@go-to-k/cdkd 0.284.25 → 0.284.26

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-BpZWPiaL.js";
+import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-DNCs229s.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B2lPfJBN.js";
+import { t as ASGProvider } from "./asg-provider-CS5j-5z6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -865,6 +865,165 @@ function namedCliRegion(optionRegion) {
 function rawCliRegion(optionRegion) {
 	return optionRegion || process.env["AWS_REGION"] || void 0;
 }
+/**
+* The region a command OPERATES on.
+*
+* Order: `--region` -> `AWS_REGION` -> `AWS_DEFAULT_REGION` -> the region the
+* AWS SDK's own chain resolves (i.e. the selected profile's `region =` line)
+* -> `us-east-1`.
+*
+* The profile step is what issue
+* [#2029](https://github.com/go-to-k/cdkd/issues/2029) adds, and it removes an
+* incoherence rather than adding a preference. cdkd ALREADY consulted the
+* profile: every command builds its pre-flight bag as
+* `new AwsClients({ ...(options.region && { region }) })`, so with no flag the
+* bag is region-less and the SDK resolves the profile. Only the region VALUE -
+* the one that keys the state file, keys the bootstrap marker and answers
+* `AWS::Region` in every user template - fell back to the literal. Measured on
+* an env-agnostic stack with `region = ap-northeast-1` in the profile and no
+* flag or env var:
+*
+* ```text
+* State bucket '...' is in 'us-east-1' (client was 'ap-northeast-1'); rebuilding S3 client.
+* Getting state for stack: CdkdBasicExample (us-east-1)
+* Resolved Ref to pseudo parameter: AWS::Region -> us-east-1
+* ```
+*
+* One command, two regions: the pre-flight talked to the profile's region
+* while the resources, their ARNs and their state landed in us-east-1. Only an
+* ENV-AGNOSTIC stack is affected - a stack with `env: { region }` pinned in CDK
+* carries its own region through the Cloud Assembly and never reaches this
+* fallback (`assembly-reader.ts` maps CDK's `unknown-region` to `undefined`).
+*
+* `AWS_DEFAULT_REGION` sits between `AWS_REGION` and the profile because the
+* AWS CLI honours it and the JS SDK does NOT (measured: with only that variable
+* set, `STSClient({}).config.region()` returns the PROFILE's region, not the
+* variable's). Reading it here is what stops cdkd disagreeing with the CLI a
+* user just ran.
+*
+* Returning the SOURCE, not just the region, is what lets a caller tell "the
+* user asked for this region" from "we inferred it" - which is the difference
+* that decides whether the reconciliation in
+* {@link reconcileRegionWithLegacyDefault} may move the answer back.
+*/
+async function resolveEffectiveRegion(options) {
+	const flag = canonicalizeRegion(options.region);
+	if (flag) return {
+		region: flag,
+		source: "flag"
+	};
+	const awsRegion = canonicalizeRegion(process.env["AWS_REGION"]);
+	if (awsRegion) return {
+		region: awsRegion,
+		source: "env"
+	};
+	const defaultRegionEnv = canonicalizeRegion(process.env["AWS_DEFAULT_REGION"]);
+	if (defaultRegionEnv) return {
+		region: defaultRegionEnv,
+		source: "default-env"
+	};
+	const fromProfile = canonicalizeRegion(await resolveSdkDefaultRegion(options.profile));
+	if (fromProfile) return {
+		region: fromProfile,
+		source: "profile"
+	};
+	return {
+		region: LEGACY_DEFAULT_REGION,
+		source: "default"
+	};
+}
+/**
+* The region cdkd used to fall back to before issue #2029, and still falls
+* back to when nothing at all answers.
+*
+* Named rather than inlined because the reconciliation below has to ask
+* "is there state under the OLD default?", and that question only means
+* something while the two are the same constant.
+*/
+const LEGACY_DEFAULT_REGION = "us-east-1";
+/**
+* Ask the AWS SDK's own chain which region it would use.
+*
+* A throwaway client, sampled once and destroyed: `src/utils/aws-clients.ts`
+* is explicit that a region-less bag's lazy members resolve independently and
+* need not agree with each other, so nothing here is reused for real work.
+* Returns `undefined` rather than throwing when the chain answers nothing -
+* a client with no resolvable region REJECTS, and that rejection is the normal
+* "no region configured" signal rather than an error worth surfacing.
+*/
+async function resolveSdkDefaultRegion(profile) {
+	const { STSClient } = await import("@aws-sdk/client-sts");
+	let client;
+	try {
+		client = new STSClient({ ...profile && { profile } });
+		return await client.config.region() || void 0;
+	} catch {
+		return;
+	} finally {
+		client?.destroy?.();
+	}
+}
+/**
+* The marker-key twin of {@link reconcileRegionWithLegacyDefault}.
+*
+* `cdkd bootstrap` WRITES `cdkd-bootstrap/{region}.json`; `cdkd gc` and
+* `cdkd bootstrap --destroy` READ it. Issue
+* [#2029](https://github.com/go-to-k/cdkd/issues/2029) moves what `{region}`
+* resolves to when the user names none, and a previous attempt at it moved the
+* READ side alone — which silently broke that pairing: for a user with a
+* non-us-east-1 profile, `cdkd gc` reported "not opted in" and the teardown
+* "nothing to delete" while the asset bucket and ECR repo stayed alive and
+* billing. So all three commands resolve through THIS function, and the pairing
+* holds by construction rather than by three call sites agreeing.
+*
+* The reconciliation itself is the same rule as the state-key one: an inferred
+* region yields to an existing marker under the old default, a named region
+* never does, and a first bootstrap goes to the profile's region because there
+* is nothing to strand.
+*
+* Note this is deliberately NOT `readBootstrapMarkerBody`: that helper answers
+* "read the marker for THIS region, trying both spellings", which is a
+* different question and would conflate a case difference with a region
+* difference. Here both probes use the canonical key, because the question is
+* only which REGION owns a marker.
+*/
+async function reconcileMarkerRegionWithLegacyDefault(input) {
+	const { effective, probe, markerKeyFor, logger } = input;
+	if (!regionNeedsReconciliation(effective)) return effective.region;
+	const markerExists = async (region) => {
+		try {
+			return await probe.getRawObject(markerKeyFor(region)) !== null;
+		} catch (error) {
+			if (error.name !== "NoSuchBucket") throw error;
+			logger.debug(`[region] no state bucket yet, so no bootstrap marker for ${region} (first bootstrap).`);
+			return false;
+		}
+	};
+	if (await markerExists(effective.region)) {
+		logger.debug(`[region] asset storage exists in ${effective.region} (from your AWS profile); using it.`);
+		return effective.region;
+	}
+	if (!await markerExists("us-east-1")) return effective.region;
+	logger.info(`cdkd asset storage exists in ${LEGACY_DEFAULT_REGION}, but your AWS profile resolves ${effective.region}. Continuing to use ${LEGACY_DEFAULT_REGION} so the existing storage is not orphaned. Pass '--region ${effective.region}' to target your profile's region, or '--region ${LEGACY_DEFAULT_REGION}' to silence this message.`);
+	return LEGACY_DEFAULT_REGION;
+}
+/**
+* Whether {@link resolveEffectiveRegion}'s answer is subject to the
+* reconciliation — i.e. whether cdkd INFERRED it rather than being told.
+*
+* `flag` and `env` (`AWS_REGION`) are the user speaking, and are obeyed as
+* given. `default-env` (`AWS_DEFAULT_REGION`) is NOT: cdkd never read that
+* variable before, so acting on it is a new inference. `default` is already
+* the legacy region, so there is nothing to reconcile against.
+*
+* Exported so a caller can skip CONSTRUCTING a probe client it will not use —
+* the reconciliation functions return early on the same condition, but by then
+* the caller has already paid for an S3 client and a state backend.
+*/
+function regionNeedsReconciliation(effective) {
+	if (effective.source === "flag" || effective.source === "env") return false;
+	return effective.region !== LEGACY_DEFAULT_REGION;
+}
 
 //#endregion
 //#region src/cli/commands/state-file-keys.ts
@@ -1159,15 +1318,43 @@ async function bootstrapDestroyCommand(options) {
 		roleArn: options.roleArn,
 		region: namedCliRegion(options.region)
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	const effective = await resolveEffectiveRegion(options);
+	const accountClients = new AwsClients({
+		region: effective.region,
+		...options.profile && { profile: options.profile }
+	});
+	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
+	let region = effective.region;
+	if (regionNeedsReconciliation(effective)) {
+		const probeBackend = new S3StateBackend(new S3Client({
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		}), {
+			bucket: bucketName,
+			prefix: STATE_PREFIX
+		}, {
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		});
+		try {
+			region = await reconcileMarkerRegionWithLegacyDefault({
+				effective,
+				probe: probeBackend,
+				markerKeyFor: getBootstrapMarkerKey,
+				logger
+			});
+		} finally {
+			probeBackend.destroyClient();
+		}
+	}
 	const rawRegion = rawCliRegion(options.region) ?? region;
-	const awsClients = new AwsClients({
+	const awsClients = region === effective.region ? accountClients : new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
 	});
+	if (awsClients !== accountClients) accountClients.destroy();
 	setAwsClients(awsClients);
-	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
-	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
 		region,
 		...options.profile && { profile: options.profile }
@@ -1291,19 +1478,19 @@ async function bootstrapCommand(options) {
 	if (options.verbose) logger.setLevel("debug");
 	logger.info("Starting cdkd bootstrap...");
 	logger.debug("Options:", options);
-	const rawRegion = rawCliRegion(options.region) ?? "us-east-1";
+	const rawRegion = rawCliRegion(options.region);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+	const effective = await resolveEffectiveRegion(options);
+	let awsClients = new AwsClients({
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const s3Client = awsClients.s3;
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	let s3Client = awsClients.s3;
 	let bucketName;
 	let accountId;
 	if (options.stateBucket) {
@@ -1315,6 +1502,39 @@ async function bootstrapCommand(options) {
 		bucketName = getDefaultStateBucketName(accountId);
 		logger.info(`Using default state bucket: ${bucketName}`);
 	}
+	let region = effective.region;
+	if (regionNeedsReconciliation(effective)) {
+		const probeBackend = new S3StateBackend(new S3Client({
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		}), {
+			bucket: bucketName,
+			prefix: "cdkd"
+		}, {
+			region: effective.region,
+			...options.profile && { profile: options.profile }
+		});
+		try {
+			region = await reconcileMarkerRegionWithLegacyDefault({
+				effective,
+				probe: probeBackend,
+				markerKeyFor: getBootstrapMarkerKey,
+				logger
+			});
+		} finally {
+			probeBackend.destroyClient();
+		}
+	}
+	if (region !== effective.region) {
+		const held = new AwsClients({
+			region,
+			...options.profile && { profile: options.profile }
+		});
+		awsClients.destroy();
+		awsClients = held;
+		setAwsClients(awsClients);
+		s3Client = awsClients.s3;
+	}
 	const rebuiltStateBucketClient = await rebuildClientForBucketRegion(s3Client, bucketName, { ...options.profile && { profile: options.profile } });
 	const stateBucketS3 = rebuiltStateBucketClient ?? s3Client;
 	try {
@@ -1401,7 +1621,7 @@ async function bootstrapCommand(options) {
 					ecrClient,
 					stateBackend,
 					accountId,
-					region: rawRegion,
+					region: rawRegion ?? region,
 					force: options.force,
 					...options.assetBucket && { assetBucketName: options.assetBucket },
 					...options.containerRepo && { containerRepoName: options.containerRepo }
@@ -72155,26 +72375,37 @@ async function gcCommand(options) {
 		roleArn: options.roleArn,
 		region: namedCliRegion(options.region)
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const rawRegion = rawCliRegion(options.region) ?? region;
-	const awsClients = new AwsClients({
-		region,
+	const effective = await resolveEffectiveRegion(options);
+	const accountClients = new AwsClients({
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
-	setAwsClients(awsClients);
-	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
+	const accountId = (await accountClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
-		region,
+		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
 		prefix: "cdkd"
 	}, {
+		region: effective.region,
+		...options.profile && { profile: options.profile }
+	});
+	const region = regionNeedsReconciliation(effective) ? await reconcileMarkerRegionWithLegacyDefault({
+		effective,
+		probe: stateBackend,
+		markerKeyFor: getBootstrapMarkerKey,
+		logger
+	}) : effective.region;
+	const rawRegion = rawCliRegion(options.region) ?? region;
+	const awsClients = region === effective.region ? accountClients : new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
 	});
+	if (awsClients !== accountClients) accountClients.destroy();
+	setAwsClients(awsClients);
 	const ecrClient = new ECRClient({
 		region,
 		...options.profile && { profile: options.profile }
@@ -72253,7 +72484,7 @@ async function gcCommand(options) {
 * Create the `cdkd gc` command (upstream `cdk gc` parity naming).
 */
 function createGcCommand() {
-	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc for that).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION / AWS_DEFAULT_REGION, else the profile region; refuses if none is configured)")).action(withErrorHandling(async (options) => {
+	const cmd = new Command("gc").description("Garbage-collect unreferenced objects / images from ONE region's cdkd-owned asset storage (asset bucket + container-asset ECR repo). References are collected from every cdkd state file; CDK bootstrap storage is never touched (use cdk gc for that).").option("--state-bucket <bucket>", "S3 bucket holding cdkd state (default: cdkd-state-{accountId})").addOption(new Option("--older-than <duration>", "Never delete an object / image newer than this age, even when unreferenced (protects in-flight publishes and recent rollback targets). Accepts <n>d / <n>h.").default(DEFAULT_OLDER_THAN_MS, "30d").argParser(parseOlderThan)).option("--dry-run", "Print the reclaim plan (per-item list + totals) without deleting", false).addOption(new Option("--region <region>", "Region whose cdkd asset storage to garbage-collect (defaults to AWS_REGION, then AWS_DEFAULT_REGION, then your AWS profile's region, then us-east-1)")).action(withErrorHandling(async (options) => {
 		await gcCommand(options);
 	}));
 	commonOptions.forEach((opt) => cmd.addOption(opt));
@@ -84028,7 +84259,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.25");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.26");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;