@go-to-k/cdkd 0.284.5 → 0.284.7

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-BKSfYWps.js";
+import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-CJncZQEi.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-C1NtROYt.js";
+import { t as ASGProvider } from "./asg-provider-DOdJgPLS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -995,12 +995,66 @@ async function deleteContainerRepo(containerRepo, region, profile, logger) {
 		ecrClient.destroy();
 	}
 }
-/**
-* List OTHER regions that still have a bootstrap marker in the state
-* bucket (i.e. are still opted in to cdkd asset storage).
-*/
-async function listOtherBootstrapRegions(stateBackend, region) {
-	return (await stateBackend.listRawKeys(BOOTSTRAP_MARKER_PREFIX)).filter((k) => k.endsWith(".json")).map((k) => k.slice(BOOTSTRAP_MARKER_PREFIX.length, -5)).filter((r) => r.length > 0 && r !== region);
+/** The region spelling a bootstrap marker key carries, e.g. `Us-East-1`. */
+function markerRegionOfKey(markerKey) {
+	return markerKey.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
+}
+/**
+* Partition the state bucket's bootstrap markers, relative to the ONE this run
+* resolved, into the two kinds that must not be silently destroyed with the
+* bucket:
+*
+* - `otherRegions` — markers for a DIFFERENT region, still opted in.
+* - `sameRegionKeys` — markers for THIS region under a different SPELLING of
+*   its name. The teardown deletes exactly one key, so every other spelling
+*   survives, naming asset storage this run did not touch.
+*
+* Both come from ONE listing, and the second kind is why the listing rather
+* than a per-key probe is the source: a probe is only as deep as the keys it
+* guesses (`us-east-1` / `US-EAST-1`), while a region can hold a marker under
+* any spelling (`Us-East-1`), and the listing sees all of them.
+*
+* `region` arrives CANONICAL (issue #1995) while the key segments are whatever
+* `cdkd bootstrap` actually wrote, which is not folded (issue #1820) — so the
+* two sides are compared through {@link canonicalizeRegion} rather than
+* directly. A raw compare re-introduces this command's own bug in a different
+* flag: with a marker at `cdkd-bootstrap/US-EAST-1.json`,
+* `--destroy --region US-EAST-1 --include-state-bucket` would list `US-EAST-1`
+* as an "other" region, refuse with `STATE_BUCKET_HOLDS_MARKERS` naming the
+* very region being torn down, and tell the user to run the command they just
+* ran. It aborts BEFORE the teardown, so the bucket and repo survive too.
+*
+* Other regions are deduplicated by the folded name, so a region bootstrapped
+* twice under two spellings is reported once rather than twice.
+*
+* The comparison folds but the REPORTED value stays the RAW key segment, and
+* that asymmetry is load-bearing. The error tells the user to run
+* `cdkd bootstrap --destroy --region <r>` for each name printed, and only the
+* raw spelling actually reaches the marker: `--region eu-west-1` against a
+* marker at `cdkd-bootstrap/EU-WEST-1.json` probes the canonical key (absent),
+* finds `rawMarkerKey === markerKey`, skips the second probe, and reports
+* "nothing to delete". Printing the folded name would hand the user a command
+* that cannot work.
+*/
+async function listBootstrapMarkerSiblings(stateBackend, region, resolvedMarkerKey) {
+	const segments = (await stateBackend.listRawKeys(BOOTSTRAP_MARKER_PREFIX)).filter((k) => k.endsWith(".json")).map((k) => {
+		const raw = k.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
+		return {
+			key: k,
+			raw,
+			folded: canonicalizeRegion(raw)
+		};
+	}).filter((e) => e.raw.length > 0);
+	const byCanonical = /* @__PURE__ */ new Map();
+	for (const { raw, folded } of segments) {
+		if (folded === region) continue;
+		if (!byCanonical.has(folded)) byCanonical.set(folded, raw);
+	}
+	const sameRegionKeys = segments.filter((e) => e.folded === region && e.key !== resolvedMarkerKey).map((e) => e.key);
+	return {
+		otherRegions: [...byCanonical.values()],
+		sameRegionKeys
+	};
 }
 /**
 * `cdkd bootstrap --destroy` implementation. Dispatched from the bootstrap
@@ -1013,14 +1067,16 @@ async function bootstrapDestroyCommand(options) {
 	logger.debug("Options:", options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
-		region: options.region
+		region: canonicalizeRegion(options.region)
 	});
+	const rawRegion = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
+	const clientRegion = canonicalizeRegion(options.region || process.env["AWS_REGION"]) || void 0;
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
 	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
@@ -1036,9 +1092,18 @@ async function bootstrapDestroyCommand(options) {
 	});
 	try {
 		const markerKey = getBootstrapMarkerKey(region);
+		const rawMarkerKey = getBootstrapMarkerKey(rawRegion);
 		let markerBody;
+		let resolvedMarkerKey = markerKey;
 		try {
 			markerBody = await stateBackend.getRawObject(markerKey);
+			if (markerBody === null && rawMarkerKey !== markerKey) {
+				markerBody = await stateBackend.getRawObject(rawMarkerKey);
+				if (markerBody !== null) {
+					resolvedMarkerKey = rawMarkerKey;
+					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+				}
+			}
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account/region was never bootstrapped; nothing to delete.`);
@@ -1046,14 +1111,29 @@ async function bootstrapDestroyCommand(options) {
 			}
 			throw error;
 		}
+		let markerSiblings = {
+			otherRegions: [],
+			sameRegionKeys: []
+		};
+		let markerListingSucceeded = true;
+		try {
+			markerSiblings = await listBootstrapMarkerSiblings(stateBackend, region, resolvedMarkerKey);
+		} catch (error) {
+			markerListingSucceeded = false;
+			if (options.includeStateBucket) throw new CdkdError(`Cannot verify which bootstrap markers the state bucket '${bucketName}' still holds (listing '${BOOTSTRAP_MARKER_PREFIX}' failed), and --include-state-bucket deletes every one of them. Grant s3:ListBucket on this bucket and re-run.`, "STATE_BUCKET_MARKER_SCAN_FAILED", error);
+			logger.warn(`Could not list bootstrap markers under '${BOOTSTRAP_MARKER_PREFIX}' (${error instanceof Error ? error.message : String(error)}). Continuing — this only means a marker for this region under another spelling of its name would not be reported.`);
+		}
 		let marker;
 		if (markerBody === null) {
-			logger.info(`No bootstrap marker for region '${region}' (${markerKey}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
+			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
+			logger.info(`No bootstrap marker for region '${region}' (${probed}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
+			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive. Re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear it down.`);
 			if (!options.includeStateBucket) {
-				logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
+				if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so it is NOT known whether this region has a marker under another spelling of its name. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}' before re-bootstrapping — re-running 'cdkd bootstrap' while one exists writes a SECOND marker with DEFAULT names, and the next destroy would then tear down that storage while the storage the existing marker names survives.`);
+				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
 				return;
 			}
-		} else marker = parseBootstrapMarker(markerBody, markerKey);
+		} else marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		if (marker && !options.force) {
 			logger.info("Scanning stack state for references to the asset storage...");
 			const referencing = await scanStateReferences(stateBackend, [marker.assetBucket, marker.containerRepo]);
@@ -1065,14 +1145,19 @@ async function bootstrapDestroyCommand(options) {
 				const listing = stateKeys.map((k) => `  - ${describeStateKey(k)}  [${k}]`).join("\n");
 				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
 			}
-			const otherRegions = await listOtherBootstrapRegions(stateBackend, region);
-			if (otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+			if (markerSiblings.sameRegionKeys.length > 0) {
+				const canonicalStillPresent = markerBody !== null && resolvedMarkerKey === markerKey;
+				const listing = markerSiblings.sameRegionKeys.map((k) => canonicalStillPresent ? `  - ${k}` : `  - ${k}  (cdkd bootstrap --destroy --region ${markerRegionOfKey(k)})`).join("\n");
+				const remedy = canonicalStillPresent ? `Run 'cdkd bootstrap --destroy --region ${region}' WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : "Run the command shown against each marker above, then re-run with --include-state-bucket.";
+				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.`, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
+			}
 		}
 		const planLines = [];
 		if (marker) {
 			planLines.push(`Asset bucket: s3://${marker.assetBucket} (region ${region}, all contents)`);
 			planLines.push(`Container-asset ECR repository: ${marker.containerRepo} (region ${region}, all images)`);
-			planLines.push(`Bootstrap marker: s3://${bucketName}/${markerKey} (deleted last)`);
+			planLines.push(`Bootstrap marker: s3://${bucketName}/${resolvedMarkerKey} (deleted last)`);
 		}
 		if (options.includeStateBucket) planLines.push(`State bucket: s3://${bucketName} (ALL contents, including all versions)`);
 		if (!await promptBootstrapDestroyConfirm({
@@ -1085,8 +1170,10 @@ async function bootstrapDestroyCommand(options) {
 		if (marker) {
 			await emptyAndDeleteBucket(awsClients.s3, marker.assetBucket, accountId, "Asset bucket", logger);
 			await deleteContainerRepo(marker.containerRepo, region, options.profile, logger);
-			await stateBackend.deleteRawObjects([markerKey]);
-			logger.info(`✓ Deleted bootstrap marker (${markerKey})`);
+			await stateBackend.deleteRawObjects([resolvedMarkerKey]);
+			logger.info(`✓ Deleted bootstrap marker (${resolvedMarkerKey})`);
+			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run — re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear that one down too.`);
+			if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so a marker under another spelling of this region may still be live. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}'.`);
 			logger.info(`\ncdkd asset storage is now OFF for region ${region}: future deploys in this region fall back to legacy mode (CDK bootstrap destinations) unless the region is bootstrapped again.`);
 		}
 		if (options.includeStateBucket) {
@@ -63078,7 +63165,10 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
 						desiredFromAwsReadback: true,
 						maskSecrets: createSecretMasker(secrets)
-					}), outcome.logicalId, { logger: { debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)) } });
+					}), outcome.logicalId, { logger: {
+						debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
+						warn: (msg) => logger.warn(maskSecretsInText(msg, secrets))
+					} });
 					totalSucceeded++;
 					const revertPartial = updatePartialReason(updateResult);
 					if (revertPartial !== void 0) logger.warn(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, ${maskSecretsInText(updatePartialMessage(revertPartial), secrets)}`);
@@ -69861,6 +69951,107 @@ const KEY_TERMINATORS = "[^\\s\"'?]";
 */
 const GC_EXTRA_URL_SUFFIXES = [];
 /**
+* Every AWS partition's URL suffix. The asset-reference matchers match the
+* suffix against this CLOSED SET instead of hardcoding one literal
+* (issue #1781).
+*
+* Before this list, all three matchers spelled `amazonaws\.com` inline, so a
+* state file written in `aws-cn` / `us-iso*` / `us-isob*` (recording
+* `amazonaws.com.cn` / `c2s.ic.gov` / `sc2s.sgov.gov` hosts) matched none of
+* them and its assets read as UNREFERENCED.
+*
+* **What that actually deleted, measured rather than assumed.** The blast
+* radius is narrower than "every live asset" but still a silent, irreversible
+* delete:
+*
+* - **S3 was already rescued**, by accident. {@link CONTENT_HASH_KEY_RE}
+*   collects `<sha256>.<ext>` tokens out of ANY string regardless of host, and
+*   cdkd's file assets are content-addressed with an extension — so a
+*   non-commercial `https://…amazonaws.com.cn/<sha256>.zip` still had its key
+*   protected by the name-independent pass. Measured on a real `--dry-run`
+*   against a seeded `cn-north-1` state file: 71 of 72 objects, including the
+*   referenced one, were protected with the matchers still broken.
+* - **ECR was NOT rescued, and is where the bug actually deleted.** cdkd's
+*   image tags are bare 64-hex with no `.<ext>` tail, so the content-hash pass
+*   cannot see them, and digests are `sha256:<hex>` — also no tail. With the
+*   ECR matcher missing the suffix, a referenced non-commercial image is
+*   selected for deletion. That is the case the live test reproduced.
+*
+* Either way the failure direction is the opposite of the #1758 / #1745 sites,
+* which merely emit a host that does not resolve.
+*
+* Two properties of this list are load-bearing:
+*
+* - It is the union over ALL partitions, not
+*   `derivePartitionAndUrlSuffix(region).urlSuffix` for the caller's region.
+*   The scan reads EVERY state file in the state bucket, written by any cdkd
+*   binary for any region, so it must match every partition at once; a single
+*   derived literal would still delete a `cn-north-1` stack's images during a
+*   `us-east-1` gc run.
+* - It is a SUPERSET of the arms {@link derivePartitionAndUrlSuffix} knows
+*   (issue #1764). A suffix missing HERE deletes live assets, which is the
+*   irreversible direction, so this list must lead that table rather than
+*   follow it.
+*
+* The superset property is now MECHANICAL rather than hand-maintained (issue
+* #1785): the list is built FROM {@link PARTITION_TABLE} plus
+* {@link GC_EXTRA_URL_SUFFIXES}, so a partition arm added to that table
+* propagates here in the same commit instead of silently outrunning gc. It
+* used to be a hand-written literal, and the test meant to fence it iterated a
+* hand-written region list — so a new arm in the derive table redded nothing.
+*
+* It is a closed SET rather than a `[^/\s]+` wildcard so a look-alike host
+* (`https://<assetBucket>.s3.<region>.example.com/<key>`) is not treated as a
+* cdkd asset reference. That direction only ever over-PROTECTS, but it would
+* also let any string embedding the bucket name pin an object forever, which
+* quietly turns gc into a no-op.
+*
+* NOTE this is a weaker check than `src/utils/ecr-uri.ts`, which CAPTURES the
+* suffix and validates it against the region the host names. That is the right
+* shape there (one host, one caller-known region) and the wrong shape here:
+* the region in a scanned string is not necessarily the region whose partition
+* the suffix must belong to, and pairing them would re-inherit #1764's missing
+* arms on the irreversible side.
+*/
+const AWS_URL_SUFFIXES = [.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])];
+/**
+* Spell an ASCII literal so it matches case-INSENSITIVELY inside a
+* case-SENSITIVE `RegExp`: `s3` → `[sS]3`, `amazonaws.com` →
+* `[aA][mM][aA][zZ][oO][nN][aA][wW][sS]\.[cC][oO][mM]`. EVERY character goes
+* through {@link escapeRegExp} first and the ASCII letters are folded after,
+* so the result is exactly as strict as an escaped literal outside the letters
+* it folds.
+*
+* This exists because gc must fold only PART of a pattern (issue #1847). Host
+* names are case-insensitive, so
+* `https://<assetBucket>.s3.<region>.AMAZONAWS.COM/<key>` in a state file names
+* the same object as the lower-cased spelling — and a reference gc misses reads
+* as UNREFERENCED, so the live object is DELETED. The obvious fix, the `i` flag
+* the ECR matcher carries, is per-REGEX and therefore all-or-nothing: it cannot
+* fold the host while leaving a KEY or a path-segment bucket exact, and those
+* segments are genuinely case-sensitive at S3. Which segment gets folded is
+* decided per shape at the matchers themselves — see the block above
+* `s3UriRe` for the authority / path-segment / DNS-label split.
+*
+* Two further properties are load-bearing:
+*
+* - Folding by character class rather than by flag leaves
+*   {@link URL_SUFFIX_ALTERNATION} — SHARED with the ECR matcher — spelled
+*   exactly as that matcher's own review settled it, so the S3 side cannot
+*   quietly redefine the constant the ECR side reads (issues #1792 / #1793).
+* - A two-character class is not `/k/i`. Under a `u` flag the `i` flag
+*   canonicalizes U+212A KELVIN SIGN onto ASCII `k` — the hazard
+*   `src/utils/ecr-uri.ts` guards its region / suffix checks against —
+*   whereas `[kK]` matches those two code points and nothing else, with or
+*   without `u`. (Measured, and pinned by `tests/unit/cli/gc.test.ts`:
+*   `/k/iu` matches U+212A, `/[kK]/u` does not.) The matchers below carry no
+*   `u` flag today, so this is about what adding one later could silently
+*   widen: with classes, nothing.
+*/
+function caseFoldLiteral(literal) {
+	return escapeRegExp(literal).replace(/[A-Za-z]/g, (ch) => `[${ch.toLowerCase()}${ch.toUpperCase()}]`);
+}
+/**
 * `(?:amazonaws\.com\.cn|amazonaws\.com|...)` — {@link AWS_URL_SUFFIXES} as a
 * non-capturing alternation, LONGEST FIRST so `amazonaws.com.cn` is tried
 * before its own `amazonaws.com` prefix instead of relying on backtracking.
@@ -69870,8 +70061,48 @@ const GC_EXTRA_URL_SUFFIXES = [];
 * the ECR digest), and this alternation sits BEFORE those groups in all three
 * patterns. Making it capturing would shift every index by one and silently
 * collect the suffix as if it were a key.
+*
+* `spellSuffix` decides how each suffix is written out, so the SET, the
+* longest-first order and the non-capturing property keep exactly one
+* definition while the two consumers differ in case handling — see
+* {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED}.
+*/
+function buildUrlSuffixAlternation(spellSuffix) {
+	return `(?:${[...AWS_URL_SUFFIXES].sort((a, b) => b.length - a.length).map(spellSuffix).join("|")})`;
+}
+/**
+* The case-SENSITIVE spelling, consumed by {@link ECR_REGISTRY_HOST}.
+*
+* Folding THIS constant would be inert for its only consumer — the ECR matcher
+* carries the `i` flag, so it already matches an upper-cased suffix either way.
+* The constraint is the other direction: this is the spelling the ECR side's
+* own review settled on (issues #1792 / #1793), and the S3 matchers must widen
+* through their own {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED} copy rather than
+* by editing the shared one, so an S3-side change can never reach the ECR
+* grammar.
+*/
+const URL_SUFFIX_ALTERNATION = buildUrlSuffixAlternation(escapeRegExp);
+/**
+* The case-FOLDED spelling, consumed by the three S3 matchers (issue #1847).
+* Same suffix set, same order, letters folded per {@link caseFoldLiteral} — so
+* an upper-cased or mixed-case host suffix collects the key. Still a CLOSED
+* set: folding widens the SPELLING of each suffix, never which suffixes count.
 */
-const URL_SUFFIX_ALTERNATION = `(?:${[...[.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
+const URL_SUFFIX_ALTERNATION_CASE_FOLDED = buildUrlSuffixAlternation(caseFoldLiteral);
+/**
+* `[sS]3`, case-folded (issue #1847). One constant for BOTH places the literal
+* `s3` appears: the `s3://` URI SCHEME and the `s3` HOST LABEL of the two HTTPS
+* shapes. The two roles differ but the spelling and the fold argument are the
+* same, and a single constant is what stops the three matchers drifting into
+* two different spellings of it.
+*/
+const S3_SEGMENT_CASE_FOLDED = caseFoldLiteral("s3");
+/**
+* `[hH][tT][tT][pP][sS]` — the URI scheme, case-folded (issue #1847). A scheme
+* is case-insensitive by RFC 3986 §3.1, and folding a fixed literal that is
+* neither the bucket name nor the key can only ever over-PROTECT.
+*/
+const HTTPS_SCHEME_CASE_FOLDED = caseFoldLiteral("https");
 /**
 * The HOST half of an ECR registry, built from the ONE authoritative FORM TABLE
 * in `src/utils/ecr-uri.ts` (issue #1793) instead of spelled a second time here.
@@ -69964,16 +70195,21 @@ function tryDecodeBase64Text(value) {
 *   account's or region's URI can only over-protect (keep more), never
 *   delete more.
 *
-* `<urlSuffix>` in the two S3 shapes is {@link URL_SUFFIX_ALTERNATION}, i.e.
-* EVERY partition's suffix at once — see that constant for why a per-region
-* derived literal is the wrong shape here (issue #1781).
+* `<urlSuffix>` in the two S3 shapes is
+* {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED}, i.e. EVERY partition's suffix at
+* once — see {@link AWS_URL_SUFFIXES} for why a per-region derived literal is
+* the wrong shape here (issue #1781). Every S3 HOST segment is matched
+* case-insensitively, including the bucket label of the virtual-hosted shape,
+* while the KEY and the bucket in the other two shapes stay EXACT (issue
+* #1847); the per-shape reasoning is in the block above `s3UriRe`.
 */
 function buildReferenceExtractors(marker) {
-	const bucket = escapeRegExp(marker.assetBucket);
+	const bucketExact = escapeRegExp(marker.assetBucket);
+	const bucketFolded = caseFoldLiteral(marker.assetBucket);
 	const repo = escapeRegExp(marker.containerRepo);
-	const s3UriRe = new RegExp(`s3://${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/(${KEY_TERMINATORS}+)`, "g");
-	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/${bucket}/(${KEY_TERMINATORS}+)`, "g");
+	const s3UriRe = new RegExp(`${S3_SEGMENT_CASE_FOLDED}://${bucketExact}/(${KEY_TERMINATORS}+)`, "g");
+	const virtualHostedRe = new RegExp(`${HTTPS_SCHEME_CASE_FOLDED}://${bucketFolded}\\.${S3_SEGMENT_CASE_FOLDED}[^/\\s]*\\.${URL_SUFFIX_ALTERNATION_CASE_FOLDED}/(${KEY_TERMINATORS}+)`, "g");
+	const pathStyleRe = new RegExp(`${HTTPS_SCHEME_CASE_FOLDED}://${S3_SEGMENT_CASE_FOLDED}[^/\\s]*\\.${URL_SUFFIX_ALTERNATION_CASE_FOLDED}/${bucketExact}/(${KEY_TERMINATORS}+)`, "g");
 	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "gi");
 	const extractOnce = (value, refs) => {
 		for (const re of [
@@ -70242,9 +70478,10 @@ async function gcCommand(options) {
 	logger.debug("Options:", options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
-		region: options.region
+		region: canonicalizeRegion(options.region)
 	});
-	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const rawRegion = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
 	const awsClients = new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
@@ -70269,9 +70506,18 @@ async function gcCommand(options) {
 	});
 	try {
 		const markerKey = getBootstrapMarkerKey(region);
+		const rawMarkerKey = getBootstrapMarkerKey(rawRegion);
 		let markerBody;
+		let resolvedMarkerKey = markerKey;
 		try {
 			markerBody = await stateBackend.getRawObject(markerKey);
+			if (markerBody === null && rawMarkerKey !== markerKey) {
+				markerBody = await stateBackend.getRawObject(rawMarkerKey);
+				if (markerBody !== null) {
+					resolvedMarkerKey = rawMarkerKey;
+					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+				}
+			}
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account was never bootstrapped; nothing to garbage-collect.`);
@@ -70280,10 +70526,11 @@ async function gcCommand(options) {
 			throw error;
 		}
 		if (markerBody === null) {
-			logger.info(`No bootstrap marker for region '${region}' (${markerKey}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
+			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
+			logger.info(`No bootstrap marker for region '${region}' (${probed}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
 			return;
 		}
-		const marker = parseBootstrapMarker(markerBody, markerKey);
+		const marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
 			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX)}  [${k}]`).join("\n");
@@ -82114,7 +82361,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.7");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;