = class {
 			}));
 			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
-				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
-					ListenerArn: physicalId,
-					Attributes: submittedAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+				const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
+				try {
+					await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
+						ListenerArn: physicalId,
+						Attributes: submittedAttrs
+					})), logicalId, {
+						logger: this.maskedRetryLogger(maskSecrets),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
 				this.logger.debug(`Applied ${submittedAttrs.length} ListenerAttributes change(s) for ${logicalId}`);
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
@@ -42539,16 +42833,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
-			await withRetry(async () => {
-				const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
-				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			}, logicalId, {
-				maxRetries: 24,
-				initialDelayMs: 3e3,
-				maxDelayMs: 15e3,
-				isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
-				logger: this.logger
-			});
+			const watch = startInterruptWatch(`Cloud Map namespace ${logicalId}`);
+			try {
+				await withRetry(async () => {
+					const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
+					if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+				}, logicalId, {
+					maxRetries: 24,
+					initialDelayMs: 3e3,
+					maxDelayMs: 15e3,
+					isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
+					logger: this.logger,
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted
+				});
+			} finally {
+				watch.dispose();
+			}
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
@@ -42748,13 +43049,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 				if (Object.keys(attrs).length > 0) {
-					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-						ServiceId: serviceId,
-						Attributes: attrs
-					})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
+					const watch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+					try {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: serviceId,
+							Attributes: attrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: watch.isInterrupted,
+							onInterrupted: watch.onInterrupted
+						});
+					} finally {
+						watch.dispose();
+					}
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete does not complete, remove it manually: aws servicediscovery delete-service --id ${serviceId}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
@@ -42824,19 +43135,34 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}))).OperationId;
 				if (operationId) await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
 			}
-			if (hasAttrUpsert) {
-				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: upsertAttrs
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
-			}
-			if (hasAttrRemove) {
-				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
-					ServiceId: physicalId,
-					Attributes: removedAttrKeys
-				})), logicalId, { logger: this.maskedRetryLogger(maskSecrets) });
-				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+			if (hasAttrUpsert || hasAttrRemove) {
+				const attrWatch = startInterruptWatch(`Cloud Map service ${logicalId} attributes`);
+				try {
+					if (hasAttrUpsert) {
+						await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: upsertAttrs
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
+					}
+					if (hasAttrRemove) {
+						await withRetry(() => client.send(new DeleteServiceAttributesCommand({
+							ServiceId: physicalId,
+							Attributes: removedAttrKeys
+						})), logicalId, {
+							logger: this.maskedRetryLogger(maskSecrets),
+							isInterrupted: attrWatch.isInterrupted,
+							onInterrupted: attrWatch.onInterrupted
+						});
+						this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+					}
+				} finally {
+					attrWatch.dispose();
+				}
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
 			return {
@@ -58198,7 +58524,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (!isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
+					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -58282,11 +58608,19 @@ async function runDestroyForStack(stackName, state, ctx) {
 			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, ${orphanHint} is the last resort: it removes the state record without deleting AWS resources.` + skippedClause);
 		}
 	} finally {
-		process.removeListener("SIGINT", sigintHandler);
-		renderer.stop();
-		await saveChain;
-		logger.debug("Releasing lock...");
-		await ctx.lockManager.releaseLock(stackName, regionForState);
+		try {
+			try {
+				renderer.stop();
+			} catch (rendererError) {
+				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${rendererError instanceof Error ? rendererError.message : String(rendererError)}`);
+			}
+			await saveChain;
+			logger.debug("Releasing lock...");
+			await ctx.lockManager.releaseLock(stackName, regionForState);
+		} finally {
+			process.removeListener("SIGINT", sigintHandler);
+		}
+		result.interrupted ||= draining;
 		if (destroyAwsClients) {
 			destroyAwsClients.destroy();
 			process.env["AWS_REGION"] = ctx.baseRegion;
@@ -72041,26 +72375,37 @@ async function gcCommand(options) {
 		roleArn: options.roleArn,
 		region: namedCliRegion(options.region)
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const rawRegion = rawCliRegion(options.region) ?? region;
-	const awsClients = new AwsClients({
-		region,
+	const effective = await resolveEffectiveRegion(options);
+	const accountClients = new AwsClients({
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
-	setAwsClients(awsClients);
-	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
-		region,
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
 		prefix: "cdkd"
 	}, {
+		region: effective.region,
+		...options.profile && { profile: options.profile }
+	});
+	const region = regionNeedsReconciliation(effective) ? await reconcileMarkerRegionWithLegacyDefault({
+		effective,
+		probe: stateBackend,
+		markerKeyFor: getBootstrapMarkerKey,
+		logger
+	}) : effective.region;
+	const rawRegion = rawCliRegion(options.region) ?? region;
+	const awsClients = region === effective.region ? accountClients : new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
 	});
+	if (awsClients !== accountClients) accountClients.destroy();
+	setAwsClients(awsClients);
 	const ecrClient = new ECRClient({
 		region,
 		...options.profile && { profile: options.profile }
@@ -72139,7 +72484,7 @@ async function gcCommand(options) {
 * Create the `cdkd gc` command (upstream `cdk gc` parity naming).
 */
 function createGcCommand() {
-	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc for that).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION / AWS_DEFAULT_REGION, else the profile region; refuses if none is configured)")).action(withErrorHandling(async (options) => {
+	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc for that).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION, then AWS_DEFAULT_REGION, then your AWS profile's region, then us-east-1)")).action(withErrorHandling(async (options) => {
 		await gcCommand(options);
 	}));
 	commonOptions.forEach((opt) => cmd.addOption(opt));
@@ -83914,7 +84259,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.26");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;