@go-to-k/cdkd 0.284.6 → 0.284.8

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-Ce7kNQp2.js";
+import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-36yWG1OT.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B9L-88MC.js";
+import { t as ASGProvider } from "./asg-provider-jYyUCsx_.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -995,12 +995,66 @@ async function deleteContainerRepo(containerRepo, region, profile, logger) {
 		ecrClient.destroy();
 	}
 }
-/**
-* List OTHER regions that still have a bootstrap marker in the state
-* bucket (i.e. are still opted in to cdkd asset storage).
-*/
-async function listOtherBootstrapRegions(stateBackend, region) {
-	return (await stateBackend.listRawKeys(BOOTSTRAP_MARKER_PREFIX)).filter((k) => k.endsWith(".json")).map((k) => k.slice(BOOTSTRAP_MARKER_PREFIX.length, -5)).filter((r) => r.length > 0 && r !== region);
+/** The region spelling a bootstrap marker key carries, e.g. `Us-East-1`. */
+function markerRegionOfKey(markerKey) {
+	return markerKey.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
+}
+/**
+* Partition the state bucket's bootstrap markers, relative to the ONE this run
+* resolved, into the two kinds that must not be silently destroyed with the
+* bucket:
+*
+* - `otherRegions` — markers for a DIFFERENT region, still opted in.
+* - `sameRegionKeys` — markers for THIS region under a different SPELLING of
+*   its name. The teardown deletes exactly one key, so every other spelling
+*   survives, naming asset storage this run did not touch.
+*
+* Both come from ONE listing, and the second kind is why the listing rather
+* than a per-key probe is the source: a probe is only as deep as the keys it
+* guesses (`us-east-1` / `US-EAST-1`), while a region can hold a marker under
+* any spelling (`Us-East-1`), and the listing sees all of them.
+*
+* `region` arrives CANONICAL (issue #1995) while the key segments are whatever
+* `cdkd bootstrap` actually wrote, which is not folded (issue #1820) — so the
+* two sides are compared through {@link canonicalizeRegion} rather than
+* directly. A raw compare re-introduces this command's own bug in a different
+* flag: with a marker at `cdkd-bootstrap/US-EAST-1.json`,
+* `--destroy --region US-EAST-1 --include-state-bucket` would list `US-EAST-1`
+* as an "other" region, refuse with `STATE_BUCKET_HOLDS_MARKERS` naming the
+* very region being torn down, and tell the user to run the command they just
+* ran. It aborts BEFORE the teardown, so the bucket and repo survive too.
+*
+* Other regions are deduplicated by the folded name, so a region bootstrapped
+* twice under two spellings is reported once rather than twice.
+*
+* The comparison folds but the REPORTED value stays the RAW key segment, and
+* that asymmetry is load-bearing. The error tells the user to run
+* `cdkd bootstrap --destroy --region <r>` for each name printed, and only the
+* raw spelling actually reaches the marker: `--region eu-west-1` against a
+* marker at `cdkd-bootstrap/EU-WEST-1.json` probes the canonical key (absent),
+* finds `rawMarkerKey === markerKey`, skips the second probe, and reports
+* "nothing to delete". Printing the folded name would hand the user a command
+* that cannot work.
+*/
+async function listBootstrapMarkerSiblings(stateBackend, region, resolvedMarkerKey) {
+	const segments = (await stateBackend.listRawKeys(BOOTSTRAP_MARKER_PREFIX)).filter((k) => k.endsWith(".json")).map((k) => {
+		const raw = k.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
+		return {
+			key: k,
+			raw,
+			folded: canonicalizeRegion(raw)
+		};
+	}).filter((e) => e.raw.length > 0);
+	const byCanonical = /* @__PURE__ */ new Map();
+	for (const { raw, folded } of segments) {
+		if (folded === region) continue;
+		if (!byCanonical.has(folded)) byCanonical.set(folded, raw);
+	}
+	const sameRegionKeys = segments.filter((e) => e.folded === region && e.key !== resolvedMarkerKey).map((e) => e.key);
+	return {
+		otherRegions: [...byCanonical.values()],
+		sameRegionKeys
+	};
 }
 /**
 * `cdkd bootstrap --destroy` implementation. Dispatched from the bootstrap
@@ -1013,14 +1067,16 @@ async function bootstrapDestroyCommand(options) {
 	logger.debug("Options:", options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
-		region: options.region
+		region: canonicalizeRegion(options.region)
 	});
+	const rawRegion = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
+	const clientRegion = canonicalizeRegion(options.region || process.env["AWS_REGION"]) || void 0;
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
 	const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
@@ -1036,9 +1092,18 @@ async function bootstrapDestroyCommand(options) {
 	});
 	try {
 		const markerKey = getBootstrapMarkerKey(region);
+		const rawMarkerKey = getBootstrapMarkerKey(rawRegion);
 		let markerBody;
+		let resolvedMarkerKey = markerKey;
 		try {
 			markerBody = await stateBackend.getRawObject(markerKey);
+			if (markerBody === null && rawMarkerKey !== markerKey) {
+				markerBody = await stateBackend.getRawObject(rawMarkerKey);
+				if (markerBody !== null) {
+					resolvedMarkerKey = rawMarkerKey;
+					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+				}
+			}
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account/region was never bootstrapped; nothing to delete.`);
@@ -1046,14 +1111,29 @@ async function bootstrapDestroyCommand(options) {
 			}
 			throw error;
 		}
+		let markerSiblings = {
+			otherRegions: [],
+			sameRegionKeys: []
+		};
+		let markerListingSucceeded = true;
+		try {
+			markerSiblings = await listBootstrapMarkerSiblings(stateBackend, region, resolvedMarkerKey);
+		} catch (error) {
+			markerListingSucceeded = false;
+			if (options.includeStateBucket) throw new CdkdError(`Cannot verify which bootstrap markers the state bucket '${bucketName}' still holds (listing '${BOOTSTRAP_MARKER_PREFIX}' failed), and --include-state-bucket deletes every one of them. Grant s3:ListBucket on this bucket and re-run.`, "STATE_BUCKET_MARKER_SCAN_FAILED", error);
+			logger.warn(`Could not list bootstrap markers under '${BOOTSTRAP_MARKER_PREFIX}' (${error instanceof Error ? error.message : String(error)}). Continuing — this only means a marker for this region under another spelling of its name would not be reported.`);
+		}
 		let marker;
 		if (markerBody === null) {
-			logger.info(`No bootstrap marker for region '${region}' (${markerKey}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
+			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
+			logger.info(`No bootstrap marker for region '${region}' (${probed}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
+			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive. Re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear it down.`);
 			if (!options.includeStateBucket) {
-				logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
+				if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so it is NOT known whether this region has a marker under another spelling of its name. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}' before re-bootstrapping — re-running 'cdkd bootstrap' while one exists writes a SECOND marker with DEFAULT names, and the next destroy would then tear down that storage while the storage the existing marker names survives.`);
+				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
 				return;
 			}
-		} else marker = parseBootstrapMarker(markerBody, markerKey);
+		} else marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		if (marker && !options.force) {
 			logger.info("Scanning stack state for references to the asset storage...");
 			const referencing = await scanStateReferences(stateBackend, [marker.assetBucket, marker.containerRepo]);
@@ -1065,14 +1145,19 @@ async function bootstrapDestroyCommand(options) {
 				const listing = stateKeys.map((k) => `  - ${describeStateKey(k)}  [${k}]`).join("\n");
 				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
 			}
-			const otherRegions = await listOtherBootstrapRegions(stateBackend, region);
-			if (otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+			if (markerSiblings.sameRegionKeys.length > 0) {
+				const canonicalStillPresent = markerBody !== null && resolvedMarkerKey === markerKey;
+				const listing = markerSiblings.sameRegionKeys.map((k) => canonicalStillPresent ? `  - ${k}` : `  - ${k}  (cdkd bootstrap --destroy --region ${markerRegionOfKey(k)})`).join("\n");
+				const remedy = canonicalStillPresent ? `Run 'cdkd bootstrap --destroy --region ${region}' WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : "Run the command shown against each marker above, then re-run with --include-state-bucket.";
+				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.`, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
+			}
 		}
 		const planLines = [];
 		if (marker) {
 			planLines.push(`Asset bucket: s3://${marker.assetBucket} (region ${region}, all contents)`);
 			planLines.push(`Container-asset ECR repository: ${marker.containerRepo} (region ${region}, all images)`);
-			planLines.push(`Bootstrap marker: s3://${bucketName}/${markerKey} (deleted last)`);
+			planLines.push(`Bootstrap marker: s3://${bucketName}/${resolvedMarkerKey} (deleted last)`);
 		}
 		if (options.includeStateBucket) planLines.push(`State bucket: s3://${bucketName} (ALL contents, including all versions)`);
 		if (!await promptBootstrapDestroyConfirm({
@@ -1085,8 +1170,10 @@ async function bootstrapDestroyCommand(options) {
 		if (marker) {
 			await emptyAndDeleteBucket(awsClients.s3, marker.assetBucket, accountId, "Asset bucket", logger);
 			await deleteContainerRepo(marker.containerRepo, region, options.profile, logger);
-			await stateBackend.deleteRawObjects([markerKey]);
-			logger.info(`✓ Deleted bootstrap marker (${markerKey})`);
+			await stateBackend.deleteRawObjects([resolvedMarkerKey]);
+			logger.info(`✓ Deleted bootstrap marker (${resolvedMarkerKey})`);
+			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run — re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear that one down too.`);
+			if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so a marker under another spelling of this region may still be live. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}'.`);
 			logger.info(`\ncdkd asset storage is now OFF for region ${region}: future deploys in this region fall back to legacy mode (CDK bootstrap destinations) unless the region is bootstrapped again.`);
 		}
 		if (options.includeStateBucket) {
@@ -58636,6 +58723,18 @@ function containsSecretDynamicReference(value) {
 	if (value !== null && typeof value === "object") return Object.values(value).some(containsSecretDynamicReference);
 	return false;
 }
+/**
+* Does this template carry a secret-bearing dynamic reference ANYWHERE?
+*
+* Exported for the DELETED nested-child path (issue #1948 review): that node
+* diffs its state against an EMPTY template, so it can compute nothing about
+* secrets from its own input and would render a pre-GHSA child's whole stored
+* bag in full. The caller passes the PARENT's answer instead — see
+* `diff-recursive.ts`'s `buildDeletedSubtree`.
+*/
+function templateHasSecretDynamicReference(template) {
+	return containsSecretDynamicReference(template);
+}
 /** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
 function valuesEqual(a, b) {
 	if (a === b) return true;
@@ -58685,13 +58784,21 @@ function valuesEqual(a, b) {
 * resolver runs with `skipDynamicReferences`, so a `{{resolve:...}}` reference
 * is never resolved to plaintext in the first place and the bag already holds
 * the expression that state stores post-redaction.
+*
+* `storedOutputs` is the bag currently in state. It is consulted for exactly
+* one decision — the LITERAL `Export.Name` of a secret-bearing stack, see issue
+* #1942 at that branch — and never merged into the result: everything else here
+* previews what the template says, and reading state anywhere else would make
+* the preview agree with the past instead of with the next deploy.
 */
-async function resolveTemplateOutputs(template, resolveFn, conditions) {
+async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs) {
 	const logger = getLogger().child("OutputsDiff");
-	const outputs = {};
+	const outputs = Object.create(null);
 	const exportNames = /* @__PURE__ */ new Set();
 	const failedKeys = /* @__PURE__ */ new Set();
 	const secretSourceKeys = /* @__PURE__ */ new Set();
+	const declaredKeys = /* @__PURE__ */ new Set();
+	const templateHasSecretReference = containsSecretDynamicReference(template);
 	let resolutionFailed = false;
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs ?? {}, conditions);
 	if (!template.Outputs) return {
@@ -58699,6 +58806,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		exportNames,
 		failedKeys,
 		secretSourceKeys,
+		declaredKeys,
+		templateHasSecretReference,
 		resolutionFailed
 	};
 	/**
@@ -58712,6 +58821,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
 	};
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		declaredKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") declaredKeys.add(output.Export.Name);
 		if (!containsSecretDynamicReference(output.Value)) continue;
 		secretSourceKeys.add(outputKey);
 		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
@@ -58751,11 +58862,15 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 			}
 			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
-			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) {
-				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret`);
+			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
+				outputs[exportName] = value;
+				exportNames.add(exportName);
+			} else {
+				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
 				failedKeys.add(exportName);
 				resolutionFailed = true;
-			} else {
+			}
+			else {
 				outputs[exportName] = value;
 				exportNames.add(exportName);
 			}
@@ -58767,6 +58882,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		exportNames,
 		failedKeys,
 		secretSourceKeys,
+		declaredKeys,
+		templateHasSecretReference,
 		resolutionFailed
 	};
 }
@@ -58796,24 +58913,73 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 *   {@link isSecretDynamicReference} (this resolver runs with
 *   `skipDynamicReferences`) while the stored side is not; and
 * - `secretSourceKeys` — the template itself declares the key's value as such a
-*   reference. This one reaches cases the first cannot: a
-*   condition-skipped secret output, or one deleted from the template, has NO
-*   desired side at all and would otherwise print in full as a REMOVE row.
+*   reference. This one reaches a case the first cannot: a condition-skipped
+*   secret output has NO desired side at all and would otherwise print in full
+*   as a REMOVE row.
 *
 * A hit on either makes the WHOLE record suspect, not just that key: the
 * record was written by a pre-GHSA binary, so every value in it is unredacted.
 * Withholding is therefore record-level. The change is still REPORTED — only
 * the value is withheld — so `--fail` and the exports story are unaffected.
-*/
-function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set()) {
+*
+* ## The key today's template cannot account for (issue #1948)
+*
+* Neither signal above covers an output DELETED from the template, and an
+* earlier revision of this note claimed `secretSourceKeys` did — a false
+* coverage claim, which is exactly what lets a reader conclude the case is
+* handled. It structurally cannot: that set is built from DECLARATIONS, and a
+* deleted output declares nothing, so a record whose ONLY secret-bearing output
+* has since been removed is judged not-legacy and its stored pre-GHSA plaintext
+* renders as the `old:` side of a REMOVE row.
+*
+* The signal has to come from the STORED bag, and the honest statement about
+* the stored bag is that the case is UNDECIDABLE there: post-GHSA a secret
+* output stores its `{{resolve:...}}` EXPRESSION, but pre-GHSA it stores a
+* plaintext, and a plaintext is indistinguishable from an ordinary string. So
+* this is a REFUSAL rather than a detection — a stored key the template cannot
+* account for has its value withheld — bounded by two gates that keep it off
+* the common benign case (deleting an output is a normal refactor):
+*
+* - `templateHasSecretReference` — the template must still prove this stack
+*   handles secrets AT ALL (anywhere, `Resources` included). An ordinary stack
+*   with no secret reference keeps printing its REMOVE values.
+* - no stored value is itself a secret-bearing expression. One that is proves
+*   the LAST write was post-GHSA, and the bag is rewritten wholesale by
+*   `resolveOutputs` on every deploy, so every other value in it is redacted
+*   too. This exonerates the record.
+*
+*   That reasoning holds for a DEPLOY write and is weaker for a `cdkd scrub`
+*   one, which rewrites `state.outputs` IN PLACE: scrub redacts what it has a
+*   needle or a template position for, and its own docs admit it can leave a
+*   plaintext it has neither for — so a scrubbed bag holding one redacted key
+*   can exonerate a deleted key's surviving plaintext. Recorded rather than
+*   closed: removing the exoneration would withhold values on every clean
+*   post-GHSA record in a secret-handling stack, which is the larger harm.
+*
+* Withholding here is PER-KEY, unlike the record-level arms above, and the
+* asymmetry follows from what each concludes: those conclude the record was
+* written by a pre-GHSA binary (a claim about the whole bag), while this one
+* concludes only that THIS key is undecidable. So a secret-handling stack that
+* deletes an ordinary output withholds that one row's value and prints the
+* rest.
+*
+* Residual, stated because the gate is what buys the low false-positive rate:
+* a stack whose ONLY secret reference WAS the deleted output has no secret left
+* in its template, so nothing here fires. Closing it would mean withholding
+* every REMOVE value on every stack, which is a worse trade.
+*/
+function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set(), unaccountableScan = {}) {
 	const changes = [];
 	const currentBag = current ?? {};
 	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
 		if (typeof oldValue === "string" && isSecretDynamicReference(oldValue)) return false;
 		return containsSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
 	});
+	const recordProvesPostGhsa = Object.values(currentBag).some((v) => typeof v === "string" && isSecretDynamicReference(v));
+	const declaredKeys = unaccountableScan.declaredKeys ?? /* @__PURE__ */ new Set();
+	const unaccountable = (name) => unaccountableScan.templateHasSecretReference === true && !recordProvesPostGhsa && !declaredKeys.has(name) && !Object.prototype.hasOwnProperty.call(desired, name);
 	const push = (change) => {
-		if (legacyRecord && change.changeType !== "ADD") {
+		if (change.changeType !== "ADD" && (legacyRecord || unaccountable(change.name))) {
 			const { oldValue: _dropped, ...rest } = change;
 			changes.push({
 				...rest,
@@ -59824,7 +59990,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
-async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback) {
+async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
+	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate } = options;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	let mergedParameters = parameters;
 	let parametersBound = false;
@@ -59866,11 +60033,17 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		skipDynamicReferences: true
 	});
 	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
-	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs);
 	let outputChanges = [];
 	if (resolved.resolutionFailed) {
-		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
-	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys);
+		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
+			declaredKeys: resolved.declaredKeys,
+			templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
+		}).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
+	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
+		declaredKeys: resolved.declaredKeys,
+		templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
+	});
 	return {
 		changes,
 		outputChanges
@@ -59935,9 +60108,15 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
-	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback);
+	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
+	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+		...parameters && { parameters },
+		...canonicalizeProperties && { canonicalizeProperties },
+		...cfnFallback !== void 0 && { cfnFallback },
+		inheritSecretBearingTemplate: false
+	});
 	const node = {
 		stackName,
 		displayName,
@@ -59971,13 +60150,14 @@ async function buildDiffTree(args) {
 			parameters: childParameters,
 			...canonicalizeProperties && { canonicalizeProperties },
 			...assetRedirect && { assetRedirect },
-			...cfnFallback !== void 0 && { cfnFallback }
+			...cfnFallback !== void 0 && { cfnFallback },
+			parentHasSecretReference: secretBearingAbove
 		}));
 	}
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove));
 	}
 	return node;
 }
@@ -59987,9 +60167,9 @@ async function buildDiffTree(args) {
 * (state vs empty template), recursing into state-listed grandchildren
 * (also all DELETE).
 */
-async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator) {
+async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference) {
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
-	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator);
+	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, { inheritSecretBearingTemplate: parentHasSecretReference });
 	const node = {
 		stackName,
 		displayName: stackName,
@@ -60001,7 +60181,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference));
 	}
 	return node;
 }
@@ -60231,25 +60411,19 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		delete: deleteCount
 	};
 }
-/** Stand-in printed instead of a withheld legacy-plaintext output value. */
-const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run `cdkd scrub`>";
 /**
-* Strip characters that let a template-controlled string manipulate the
-* TERMINAL rather than merely appear in it: C0 (incl. ESC, so no ANSI sequence
-* survives), DEL, C1 (the 8-bit CSI forms some terminals still honor), and the
-* bidi / format overrides that visually reorder a rendered line.
-*
-* Applied only on the human-render path. The `--json` payload is deliberately
-* left byte-faithful: it is a machine interface, an export NAME is data a
-* consumer may match on, and silently mutating it there would trade a real
-* correctness regression for a display concern belonging to whatever renders
-* the JSON. `JSON.stringify` already escapes everything below 0x20.
+* Stand-in printed instead of a withheld stored output value.
 *
-* The helper itself now lives in `src/utils/regexp.ts` — `outputs-export-alias`
-* prints the same class of string and had grown a second copy.
+* Worded as a POSSIBILITY because both reasons the value is withheld are
+* suspicions rather than detections — a record that LOOKS pre-GHSA, and a
+* stored key today's template cannot account for (issue #1948), which is
+* undecidable by construction. Stating it as a fact would be wrong on the
+* benign half of each, and `cdkd scrub` finding nothing is the expected
+* outcome there.
 */
+const REDACTED_LEGACY_PLAINTEXT = "<redacted: may be legacy plaintext in state — run `cdkd scrub`>";
 /**
-* The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
+* The guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
 * only, deliberately NOT C0.
 *
 * `JSON.stringify` escapes every character below 0x20 that occurs INSIDE a
@@ -67801,13 +67975,13 @@ async function stateResourcesCommand(stackName, options) {
 			for (const detail of details) {
 				lines.push(detail.logicalId);
 				lines.push(`  Type: ${detail.resourceType}`);
-				lines.push(`  PhysicalID: ${detail.physicalId}`);
+				lines.push(`  PhysicalID: ${stripControlChars(detail.physicalId)}`);
 				lines.push(`  Dependencies: ${detail.dependencies.length > 0 ? detail.dependencies.join(", ") : "(none)"}`);
 				const attrEntries = Object.entries(detail.attributes);
 				if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 				else {
 					lines.push("  Attributes:");
-					for (const [k, v] of attrEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+					for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 				}
 				lines.push("");
 			}
@@ -67827,11 +68001,31 @@ async function stateResourcesCommand(stackName, options) {
 *
 * Scalar values render as-is; objects/arrays are JSON-encoded inline so a
 * resource block stays compact even when an attribute is structured.
+*
+* Control characters are stripped HERE rather than at each call site (issue
+* #1948 review), because every caller has the same provenance problem and the
+* same answer: an Outputs value, a resource PROPERTY and a provider-returned
+* ATTRIBUTE are all values cdkd resolved or read back, none of them passed a
+* CloudFormation validator, and all three land in the same terminal. Doing it
+* once means a future caller cannot forget — the half-applied version of this
+* guard is what the review caught.
+*
+* The FULL class (C0 included), unlike `diff-recursive`'s
+* `stripDisplayOnlyChars`: that narrower guard exists to protect a
+* PRETTY-PRINTED payload's structural newlines, and this function never
+* pretty-prints — `JSON.stringify` is called without an indent, so a newline
+* here is content injected by the value, not layout.
+*
+* Only the human path routes through this; `--json` serializes the state
+* record directly and stays byte-faithful, which is the same split
+* `renderOutputChangeLines` makes.
 */
 function formatAttributeValue(value) {
 	if (value === null) return "null";
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
-	return JSON.stringify(value);
+	if (value === void 0) return "undefined";
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return stripControlChars(String(value));
+	const json = JSON.stringify(value);
+	return json === void 0 ? "(unserializable)" : stripControlChars(json);
 }
 /**
 * Render a duration in milliseconds as `1m23s` / `45s`.
@@ -67933,7 +68127,7 @@ function renderStateBlock(state, lockInfo) {
 	if (outputEntries.length > 0) {
 		lines.push("");
 		lines.push("Outputs:");
-		for (const [k, v] of outputEntries) lines.push(`  ${k}: ${formatAttributeValue(v)}`);
+		for (const [k, v] of outputEntries) lines.push(`  ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 	}
 	const resourceEntries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 	lines.push("");
@@ -67942,7 +68136,7 @@ function renderStateBlock(state, lockInfo) {
 		lines.push("");
 		lines.push(logicalId);
 		lines.push(`  Type: ${resource.resourceType}`);
-		lines.push(`  PhysicalID: ${resource.physicalId}`);
+		lines.push(`  PhysicalID: ${stripControlChars(resource.physicalId)}`);
 		const provisionedBy = resource.provisionedBy ?? "(sdk, legacy default)";
 		lines.push(`  ProvisionedBy: ${provisionedBy}`);
 		const deps = resource.dependencies ?? [];
@@ -67951,13 +68145,13 @@ function renderStateBlock(state, lockInfo) {
 		if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 		else {
 			lines.push("  Attributes:");
-			for (const [k, v] of attrEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 		}
 		const propEntries = Object.entries(resource.properties ?? {});
 		if (propEntries.length === 0) lines.push("  Properties: (none)");
 		else {
 			lines.push("  Properties:");
-			for (const [k, v] of propEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of propEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 		}
 	}
 	return lines;
@@ -68628,6 +68822,19 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 	}
 }
 /**
+* The secrets map every redaction on this command's paths gets, and it is
+* EMPTY by construction (issue #1926).
+*
+* `cdkd state refresh-observed` neither synthesizes a template nor resolves a
+* dynamic reference, so no plaintext is ever recorded here and a VALUE scan
+* would have no needles at all. That is the issue #1900 shape, and it is why
+* the PATH pass has to carry the redaction on its own — see the call site.
+*
+* Shared rather than constructed per resource because nothing writes to it:
+* `redactSecretsForState` only reads its argument.
+*/
+const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Refresh the `observedProperties` of every resource in one stack
 * record. Returns counts so the caller can aggregate across `--all`.
 *
@@ -68706,7 +68913,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						unsupported++;
 						return;
 					}
-					resource.observedProperties = observed;
+					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -68747,7 +68954,7 @@ async function confirmRefresh(prompt) {
 * Create the `state refresh-observed` subcommand.
 */
 function createStateRefreshObservedCommand() {
-	const cmd = new Command("refresh-observed").description("Refresh observedProperties for every resource in a stack by calling provider.readCurrentState — populates the drift baseline for stacks deployed before state schema v3, without redeploying.").argument("[stacks...]", "Stack name(s) to refresh (physical CloudFormation names)").option("--all", "Refresh every stack in the state bucket", false).option("--dry-run", "Print the per-stack refresh count without writing state", false).addOption(stackRegionOption$1()).action(withErrorHandling(stateRefreshObservedCommand));
+	const cmd = new Command("refresh-observed").description("Refresh observedProperties for every resource in a stack by calling provider.readCurrentState — populates the drift baseline for stacks deployed before state schema v3, without redeploying. Run cdkd scrub first on state written by a pre-GHSA binary: the readback is redacted by POSITION against the record, so a record whose own properties still hold plaintext has nothing to redact from.").argument("[stacks...]", "Stack name(s) to refresh (physical CloudFormation names)").option("--all", "Refresh every stack in the state bucket", false).option("--dry-run", "Print the per-stack refresh count without writing state", false).addOption(stackRegionOption$1()).action(withErrorHandling(stateRefreshObservedCommand));
 	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -69864,6 +70071,107 @@ const KEY_TERMINATORS = "[^\\s\"'?]";
 */
 const GC_EXTRA_URL_SUFFIXES = [];
 /**
+* Every AWS partition's URL suffix. The asset-reference matchers match the
+* suffix against this CLOSED SET instead of hardcoding one literal
+* (issue #1781).
+*
+* Before this list, all three matchers spelled `amazonaws\.com` inline, so a
+* state file written in `aws-cn` / `us-iso*` / `us-isob*` (recording
+* `amazonaws.com.cn` / `c2s.ic.gov` / `sc2s.sgov.gov` hosts) matched none of
+* them and its assets read as UNREFERENCED.
+*
+* **What that actually deleted, measured rather than assumed.** The blast
+* radius is narrower than "every live asset" but still a silent, irreversible
+* delete:
+*
+* - **S3 was already rescued**, by accident. {@link CONTENT_HASH_KEY_RE}
+*   collects `<sha256>.<ext>` tokens out of ANY string regardless of host, and
+*   cdkd's file assets are content-addressed with an extension — so a
+*   non-commercial `https://…amazonaws.com.cn/<sha256>.zip` still had its key
+*   protected by the name-independent pass. Measured on a real `--dry-run`
+*   against a seeded `cn-north-1` state file: 71 of 72 objects, including the
+*   referenced one, were protected with the matchers still broken.
+* - **ECR was NOT rescued, and is where the bug actually deleted.** cdkd's
+*   image tags are bare 64-hex with no `.<ext>` tail, so the content-hash pass
+*   cannot see them, and digests are `sha256:<hex>` — also no tail. With the
+*   ECR matcher missing the suffix, a referenced non-commercial image is
+*   selected for deletion. That is the case the live test reproduced.
+*
+* Either way the failure direction is the opposite of the #1758 / #1745 sites,
+* which merely emit a host that does not resolve.
+*
+* Two properties of this list are load-bearing:
+*
+* - It is the union over ALL partitions, not
+*   `derivePartitionAndUrlSuffix(region).urlSuffix` for the caller's region.
+*   The scan reads EVERY state file in the state bucket, written by any cdkd
+*   binary for any region, so it must match every partition at once; a single
+*   derived literal would still delete a `cn-north-1` stack's images during a
+*   `us-east-1` gc run.
+* - It is a SUPERSET of the arms {@link derivePartitionAndUrlSuffix} knows
+*   (issue #1764). A suffix missing HERE deletes live assets, which is the
+*   irreversible direction, so this list must lead that table rather than
+*   follow it.
+*
+* The superset property is now MECHANICAL rather than hand-maintained (issue
+* #1785): the list is built FROM {@link PARTITION_TABLE} plus
+* {@link GC_EXTRA_URL_SUFFIXES}, so a partition arm added to that table
+* propagates here in the same commit instead of silently outrunning gc. It
+* used to be a hand-written literal, and the test meant to fence it iterated a
+* hand-written region list — so a new arm in the derive table redded nothing.
+*
+* It is a closed SET rather than a `[^/\s]+` wildcard so a look-alike host
+* (`https://<assetBucket>.s3.<region>.example.com/<key>`) is not treated as a
+* cdkd asset reference. That direction only ever over-PROTECTS, but it would
+* also let any string embedding the bucket name pin an object forever, which
+* quietly turns gc into a no-op.
+*
+* NOTE this is a weaker check than `src/utils/ecr-uri.ts`, which CAPTURES the
+* suffix and validates it against the region the host names. That is the right
+* shape there (one host, one caller-known region) and the wrong shape here:
+* the region in a scanned string is not necessarily the region whose partition
+* the suffix must belong to, and pairing them would re-inherit #1764's missing
+* arms on the irreversible side.
+*/
+const AWS_URL_SUFFIXES = [.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])];
+/**
+* Spell an ASCII literal so it matches case-INSENSITIVELY inside a
+* case-SENSITIVE `RegExp`: `s3` → `[sS]3`, `amazonaws.com` →
+* `[aA][mM][aA][zZ][oO][nN][aA][wW][sS]\.[cC][oO][mM]`. EVERY character goes
+* through {@link escapeRegExp} first and the ASCII letters are folded after,
+* so the result is exactly as strict as an escaped literal outside the letters
+* it folds.
+*
+* This exists because gc must fold only PART of a pattern (issue #1847). Host
+* names are case-insensitive, so
+* `https://<assetBucket>.s3.<region>.AMAZONAWS.COM/<key>` in a state file names
+* the same object as the lower-cased spelling — and a reference gc misses reads
+* as UNREFERENCED, so the live object is DELETED. The obvious fix, the `i` flag
+* the ECR matcher carries, is per-REGEX and therefore all-or-nothing: it cannot
+* fold the host while leaving a KEY or a path-segment bucket exact, and those
+* segments are genuinely case-sensitive at S3. Which segment gets folded is
+* decided per shape at the matchers themselves — see the block above
+* `s3UriRe` for the authority / path-segment / DNS-label split.
+*
+* Two further properties are load-bearing:
+*
+* - Folding by character class rather than by flag leaves
+*   {@link URL_SUFFIX_ALTERNATION} — SHARED with the ECR matcher — spelled
+*   exactly as that matcher's own review settled it, so the S3 side cannot
+*   quietly redefine the constant the ECR side reads (issues #1792 / #1793).
+* - A two-character class is not `/k/i`. Under a `u` flag the `i` flag
+*   canonicalizes U+212A KELVIN SIGN onto ASCII `k` — the hazard
+*   `src/utils/ecr-uri.ts` guards its region / suffix checks against —
+*   whereas `[kK]` matches those two code points and nothing else, with or
+*   without `u`. (Measured, and pinned by `tests/unit/cli/gc.test.ts`:
+*   `/k/iu` matches U+212A, `/[kK]/u` does not.) The matchers below carry no
+*   `u` flag today, so this is about what adding one later could silently
+*   widen: with classes, nothing.
+*/
+function caseFoldLiteral(literal) {
+	return escapeRegExp(literal).replace(/[A-Za-z]/g, (ch) => `[${ch.toLowerCase()}${ch.toUpperCase()}]`);
+}
+/**
 * `(?:amazonaws\.com\.cn|amazonaws\.com|...)` — {@link AWS_URL_SUFFIXES} as a
 * non-capturing alternation, LONGEST FIRST so `amazonaws.com.cn` is tried
 * before its own `amazonaws.com` prefix instead of relying on backtracking.
@@ -69873,8 +70181,48 @@ const GC_EXTRA_URL_SUFFIXES = [];
 * the ECR digest), and this alternation sits BEFORE those groups in all three
 * patterns. Making it capturing would shift every index by one and silently
 * collect the suffix as if it were a key.
+*
+* `spellSuffix` decides how each suffix is written out, so the SET, the
+* longest-first order and the non-capturing property keep exactly one
+* definition while the two consumers differ in case handling — see
+* {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED}.
 */
-const URL_SUFFIX_ALTERNATION = `(?:${[...[.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
+function buildUrlSuffixAlternation(spellSuffix) {
+	return `(?:${[...AWS_URL_SUFFIXES].sort((a, b) => b.length - a.length).map(spellSuffix).join("|")})`;
+}
+/**
+* The case-SENSITIVE spelling, consumed by {@link ECR_REGISTRY_HOST}.
+*
+* Folding THIS constant would be inert for its only consumer — the ECR matcher
+* carries the `i` flag, so it already matches an upper-cased suffix either way.
+* The constraint is the other direction: this is the spelling the ECR side's
+* own review settled on (issues #1792 / #1793), and the S3 matchers must widen
+* through their own {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED} copy rather than
+* by editing the shared one, so an S3-side change can never reach the ECR
+* grammar.
+*/
+const URL_SUFFIX_ALTERNATION = buildUrlSuffixAlternation(escapeRegExp);
+/**
+* The case-FOLDED spelling, consumed by the three S3 matchers (issue #1847).
+* Same suffix set, same order, letters folded per {@link caseFoldLiteral} — so
+* an upper-cased or mixed-case host suffix collects the key. Still a CLOSED
+* set: folding widens the SPELLING of each suffix, never which suffixes count.
+*/
+const URL_SUFFIX_ALTERNATION_CASE_FOLDED = buildUrlSuffixAlternation(caseFoldLiteral);
+/**
+* `[sS]3`, case-folded (issue #1847). One constant for BOTH places the literal
+* `s3` appears: the `s3://` URI SCHEME and the `s3` HOST LABEL of the two HTTPS
+* shapes. The two roles differ but the spelling and the fold argument are the
+* same, and a single constant is what stops the three matchers drifting into
+* two different spellings of it.
+*/
+const S3_SEGMENT_CASE_FOLDED = caseFoldLiteral("s3");
+/**
+* `[hH][tT][tT][pP][sS]` — the URI scheme, case-folded (issue #1847). A scheme
+* is case-insensitive by RFC 3986 §3.1, and folding a fixed literal that is
+* neither the bucket name nor the key can only ever over-PROTECT.
+*/
+const HTTPS_SCHEME_CASE_FOLDED = caseFoldLiteral("https");
 /**
 * The HOST half of an ECR registry, built from the ONE authoritative FORM TABLE
 * in `src/utils/ecr-uri.ts` (issue #1793) instead of spelled a second time here.
@@ -69967,16 +70315,21 @@ function tryDecodeBase64Text(value) {
 *   account's or region's URI can only over-protect (keep more), never
 *   delete more.
 *
-* `<urlSuffix>` in the two S3 shapes is {@link URL_SUFFIX_ALTERNATION}, i.e.
-* EVERY partition's suffix at once — see that constant for why a per-region
-* derived literal is the wrong shape here (issue #1781).
+* `<urlSuffix>` in the two S3 shapes is
+* {@link URL_SUFFIX_ALTERNATION_CASE_FOLDED}, i.e. EVERY partition's suffix at
+* once — see {@link AWS_URL_SUFFIXES} for why a per-region derived literal is
+* the wrong shape here (issue #1781). Every S3 HOST segment is matched
+* case-insensitively, including the bucket label of the virtual-hosted shape,
+* while the KEY and the bucket in the other two shapes stay EXACT (issue
+* #1847); the per-shape reasoning is in the block above `s3UriRe`.
 */
 function buildReferenceExtractors(marker) {
-	const bucket = escapeRegExp(marker.assetBucket);
+	const bucketExact = escapeRegExp(marker.assetBucket);
+	const bucketFolded = caseFoldLiteral(marker.assetBucket);
 	const repo = escapeRegExp(marker.containerRepo);
-	const s3UriRe = new RegExp(`s3://${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/(${KEY_TERMINATORS}+)`, "g");
-	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/${bucket}/(${KEY_TERMINATORS}+)`, "g");
+	const s3UriRe = new RegExp(`${S3_SEGMENT_CASE_FOLDED}://${bucketExact}/(${KEY_TERMINATORS}+)`, "g");
+	const virtualHostedRe = new RegExp(`${HTTPS_SCHEME_CASE_FOLDED}://${bucketFolded}\\.${S3_SEGMENT_CASE_FOLDED}[^/\\s]*\\.${URL_SUFFIX_ALTERNATION_CASE_FOLDED}/(${KEY_TERMINATORS}+)`, "g");
+	const pathStyleRe = new RegExp(`${HTTPS_SCHEME_CASE_FOLDED}://${S3_SEGMENT_CASE_FOLDED}[^/\\s]*\\.${URL_SUFFIX_ALTERNATION_CASE_FOLDED}/${bucketExact}/(${KEY_TERMINATORS}+)`, "g");
 	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "gi");
 	const extractOnce = (value, refs) => {
 		for (const re of [
@@ -70245,9 +70598,10 @@ async function gcCommand(options) {
 	logger.debug("Options:", options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
-		region: options.region
+		region: canonicalizeRegion(options.region)
 	});
-	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const rawRegion = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
 	const awsClients = new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
@@ -70272,9 +70626,18 @@ async function gcCommand(options) {
 	});
 	try {
 		const markerKey = getBootstrapMarkerKey(region);
+		const rawMarkerKey = getBootstrapMarkerKey(rawRegion);
 		let markerBody;
+		let resolvedMarkerKey = markerKey;
 		try {
 			markerBody = await stateBackend.getRawObject(markerKey);
+			if (markerBody === null && rawMarkerKey !== markerKey) {
+				markerBody = await stateBackend.getRawObject(rawMarkerKey);
+				if (markerBody !== null) {
+					resolvedMarkerKey = rawMarkerKey;
+					logger.debug(`Bootstrap marker found at the un-folded key '${rawMarkerKey}' (none at '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+				}
+			}
 		} catch (error) {
 			if (error.name === "NoSuchBucket") {
 				logger.info(`State bucket '${bucketName}' does not exist — this account was never bootstrapped; nothing to garbage-collect.`);
@@ -70283,10 +70646,11 @@ async function gcCommand(options) {
 			throw error;
 		}
 		if (markerBody === null) {
-			logger.info(`No bootstrap marker for region '${region}' (${markerKey}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
+			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
+			logger.info(`No bootstrap marker for region '${region}' (${probed}) — the region is not opted in to cdkd asset storage; nothing to garbage-collect. (CDK bootstrap storage is 'cdk gc' territory.)`);
 			return;
 		}
-		const marker = parseBootstrapMarker(markerBody, markerKey);
+		const marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
 			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX)}  [${k}]`).join("\n");
@@ -82117,7 +82481,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.6");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.8");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;