@go-to-k/cdkd 0.298.6 → 0.298.8

package/dist/{program-BYoddGM7.js → program-MMwB_CTT.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as isStatefulRecreateTargetForReplace, $c as warnDeprecatedNoPrefixCliFlag, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as AssetPublisher, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactDockerArgvValues, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as LockManager, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as Synthesizer, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as splitImportedOps, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as dockerSpawnEnvWithSensitive, Ci as cfnRefValueFromPhysicalId, Cl as renderAssemblyPathEscape, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as wholeStringLeavesOf, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isDockerClientEnvKey, Di as withSharedDrainBudget, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as TEMPLATE_SOURCED_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as getDockerCmd, El as resolveBucketRegion, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as STATE_SOURCED_READBACK_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as escapeRegExp, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as CrossPrefixScanCache, Ft as sameJournaledOrphans, Gc as resolveApp, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasReasonlessBaselineRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as getDefaultStateBucketName, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as describeRegionValueKind, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as stripControlChars, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as applyCrossPrefixScan, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveSkipPrefix, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as importableOutputs, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveAutoAssetStorage, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as hasUnverifiableParameterRefusal, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as stripForDisplay, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as crossPrefixDeniedWarning, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as runDockerForeground, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as S3StateBackend, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as runDockerStreaming, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as rebuildClientForBucketRegion, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as isMalformedEnvKey, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as warnFinchArgvExposure, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixReadError, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as stateBucketExistenceConfirmed, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as shouldRetainResource, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as AssetManifestLoader, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isAccessDenied, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as describeDockerFailure, Si as AWS_NO_VALUE, Sl as displayAssemblyPath, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as recordProvenPublicExpression, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as formatDockerLoginError, Ti as refStateLookupFromResource, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_CROSS_GENERATION_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as getLegacyStateBucketName, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as exportNamesCarriedFrom, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as synthesisStatusMessage, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as acceptedCreateOnlyDropsOf, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as loadCdkJson, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReadableExportSet, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as resolveStateBucketWithDefaultAndSource, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansAfterRollback, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveStateBucketWithDefault, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as isReadableBag, Yt as recheckFailedPlan, Za as shownType, Zc as resolveUseCdkBootstrapAssets, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as orphansCarriedFrom, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDenyExternalAccessPolicy, _i as isImpossibleEmptyStoredAttribute, _l as hasPlainPrototype, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as provenPublicValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as loadPublishableAssetManifest, al as uploadCfnTemplate, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerCapturedOutput, bi as isNamelessDynamicReferenceError, bl as absoluteAssemblyPathEscape, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoAttributeValues, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as BOOTSTRAP_MARKER_PREFIX, cl as expectedOwnerParam, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as getBootstrapMarkerKey, di as producerRegionsFromState, dl as derivePartitionAndUrlSuffix, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as isSensitiveAttributeName, ei as AWS_CREDENTIAL_ENV_KEYS, el as ssmResolvedValueType, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as isCrossRegionRedirect, fi as regionLessSecretName, fl as AssemblyReader, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as validateContainerRepoName, gi as getAccountInfo, gl as hasOwnKey, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as carriesSecretMask, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateAssetBucketName, hi as parameterTypeMayLoseSecretIdentity, hl as defineOwnKey, hn as secretBearing, hr as isCustomResource, hs as splitGetAttStringForm, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as createAssetRedirectResolver, il as findLargeInlineResources, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as redactedDockerCause, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as isLockInfoExpired, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as partitionSensitiveEnv, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as isSingleDynamicReferenceToken, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as assertAssetBucketRegion, ll as PARTITION_TABLE, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as readBootstrapMarkerBody, mi as isUnboundTemplateParameter, ml as processStackMessages, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as recordPhysicalNameCopy, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as WorkGraph, ni as callerEnvCredentials, nl as CFN_TEMPLATE_URL_LIMIT, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as rewriteTemplateAssetReferences, ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as parseBootstrapMarker, pi as coerceParameterTypedValue, pl as StageLoadError, pn as displayTextOrWithheld, pr as ProviderRegistry, pt as resourcesNamingDeclaredParameter, qc as resolveCaptureObservedState, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputKeys, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as buildAssetRedirectMap, ri as envCredentialsAreAssumedRole, rl as MIGRATE_TMP_PREFIX, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as AssetModeResolver, sl as decodeListingKey, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as stringifyValue, ti as applyCallerIdentityCredentials, tl as CFN_TEMPLATE_BODY_LIMIT, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as ensureAssetStorage, ui as classifyReplaySecretRegion, ul as canonicalizeRegion, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as buildDockerImage, vi as carriesDynamicReference, vl as nullPrototypeRecord, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValue, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as finchSecretArgvRefusal, wi as isStalePlaceholderArnAttribute, wl as resolveAssemblyPath, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_BASELINE_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerExecFailure, xi as keepsSecretReferenceToken, xl as describeFileReadFailure, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordNoEchoParameterFreshValue, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as resolveDockerContextDirectory, yi as carriesFetchableDynamicReference, yl as ownValue, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordMaskOnlyValuesIn, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as getDockerImageBySourceHash, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as isNotImplemented, zt as destroyStackRecordsView } from "./deploy-engine-BhJ7GrCh.js";
-import { t as getCdkdVersion } from "./version-B28nhaco.js";
+import { $a as isStatefulRecreateTargetForReplace, $c as stateBucketExistenceConfirmed, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as AssetPublisher, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactDockerArgvValues, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as LockManager, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as getDockerImageBySourceHash, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as splitImportedOps, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as dockerSpawnEnvWithSensitive, Ci as cfnRefValueFromPhysicalId, Cl as displayAssemblyPath, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as wholeStringLeavesOf, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isDockerClientEnvKey, Di as withSharedDrainBudget, Dl as injectedAwsRegionValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as TEMPLATE_SOURCED_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as getDockerCmd, El as injectAwsRegion, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as STATE_SOURCED_READBACK_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as warnFinchArgvExposure, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as CrossPrefixScanCache, Ft as sameJournaledOrphans, Gc as loadCdkJson, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasReasonlessBaselineRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as synthesisStatusMessage, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as describeRegionValueKind, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as escapeRegExp, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as applyCrossPrefixScan, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveCaptureObservedState, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as importableOutputs, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveApp, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as hasUnverifiableParameterRefusal, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as stripControlChars, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as crossPrefixDeniedWarning, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as redactedDockerCause, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as S3StateBackend, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as runDockerForeground, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as rebuildClientForBucketRegion, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as isMalformedEnvKey, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as runDockerStreaming, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixReadError, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as resolveUseCdkBootstrapAssets, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as shouldRetainResource, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as stripForDisplay, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isAccessDenied, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as describeDockerFailure, Si as AWS_NO_VALUE, Sl as describeFileReadFailure, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as recordProvenPublicExpression, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as formatDockerLoginError, Ti as refStateLookupFromResource, Tl as resolveAssemblyPath, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_CROSS_GENERATION_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as getDefaultStateBucketName, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as exportNamesCarriedFrom, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as Synthesizer, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as acceptedCreateOnlyDropsOf, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as getLegacyStateBucketName, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReadableExportSet, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as resolveStateBucketWithDefault, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansAfterRollback, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveSkipPrefix, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as isReadableBag, Yt as recheckFailedPlan, Za as shownType, Zc as resolveStateBucketWithDefaultAndSource, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as orphansCarriedFrom, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDenyExternalAccessPolicy, _i as isImpossibleEmptyStoredAttribute, _l as hasOwnKey, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as provenPublicValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as loadPublishableAssetManifest, al as findLargeInlineResources, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerCapturedOutput, bi as isNamelessDynamicReferenceError, bl as ownValue, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoAttributeValues, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as BOOTSTRAP_MARKER_PREFIX, cl as decodeListingKey, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as getBootstrapMarkerKey, di as producerRegionsFromState, dl as canonicalizeRegion, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as isSensitiveAttributeName, ei as AWS_CREDENTIAL_ENV_KEYS, el as warnDeprecatedNoPrefixCliFlag, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as isCrossRegionRedirect, fi as regionLessSecretName, fl as derivePartitionAndUrlSuffix, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as validateContainerRepoName, gi as getAccountInfo, gl as defineOwnKey, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as carriesSecretMask, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateAssetBucketName, hi as parameterTypeMayLoseSecretIdentity, hl as processStackMessages, hn as secretBearing, hr as isCustomResource, hs as splitGetAttStringForm, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as createAssetRedirectResolver, il as MIGRATE_TMP_PREFIX, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as redactedCause, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as isLockInfoExpired, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as partitionSensitiveEnv, kl as resolveBucketRegion, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as isSingleDynamicReferenceToken, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as assertAssetBucketRegion, ll as expectedOwnerParam, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as readBootstrapMarkerBody, mi as isUnboundTemplateParameter, ml as StageLoadError, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as recordPhysicalNameCopy, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as WorkGraph, ni as callerEnvCredentials, nl as CFN_TEMPLATE_BODY_LIMIT, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as rewriteTemplateAssetReferences, ol as uploadCfnTemplate, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as parseBootstrapMarker, pi as coerceParameterTypedValue, pl as AssemblyReader, pn as displayTextOrWithheld, pr as ProviderRegistry, pt as resourcesNamingDeclaredParameter, qc as resolveAutoAssetStorage, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputKeys, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as buildAssetRedirectMap, ri as envCredentialsAreAssumedRole, rl as CFN_TEMPLATE_URL_LIMIT, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as AssetModeResolver, sl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as stringifyValue, ti as applyCallerIdentityCredentials, tl as ssmResolvedValueType, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as ensureAssetStorage, ui as classifyReplaySecretRegion, ul as PARTITION_TABLE, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as buildDockerImage, vi as carriesDynamicReference, vl as hasPlainPrototype, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValue, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as finchSecretArgvRefusal, wi as isStalePlaceholderArnAttribute, wl as renderAssemblyPathEscape, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_BASELINE_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerExecFailure, xi as keepsSecretReferenceToken, xl as absoluteAssemblyPathEscape, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordNoEchoParameterFreshValue, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as resolveDockerContextDirectory, yi as carriesFetchableDynamicReference, yl as nullPrototypeRecord, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordMaskOnlyValuesIn, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as AssetManifestLoader, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as isNotImplemented, zt as destroyStackRecordsView } from "./deploy-engine-HKmcD4Kn.js";
+import { t as getCdkdVersion } from "./version-n6UXfuUI.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -345,6 +345,10 @@ async function resolveEffectiveRegion(options) {
 		source: "flag"
 	};
 	const awsRegion = canonicalizeRegion(process.env["AWS_REGION"]);
+	if (awsRegion && awsRegion === injectedAwsRegionValue()) return {
+		region: awsRegion,
+		source: "default-env"
+	};
 	if (awsRegion) return {
 		region: awsRegion,
 		source: "env"
@@ -364,6 +368,10 @@ async function resolveEffectiveRegion(options) {
 		source: "default"
 	};
 }
+function exportInferredRegionForSdk(effective) {
+	if (effective.source !== "default-env") return;
+	injectAwsRegion(effective.region);
+}
 const LEGACY_DEFAULT_REGION = "us-east-1";
 async function resolveSdkDefaultRegion(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
@@ -380,6 +388,113 @@ async function resolveSdkDefaultRegion(profile) {
 		client?.destroy?.();
 	}
 }
+function ownedByLegacyDefault(probe) {
+	return { stateExists: (stackName, region) => probe.stateExistsOwnedBy(stackName, region, LEGACY_DEFAULT_REGION) };
+}
+async function placeStack(effective, stackName, probe) {
+	const [inResolved, inLegacy] = await Promise.all([probe.stateExists(stackName, effective.region), probe.stateExists(stackName, LEGACY_DEFAULT_REGION)]);
+	if (inResolved && inLegacy) return "both";
+	if (inResolved) return "resolved";
+	return inLegacy ? "legacy" : "none";
+}
+function bothRegionsMessage(effective, stackName) {
+	return `Stack ${quoteStackName(stackName)} has state in both ${LEGACY_DEFAULT_REGION} and ${displayIdent(effective.region)} (which ${inferredFrom(effective)} resolves). Continuing to use ${LEGACY_DEFAULT_REGION}, as a command with no region named did before. Set AWS_REGION=${displayIdent(effective.region)} to work on the ${displayIdent(effective.region)} one, or AWS_REGION=${LEGACY_DEFAULT_REGION} to silence this message.`;
+}
+function inferredFrom(effective) {
+	return effective.source === "default-env" ? "AWS_DEFAULT_REGION" : "your AWS profile";
+}
+function holdMessage(effective, stackName) {
+	return `Stack ${quoteStackName(stackName)} has existing state in ${LEGACY_DEFAULT_REGION}, but ${inferredFrom(effective)} resolves ${displayIdent(effective.region)}. Continuing to use ${LEGACY_DEFAULT_REGION} so the existing stack is not duplicated. Set AWS_REGION=${LEGACY_DEFAULT_REGION} to silence this message, or AWS_REGION=${displayIdent(effective.region)} to work in ${displayIdent(effective.region)} instead (where this stack has no state).`;
+}
+function quoteStackName(stackName) {
+	return displayIdent(stackName) === stackName ? `'${stackName}'` : "a stack whose name is not a plain identifier";
+}
+function stackRegionResolver(input) {
+	const { effective, logger } = input;
+	const probe = ownedByLegacyDefault(input.probe);
+	const placements = /* @__PURE__ */ new Map();
+	const place = (stackName) => {
+		let placement = placements.get(stackName);
+		if (placement === void 0) {
+			placement = placeStack(effective, stackName, probe);
+			placement.catch(() => placements.delete(stackName));
+			placements.set(stackName, placement);
+		}
+		return placement;
+	};
+	const answers = /* @__PURE__ */ new Map();
+	const answer = async (stackName) => {
+		const placement = await place(stackName);
+		if (placement === "legacy" || placement === "both") {
+			logger.info(placement === "both" ? bothRegionsMessage(effective, stackName) : holdMessage(effective, stackName));
+			return LEGACY_DEFAULT_REGION;
+		}
+		if (placement === "resolved") return effective.region;
+		const others = (input.siblings ?? []).filter((name) => name !== stackName);
+		const siblingPlacements = await Promise.all(others.map(place));
+		if (siblingPlacements.some((p) => p === "legacy" || p === "both") && !siblingPlacements.includes("resolved")) {
+			logger.info(`Stack ${quoteStackName(stackName)} has no state yet, and the other stacks of this app that have state all stay in ${LEGACY_DEFAULT_REGION}, while ${inferredFrom(effective)} resolves ${displayIdent(effective.region)}. Using ${LEGACY_DEFAULT_REGION} for it too, so the app stays in one region. Set AWS_REGION=${LEGACY_DEFAULT_REGION} to silence this message.`);
+			return LEGACY_DEFAULT_REGION;
+		}
+		return effective.region;
+	};
+	return (stackName, pinned) => {
+		if (pinned) return Promise.resolve(pinned);
+		if (!regionNeedsReconciliation(effective)) return Promise.resolve(effective.region);
+		let result = answers.get(stackName);
+		if (result === void 0) {
+			result = answer(stackName);
+			result.catch(() => answers.delete(stackName));
+			answers.set(stackName, result);
+		}
+		return result;
+	};
+}
+function stateWithRegion(state, region) {
+	return state.region ? state : {
+		...state,
+		region
+	};
+}
+function legacyStateBucketFallbackRegion(effective) {
+	return regionNeedsReconciliation(effective) ? LEGACY_DEFAULT_REGION : void 0;
+}
+async function reconcileExportIndexRegion(input) {
+	const { effective, probe, statePrefix, logger } = input;
+	if (!regionNeedsReconciliation(effective)) return effective.region;
+	const indexKey = (region) => `${statePrefix}/_index/${region}/exports.json`;
+	try {
+		if (!await probe.rawObjectExists(indexKey("us-east-1"))) return effective.region;
+	} catch (error) {
+		logger.warn(safeMsg`[region] could not probe the exports index (${error.name ?? "error"}); using ${effective.region}.`);
+		return effective.region;
+	}
+	logger.debug(safeMsg`[region] exports index exists in ${LEGACY_DEFAULT_REGION}; using it rather than ${effective.region} (inferred).`);
+	return LEGACY_DEFAULT_REGION;
+}
+function withOtherIndexRemoval(runStore, input) {
+	const { effective, runIndexRegion, statePrefix, probe, createStore, logger } = input;
+	const other = runIndexRegion === "us-east-1" ? effective.region : LEGACY_DEFAULT_REGION;
+	if (!regionNeedsReconciliation(effective) || other === runIndexRegion) return runStore;
+	let otherStore;
+	const removeFromOther = async (stackName, region) => {
+		try {
+			otherStore ??= probe.rawObjectExists(`${statePrefix}/_index/${other}/exports.json`).then((exists) => exists ? createStore(other) : void 0);
+			await (await otherStore)?.removeStackIfPresent(stackName, region);
+		} catch (error) {
+			otherStore = void 0;
+			logger.warn(safeMsg`Could not remove ${stackName}'s entries from the ${other} exports index (${error.name ?? "error"}); a later Fn::ImportValue may read a stale value from it.`);
+		}
+	};
+	return new Proxy(runStore, { get(target, prop, receiver) {
+		if (prop === "removeStack") return async (stackName, region) => {
+			await target.removeStack(stackName, region);
+			await removeFromOther(stackName, region);
+		};
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
 async function reconcileMarkerRegionWithLegacyDefault(input) {
 	const { effective, probe, markerKeyFor, logger } = input;
 	if (!regionNeedsReconciliation(effective)) return effective.region;
@@ -926,7 +1041,7 @@ async function bootstrapCommand(options) {
 	}
 }
 function createBootstrapCommand() {
-	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating the S3 state bucket plus cdkd-owned asset storage (asset bucket + container-asset ECR repo) for the region. With --destroy, tear down the region's asset storage instead.").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Create: force reconfiguration of an existing bucket. Destroy: delete the asset storage even when deployed stacks still reference it", false).option("--no-assets", "Skip cdkd asset storage (asset bucket / ECR repo / marker) — deploys keep publishing assets to the CDK bootstrap bucket/repo").option("--asset-bucket <name>", "Custom name for the cdkd asset bucket (default: cdkd-assets-{accountId}-{region}). Written into the bootstrap marker; re-bootstrapping a region with a different name is refused").option("--container-repo <name>", "Custom name for the container-asset ECR repository (default: cdkd-container-assets-{accountId}-{region}). Written into the bootstrap marker; re-bootstrapping a region with a different name is refused").option("--destroy", "Tear down the region's cdkd asset storage (empty + delete the asset bucket, force-delete the container-asset ECR repo, then delete the bootstrap marker last). The state bucket is kept unless --include-state-bucket is also passed", false).option("--include-state-bucket", "With --destroy: also delete the S3 state bucket. Refused while any stack state exists or any other region is still opted in to asset storage", false).addOption(new Option("--region <region>", "AWS region to bootstrap, or to tear down with --destroy (defaults to AWS_REGION env, else us-east-1)")).action(withErrorHandling(async (options) => {
+	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating the S3 state bucket plus cdkd-owned asset storage (asset bucket + container-asset ECR repo) for the region. With --destroy, tear down the region's asset storage instead.").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Create: force reconfiguration of an existing bucket. Destroy: delete the asset storage even when deployed stacks still reference it", false).option("--no-assets", "Skip cdkd asset storage (asset bucket / ECR repo / marker) — deploys keep publishing assets to the CDK bootstrap bucket/repo").option("--asset-bucket <name>", "Custom name for the cdkd asset bucket (default: cdkd-assets-{accountId}-{region}). Written into the bootstrap marker; re-bootstrapping a region with a different name is refused").option("--container-repo <name>", "Custom name for the container-asset ECR repository (default: cdkd-container-assets-{accountId}-{region}). Written into the bootstrap marker; re-bootstrapping a region with a different name is refused").option("--destroy", "Tear down the region's cdkd asset storage (empty + delete the asset bucket, force-delete the container-asset ECR repo, then delete the bootstrap marker last). The state bucket is kept unless --include-state-bucket is also passed", false).option("--include-state-bucket", "With --destroy: also delete the S3 state bucket. Refused while any stack state exists or any other region is still opted in to asset storage", false).addOption(new Option("--region <region>", "AWS region to bootstrap, or to tear down with --destroy (defaults to AWS_REGION, AWS_DEFAULT_REGION, the profile's region, else us-east-1; an inferred region keeps existing us-east-1 asset storage)")).action(withErrorHandling(async (options) => {
 		if (options.destroy) {
 			if (options.assetBucket !== void 0 || options.containerRepo !== void 0) throw new CdkdError("--asset-bucket / --container-repo cannot be combined with --destroy. The teardown reads the region's asset storage names from the bootstrap marker.", "INVALID_OPTIONS");
 			if (!options.assets) throw new CdkdError("--no-assets cannot be combined with --destroy. The teardown scope is the asset storage itself; use --include-state-bucket to also delete the state bucket.", "INVALID_OPTIONS");
@@ -2110,6 +2225,14 @@ var ExportIndexStore = class {
 	async removeStack(stackName, producerRegion) {
 		await this.enqueueWrite("remove", () => this.applyRemoveStack(stackName, producerRegion));
 	}
+	async removeStackIfPresent(stackName, producerRegion) {
+		await this.enqueueWrite("remove-if-present", async () => {
+			if (this.loadState.kind !== "loaded") {
+				if ((await this.loadPersisted()).kind !== "loaded") return true;
+			}
+			return this.applyRemoveStack(stackName, producerRegion);
+		});
+	}
 	async enqueueWrite(label, op) {
 		const next = this.writeChain.then(() => this.runWithRetry(label, op));
 		this.writeChain = next.then(() => {}, () => {});
@@ -2438,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BRNQRRLh.js");
+	providerClasses ??= import("./provider-classes--iMwAb7q.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2950,7 +3073,7 @@ async function deployCommand(stacks, options) {
 	applyWaitFlagEnv(options);
 	const requireApproval = resolveRequireApproval(options.requireApproval);
 	const approveDeployment = requireApproval !== "never" && !options.dryRun ? createApprovalPrompter({ yes: options.yes ?? false }) : void 0;
-	const rawBaseRegion = rawCliRegion(options.region) ?? "us-east-1";
+	const rawNamedRegion = rawCliRegion(options.region);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
@@ -2963,7 +3086,9 @@ async function deployCommand(stacks, options) {
 	const app = resolveApp(options.app);
 	if (!app) throw new Error("No app command specified. Use --app, set CDKD_APP env var, or add \"app\" to cdk.json");
 	options.app = app;
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
 	logger.debug("Starting deployment...");
 	logger.debug("Options:", options);
 	if (options.region) {
@@ -2971,12 +3096,12 @@ async function deployCommand(stacks, options) {
 		process.env["AWS_DEFAULT_REGION"] = options.region;
 	}
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
 	const statePrepPromise = (async () => {
-		const resolvedStateBucket = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region);
+		const resolvedStateBucket = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 		const stateBucket = resolvedStateBucket.bucket;
 		const preflightStateBackend = new S3StateBackend(awsClients.s3, {
 			bucket: stateBucket,
@@ -2986,10 +3111,24 @@ async function deployCommand(stacks, options) {
 			...options.profile && { profile: options.profile }
 		});
 		await preflightStateBackend.verifyBucketExists({ existenceAlreadyProbed: stateBucketExistenceConfirmed(resolvedStateBucket) });
+		const runIndexRegion = await reconcileExportIndexRegion({
+			effective: effectiveRegion,
+			probe: preflightStateBackend,
+			statePrefix: options.statePrefix,
+			logger
+		});
+		const newIndexStore = (indexRegion) => new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, indexRegion, preflightStateBackend, { profile: options.profile });
 		return {
 			stateBucket,
 			preflightStateBackend,
-			exportIndexStore: new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, preflightStateBackend, { profile: options.profile })
+			exportIndexStore: withOtherIndexRemoval(newIndexStore(runIndexRegion), {
+				effective: effectiveRegion,
+				runIndexRegion,
+				statePrefix: options.statePrefix,
+				probe: preflightStateBackend,
+				createStore: newIndexStore,
+				logger
+			})
 		};
 	})();
 	let deployInterrupted = false;
@@ -3095,17 +3234,24 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		if (roleArnReferences.length > 0) {
 			const stackByName = new Map(allStacks.map((s) => [s.stackName, s]));
 			refuseUnreadableCdkCrossAccountRefs(roleArnReferences, new Set(targetStacks.map((s) => s.stackName)), (name) => ({
-				region: stackByName.get(name)?.region ?? namedCliRegion(options.region),
+				region: stackByName.get(name)?.region ?? (regionNeedsReconciliation(effectiveRegion) ? void 0 : namedCliRegion(options.region)),
 				account: stackByName.get(name)?.account
 			}), producerLookup);
 		}
-		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
+		const baseRegion = region;
+		const regionForStack = stackRegionResolver({
+			effective: effectiveRegion,
+			probe: preflightStateBackend,
+			logger,
+			siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+		});
+		const stackRegions = new Map(await Promise.all(targetStacks.map(async (s) => [s.stackName, await regionForStack(s.stackName, s.region)])));
 		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
 			...awsClientDefaults(),
-			region: namedCliRegion(options.region) ?? "us-east-1"
+			region
 		});
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 		stsClient.destroy();
@@ -3137,10 +3283,10 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			const stackNodeId = `stack:${stack.stackName}`;
 			const stackDeps = /* @__PURE__ */ new Set();
 			if (stack.assetManifestPath) {
-				const assetRegion = stack.region || baseRegion;
+				const assetRegion = stackRegions.get(stack.stackName) ?? deployStackRegion(stack, baseRegion);
 				const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
 				if (manifest) {
-					const assetMode = await assetModeResolver.resolve(stack.region || rawBaseRegion);
+					const assetMode = await assetModeResolver.resolve(stack.region || rawNamedRegion || assetRegion);
 					logger.debug(`Asset mode for region ${assetRegion}: ${assetMode.mode} (stack ${stack.stackName})`);
 					let redirect;
 					if (assetMode.mode === "cdkd-assets") {
@@ -3184,7 +3330,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const runStackInner = async (stackInfo) => {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
-			const stackRegion = deployStackRegion(stackInfo, baseRegion);
+			const stackRegion = stackRegions.get(stackInfo.stackName) ?? deployStackRegion(stackInfo, baseRegion);
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
@@ -5772,12 +5918,14 @@ async function diffCommand(stacks, options) {
 	const app = resolveApp(options.app);
 	if (!app) throw new Error("No app command specified. Use --app, set CDKD_APP env var, or add \"app\" to cdk.json");
 	options.app = app;
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	logger.info("Calculating diff...");
 	logger.debug("Options:", options);
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
@@ -5819,6 +5967,12 @@ async function diffCommand(stacks, options) {
 			region,
 			...options.profile && { profile: options.profile }
 		});
+		const regionForStack = stackRegionResolver({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			logger,
+			siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+		});
 		const diffCalculator = new DiffCalculator();
 		const refusalRecovery = {
 			profile: options.profile,
@@ -5897,7 +6051,7 @@ async function diffCommand(stacks, options) {
 		const producerLookup = producerLookupOver(allStacks);
 		for (const stackInfo of targetStacks) {
 			logger.info(`\nCalculating diff for stack: ${stackInfo.stackName}`);
-			const stackRegion = stackInfo.region || region;
+			const stackRegion = await regionForStack(stackInfo.stackName, stackInfo.region);
 			const assetRedirect = await resolveAssetRedirect(stackInfo.assetManifestPath, stackRegion);
 			if (assetRedirect) {
 				const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
@@ -6346,10 +6500,12 @@ async function scrubCommand(stacks, options) {
 	});
 	const app = resolveApp(options.app);
 	if (!app) throw new Error("CDK app is required (scrub needs the template to identify secret references). Pass --app, set CDKD_APP, or add \"app\" to cdk.json.");
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
@@ -6453,9 +6609,16 @@ async function scrubCommand(stacks, options) {
 	const indexUnwritten = [];
 	const indexUnreadable = [];
 	const indexRegionsWritten = /* @__PURE__ */ new Set();
+	const regionForStack = stackRegionResolver({
+		effective: effectiveRegion,
+		probe: stateBackend,
+		logger,
+		siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+	});
+	const stackRegions = new Map(await Promise.all(targetStacks.map(async (stack) => [stack.stackName, await regionForStack(stack.stackName, stack.region)])));
 	const work = targetStacks.map((stack) => ({
 		stackName: stack.stackName,
-		region: stack.region || region,
+		region: stackRegions.get(stack.stackName) ?? region,
 		load: () => {
 			const defect = stack.nestedTemplates ? findNestedTemplateTreeDefect(stack.nestedTemplates) : void 0;
 			if (defect) throw new ScrubRefusalError(renderNestedTemplateTreeDefect(defect, stack.stackName, "scrub it or any stack nested under it; no state was written"), "SCRUB_NESTED_TEMPLATE_TREE_MALFORMED");
@@ -9073,15 +9236,17 @@ async function driftCommand(stacks, options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
 	const stackRegionScopes = /* @__PURE__ */ new Map();
 	try {
-		const region = namedCliRegion(options.region) ?? "us-east-1";
-		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const region = effectiveRegion.region;
+		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 		const prefix = options.statePrefix;
 		const stateConfig = {
 			bucket,
@@ -12098,8 +12263,10 @@ async function destroyCommand(stackArgs, options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	const accountRecovery = {
 		profile: options.profile,
 		stateBucket,
@@ -12116,7 +12283,7 @@ async function destroyCommand(stackArgs, options) {
 		process.env["AWS_DEFAULT_REGION"] = options.region;
 	}
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
@@ -12143,7 +12310,26 @@ async function destroyCommand(stackArgs, options) {
 		stateBackendForCleanup = stateBackend;
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
-		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
+		const runIndexRegion = await reconcileExportIndexRegion({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			statePrefix: options.statePrefix,
+			logger
+		});
+		const newIndexStore = (indexRegion) => new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, indexRegion, stateBackend, { profile: options.profile });
+		const exportIndexStore = withOtherIndexRemoval(newIndexStore(runIndexRegion), {
+			effective: effectiveRegion,
+			runIndexRegion,
+			statePrefix: options.statePrefix,
+			probe: stateBackend,
+			createStore: newIndexStore,
+			logger
+		});
+		const regionForStack = stackRegionResolver({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			logger
+		});
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry, providerClasses);
 		providerRegistry.setCustomResourceResponseBucket(stateBucket);
@@ -12257,7 +12443,7 @@ async function destroyCommand(stackArgs, options) {
 					if (pattern.includes("*") || pattern.includes("?") || pattern.includes("/")) continue;
 					if (!allStateNamesSet.has(pattern)) continue;
 					if (namesAppStack.has(pattern)) continue;
-					const refRegion = allStateRefs.find((r) => r.stackName === pattern)?.region ?? region;
+					const refRegion = allStateRefs.find((r) => r.stackName === pattern)?.region ?? await regionForStack(pattern);
 					const stateOnlyResult = await stateBackend.getState(pattern, refRegion);
 					if (stateOnlyResult?.state.parentStack) {
 						const err = new NestedStackChildDirectDestroyError(pattern, stateOnlyResult.state.parentStack, stateOnlyResult.state.parentLogicalId, void 0, stateCommandAccount);
@@ -12286,10 +12472,12 @@ async function destroyCommand(stackArgs, options) {
 		}
 		const crossPrefixCheck = { cache: new CrossPrefixGuard(stateBackend) };
 		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		const fallbackRegionByName = /* @__PURE__ */ new Map();
+		for (const name of stackNames) if ((stateRefsByName.get(name) ?? []).some((r) => !r.region)) fallbackRegionByName.set(name, await regionForStack(name));
 		for (const name of stackNames) {
 			const synth = appStacks.find((s) => s.stackName === name);
 			if (synth?.terminationProtection === true && !options.removeProtection) continue;
-			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, region);
+			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, fallbackRegionByName.get(name) ?? region);
 			if (planned !== void 0) crossPrefixCheck.cache.full(name, planned, "prestart");
 		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
@@ -12309,7 +12497,7 @@ async function destroyCommand(stackArgs, options) {
 					continue;
 				}
 			}
-			const plannedRegion = plannedDestroyRegion(refs, synthRegion, region);
+			const plannedRegion = plannedDestroyRegion(refs, synthRegion, fallbackRegionByName.get(stackName) ?? region);
 			let stackTargetRegion;
 			if (refs.length === 0) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
@@ -12377,7 +12565,7 @@ async function destroyCommand(stackArgs, options) {
 						...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 						...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
 					}
-				}, () => runDestroyForStack(stackName, stateResult.state, {
+				}, () => runDestroyForStack(stackName, stateWithRegion(stateResult.state, stackTargetRegion), {
 					stateBackend,
 					lockManager,
 					providerRegistry,
@@ -13150,14 +13338,16 @@ async function orphanCommand(pathArgs, options) {
 	});
 	if (pathArgs.length === 0) throw new Error("'cdkd orphan' requires at least one construct path, e.g. 'cdkd orphan MyStack/MyTable'.\n       To remove a stack's state record (the previous behavior), use:\n         cdkd state orphan MyStack");
 	for (const p of pathArgs) if (!p.includes("/")) throw new Error(`'cdkd orphan' now expects a construct path like 'MyStack/MyTable'.\n       Got: '${p}'\n       To remove a stack's state record (the previous behavior), use:\n         cdkd state orphan ${p}`);
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	if (options.region) {
 		process.env["AWS_REGION"] = options.region;
 		process.env["AWS_DEFAULT_REGION"] = options.region;
 	}
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
@@ -13369,7 +13559,9 @@ async function stateMigrateCommand(options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
 	const awsClients = new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
@@ -13378,26 +13570,39 @@ async function stateMigrateCommand(options) {
 	try {
 		const accountId = (await awsClients.sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!accountId) throw new Error("STS GetCallerIdentity returned no Account id.");
-		const legacyBucket = options.legacyBucket ?? getLegacyStateBucketName(accountId, region);
 		const newBucket = options.newBucket ?? getDefaultStateBucketName(accountId);
-		if (legacyBucket === newBucket) {
-			logger.warn(`Source and destination resolve to the same bucket (${legacyBucket}); nothing to do.`);
-			return;
-		}
-		logger.info("Migrating state bucket:");
-		logger.info(`  source:      ${legacyBucket} (resolved for --region ${region})`);
-		logger.info(`  destination: ${newBucket}`);
 		const probeRegion = "us-east-1";
 		const probe = new S3Client({
 			...ambientClientDefaults(),
 			region: probeRegion
 		});
+		let legacyBucket;
+		let sourceRegionLabel = region;
 		let sourceExists;
 		try {
-			sourceExists = await bucketExists(probe, legacyBucket);
+			legacyBucket = options.legacyBucket ?? getLegacyStateBucketName(accountId, region);
+			const sourceProbe = await probeBucket(probe, legacyBucket);
+			sourceExists = sourceProbe !== "missing";
+			const fallbackRegion = legacyStateBucketFallbackRegion(effectiveRegion);
+			if (options.legacyBucket === void 0 && fallbackRegion !== void 0) {
+				const fallbackBucket = getLegacyStateBucketName(accountId, fallbackRegion);
+				const fallbackProbe = fallbackBucket === newBucket ? "missing" : await probeBucket(probe, fallbackBucket);
+				if (fallbackProbe !== "missing" && (!sourceExists || !(sourceProbe === "ok" && fallbackProbe === "access-denied") && await bucketHasState(probe, fallbackBucket))) {
+					legacyBucket = fallbackBucket;
+					sourceRegionLabel = fallbackRegion;
+					sourceExists = true;
+				}
+			}
 		} finally {
 			probe.destroy();
 		}
+		if (legacyBucket === newBucket) {
+			logger.warn(`Source and destination resolve to the same bucket (${legacyBucket}); nothing to do.`);
+			return;
+		}
+		logger.info("Migrating state bucket:");
+		logger.info(`  source:      ${legacyBucket} (resolved for --region ${sourceRegionLabel})`);
+		logger.info(`  destination: ${newBucket}`);
 		if (!sourceExists) throw new Error(`Source bucket '${legacyBucket}' does not exist. Nothing to migrate. (Tip: run \`cdkd state info\` to confirm which bucket cdkd is reading from.)`);
 		const legacyRegion = await resolveBucketRegion(legacyBucket);
 		logger.info(`  source bucket actual region: ${legacyRegion}`);
@@ -13464,20 +13669,37 @@ async function stateMigrateCommand(options) {
 	}
 }
 async function bucketExists(s3, bucketName) {
+	return await probeBucket(s3, bucketName) !== "missing";
+}
+async function probeBucket(s3, bucketName) {
 	try {
 		await s3.send(new HeadBucketCommand({
 			Bucket: bucketName,
 			...await expectedOwnerParam(s3)
 		}));
-		return true;
+		return "ok";
 	} catch (error) {
 		const err = error;
 		const status = err.$metadata?.httpStatusCode;
-		if (err.name === "NotFound" || err.name === "NoSuchBucket" || status === 404) return false;
-		if (status === 301 || status === 403) return true;
+		if (err.name === "NotFound" || err.name === "NoSuchBucket" || status === 404) return "missing";
+		if (status === 301) return "ok";
+		if (status === 403) return "access-denied";
 		throw error;
 	}
 }
+async function bucketHasState(s3, bucket) {
+	try {
+		const resp = await s3.send(new ListObjectsV2Command({
+			EncodingType: "url",
+			Bucket: bucket,
+			MaxKeys: 1,
+			...await expectedOwnerParam(s3)
+		}));
+		return (resp.KeyCount ?? resp.Contents?.length ?? 0) > 0;
+	} catch {
+		return true;
+	}
+}
 async function listAllObjects(s3, bucket) {
 	const all = [];
 	let continuationToken;
@@ -13596,7 +13818,7 @@ async function confirmPrompt$3(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd state migrate confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the migration, or run the command from a real terminal." });
 }
 function createStateMigrateCommand() {
-	const cmd = new Command("migrate").description("Migrate state from the legacy region-suffixed bucket (cdkd-state-{account}-{region}) to the new region-free default (cdkd-state-{account}). Source bucket is kept by default; pass --remove-legacy to delete it after a successful migration.").option("--region <region>", "Region of the legacy bucket to migrate. Defaults to AWS_REGION or us-east-1. Run once per region for multi-region setups.").option("--legacy-bucket <name>", "Override the legacy (source) bucket name (default: derived from STS account + --region).").option("--new-bucket <name>", "Override the new (destination) bucket name (default: cdkd-state-{accountId}).").option("--dry-run", "Show planned actions without making changes", false).option("--remove-legacy", "Delete the source bucket after successful migration. Default: keep it.", false).action(withErrorHandling(stateMigrateCommand));
+	const cmd = new Command("migrate").description("Migrate state from the legacy region-suffixed bucket (cdkd-state-{account}-{region}) to the new region-free default (cdkd-state-{account}). Source bucket is kept by default; pass --remove-legacy to delete it after a successful migration.").option("--region <region>", "Region of the legacy bucket to migrate. Defaults to AWS_REGION, AWS_DEFAULT_REGION, then the profile's region (the us-east-1 legacy bucket instead when that region has none, or when the us-east-1 one holds state), else us-east-1. Run once per region for multi-region setups.").option("--legacy-bucket <name>", "Override the legacy (source) bucket name (default: derived from STS account + --region).").option("--new-bucket <name>", "Override the new (destination) bucket name (default: cdkd-state-{accountId}).").option("--dry-run", "Show planned actions without making changes", false).option("--remove-legacy", "Delete the source bucket after successful migration. Default: keep it.", false).action(withErrorHandling(stateMigrateCommand));
 	commonOptions.forEach((o) => cmd.addOption(o));
 	return cmd;
 }
@@ -14330,14 +14552,16 @@ async function exportCommand(stackArg, options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	if (options.region) {
 		process.env["AWS_REGION"] = options.region;
 		process.env["AWS_DEFAULT_REGION"] = options.region;
 	}
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
@@ -17054,13 +17278,15 @@ async function setupStateBackend(options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const region = effectiveRegion.region;
+	const bucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	const prefix = options.statePrefix;
 	const stateConfig = {
 		bucket,
@@ -17072,14 +17298,34 @@ async function setupStateBackend(options) {
 	});
 	const lockManager = new LockManager(awsClients.s3, stateConfig);
 	await stateBackend.verifyBucketExists();
+	const runIndexRegion = await reconcileExportIndexRegion({
+		effective: effectiveRegion,
+		probe: stateBackend,
+		statePrefix: prefix,
+		logger: getLogger()
+	});
+	const newIndexStore = (indexRegion) => new ExportIndexStore(awsClients.s3, stateConfig.bucket, stateConfig.prefix, indexRegion, stateBackend, { profile: options.profile });
+	const exportIndexStore = withOtherIndexRemoval(newIndexStore(runIndexRegion), {
+		effective: effectiveRegion,
+		runIndexRegion,
+		statePrefix: prefix,
+		probe: stateBackend,
+		createStore: newIndexStore,
+		logger: getLogger()
+	});
 	return {
 		stateBackend,
 		lockManager,
 		awsClients,
 		region,
+		regionFor: stackRegionResolver({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			logger: getLogger()
+		}),
 		bucket,
 		prefix,
-		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
+		exportIndexStore,
 		dispose: () => {
 			awsClients.destroy();
 			stateBackend.destroyClient();
@@ -17803,7 +18049,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
 		for (const name of stackNames) {
 			const refs = stateRefs.filter((r) => r.stackName === name);
-			for (const ref of stateDestroyTargets(refs, options.stackRegion) ?? []) crossPrefixCheck.cache.full(name, ref.region ?? setup.region, "prestart");
+			for (const ref of stateDestroyTargets(refs, options.stackRegion) ?? []) crossPrefixCheck.cache.full(name, ref.region ?? await setup.regionFor(name), "prestart");
 		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
@@ -17819,7 +18065,8 @@ async function stateDestroyCommand(stackArgs, options) {
 			else throw multipleRegionsError(stackName, refs, `Use --stack-region ${commandHole("region")} to pick one.`);
 			for (const [refIndex, ref] of targets.entries()) {
 				logger.info(safeMsg`\nPreparing to destroy stack: ${formatStackRefSafe(ref)}`);
-				const stateResult = await setup.stateBackend.getState(stackName, ref.region ?? setup.region);
+				const refRegion = ref.region ?? await setup.regionFor(stackName);
+				const stateResult = await setup.stateBackend.getState(stackName, refRegion);
 				if (!stateResult) {
 					logger.warn(safeMsg`No state found for stack ${displayStackName(stackName)}` + (ref.region ? safeMsg` in ${displayIdent(ref.region)}` : "") + ", skipping");
 					continue;
@@ -17831,7 +18078,7 @@ async function stateDestroyCommand(stackArgs, options) {
 				const eventRecorder = startRunRecorder({
 					backend: setup.stateBackend,
 					stackName,
-					region: ref.region ?? setup.region,
+					region: refRegion,
 					command: "destroy"
 				});
 				let destroyRunResult = "SUCCEEDED";
@@ -17842,7 +18089,7 @@ async function stateDestroyCommand(stackArgs, options) {
 						lockManager: setup.lockManager,
 						providerRegistry,
 						parentStackName: stackName,
-						parentRegion: ref.region ?? setup.region,
+						parentRegion: refRegion,
 						accountId: "unknown",
 						awsClients: setup.awsClients,
 						stateBucket: setup.bucket,
@@ -17857,7 +18104,7 @@ async function stateDestroyCommand(stackArgs, options) {
 							...options.resourceWarnAfter?.perTypeMs && { resourceWarnAfterByType: options.resourceWarnAfter.perTypeMs },
 							...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
 						}
-					}, () => runDestroyForStack(stackName, stateResult.state, {
+					}, () => runDestroyForStack(stackName, stateWithRegion(stateResult.state, refRegion), {
 						stateBackend: setup.stateBackend,
 						lockManager: setup.lockManager,
 						providerRegistry,
@@ -18054,8 +18301,10 @@ async function stateInfoCommand(options) {
 	setAwsClients(awsClients);
 	let regionCorrectedS3 = null;
 	try {
-		const region = namedCliRegion(options.region) ?? "us-east-1";
-		const resolved = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region);
+		const effectiveRegion = await resolveEffectiveRegion(options);
+		exportInferredRegionForSdk(effectiveRegion);
+		const region = effectiveRegion.region;
+		const resolved = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 		const bucket = resolved.bucket;
 		const prefix = options.statePrefix;
 		await new S3StateBackend(awsClients.s3, {
@@ -18620,7 +18869,7 @@ async function rollbackCommand(stackArg, options) {
 			ref = scoped[0];
 		}
 		const stackName = ref.stackName;
-		const region = ref.region ?? setup.region;
+		const region = ref.region ?? await setup.regionFor(ref.stackName);
 		if (options.dropFailed !== void 0) {
 			await dropFailedJournalEntry({
 				stateBackend: setup.stateBackend,
@@ -19093,8 +19342,10 @@ async function eventsCommand(stackName, options) {
 	});
 	setAwsClients(awsClients);
 	try {
-		const region = namedCliRegion(options.region) ?? "us-east-1";
-		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const effectiveRegion = await resolveEffectiveRegion(options);
+		exportInferredRegionForSdk(effectiveRegion);
+		const region = effectiveRegion.region;
+		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 		const prefix = options.statePrefix ?? "cdkd";
 		const stateBackend = new S3StateBackend(awsClients.s3, {
 			bucket,
@@ -19161,8 +19412,10 @@ async function eventsPruneCommand(stackName, options) {
 	});
 	setAwsClients(awsClients);
 	try {
-		const region = namedCliRegion(options.region) ?? "us-east-1";
-		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const effectiveRegion = await resolveEffectiveRegion(options);
+		exportInferredRegionForSdk(effectiveRegion);
+		const region = effectiveRegion.region;
+		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 		const prefix = options.statePrefix ?? "cdkd";
 		const stateBackend = new S3StateBackend(awsClients.s3, {
 			bucket,
@@ -19848,7 +20101,7 @@ async function publishAssetsCommand(stacks, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
-	const rawBaseRegion = rawCliRegion(options.region) ?? "us-east-1";
+	const rawNamedRegion = rawCliRegion(options.region);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
@@ -19876,7 +20129,9 @@ async function publishAssetsCommand(stacks, options) {
 	else if (allStacks.length === 1) targetStacks = allStacks;
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
-	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const baseRegion = effectiveRegion.region;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const stsClient = new STSClient({
 		...ambientClientDefaults(),
@@ -19890,7 +20145,7 @@ async function publishAssetsCommand(stacks, options) {
 		if (markerAccess !== void 0) return markerAccess?.resolver ?? null;
 		let bucket;
 		try {
-			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion);
+			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion, legacyStateBucketFallbackRegion(effectiveRegion));
 		} catch {
 			logger.info("No cdkd state bucket found — publishing to the asset-manifest destinations (CDK bootstrap storage) verbatim. Run 'cdkd bootstrap' to opt into cdkd-owned asset storage that 'cdk gc' never touches.");
 			markerAccess = null;
@@ -19910,10 +20165,22 @@ async function publishAssetsCommand(stacks, options) {
 		const resolver = new AssetModeResolver(backend, accountId, { ...options.profile && { profile: options.profile } });
 		markerAccess = {
 			resolver,
+			regionFor: stackRegionResolver({
+				effective: effectiveRegion,
+				probe: backend,
+				logger,
+				siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+			}),
 			dispose: () => markerClients.destroy()
 		};
 		return resolver;
 	};
+	const regionForStack = async (stack) => {
+		if (stack.region) return stack.region;
+		if (!regionNeedsReconciliation(effectiveRegion)) return baseRegion;
+		await getModeResolver();
+		return markerAccess ? markerAccess.regionFor(stack.stackName) : baseRegion;
+	};
 	const assetPublisher = new AssetPublisher();
 	const results = [];
 	try {
@@ -19934,13 +20201,13 @@ async function publishAssetsCommand(stacks, options) {
 				}
 				logger.info(`\nPublishing assets for stack: ${describeStack(stack)}`);
 				let redirect;
+				const stackRegion = await regionForStack(stack);
 				if (!useCdkBootstrapAssets) {
 					const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
 					if (manifest) {
 						const modeResolver = await getModeResolver();
 						if (modeResolver) {
-							const stackRegion = stack.region || baseRegion;
-							const assetMode = await modeResolver.resolve(stack.region || rawBaseRegion);
+							const assetMode = await modeResolver.resolve(stack.region || rawNamedRegion || stackRegion);
 							if (assetMode.mode === "cdkd-assets") {
 								const map = buildAssetRedirectMap(manifest, assetMode.marker, accountId, stackRegion);
 								if (map.entries.length > 0) redirect = map;
@@ -19953,7 +20220,7 @@ async function publishAssetsCommand(stacks, options) {
 				try {
 					nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
 						accountId,
-						region: stack.region || baseRegion,
+						region: stackRegion,
 						...options.profile && { profile: options.profile },
 						nodePrefix: `${stack.stackName}:`,
 						...redirect && { redirect },
@@ -20047,8 +20314,10 @@ async function forceUnlockCommand(stackArgs, options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	const failures = [];
 	try {
 		const stateConfig = {
@@ -20057,12 +20326,17 @@ async function forceUnlockCommand(stackArgs, options) {
 		};
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig);
+		const regionForLock = stackRegionResolver({
+			effective: effectiveRegion,
+			probe: { stateExistsOwnedBy: async (name, r, regionlessOwner) => await lockManager.isLocked(name, r) || await stateBackend.stateExistsOwnedBy(name, r, regionlessOwner) },
+			logger
+		});
 		for (const stackName of stackPatterns) {
 			let regionsToTry;
 			if (options.stackRegion) regionsToTry = [options.stackRegion];
 			else {
 				const matched = (await stateBackend.listStacks()).filter((r) => r.stackName === stackName);
-				if (matched.length === 0) regionsToTry = [region];
+				if (matched.length === 0) regionsToTry = [await regionForLock(stackName)];
 				else regionsToTry = matched.map((r) => r.region);
 			}
 			for (const r of regionsToTry) {
@@ -20218,17 +20492,20 @@ async function importCommand(stackArg, options) {
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
 	if (options.region) {
 		process.env["AWS_REGION"] = options.region;
 		process.env["AWS_DEFAULT_REGION"] = options.region;
 	}
 	const awsClients = new AwsClients({
-		...options.region && { region: options.region },
+		region: effectiveRegion.region,
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	let targetClients;
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -20245,8 +20522,6 @@ async function importCommand(stackArg, options) {
 		});
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
-		const providerRegistry = new ProviderRegistry();
-		registerAllProviders(providerRegistry, providerClasses);
 		const appCmd = options.app || resolveApp();
 		if (!appCmd) throw new Error("`cdkd state import` requires a CDK app: pass --app or set it in cdk.json. The template is read to find logical IDs, resource types, and dependencies.");
 		logger.info(synthesisStatusMessage(appCmd, "Synthesizing CDK app to read template..."));
@@ -20270,8 +20545,25 @@ async function importCommand(stackArg, options) {
 			}
 		} else if (result.stacks.length === 1) stackInfo = result.stacks[0];
 		else throw new Error(`Multiple stacks found: ${result.stacks.map(describeStack).join(", ")}. Specify the stack name as a positional argument.`);
-		const targetRegion = stackInfo.region || region;
+		const targetRegion = await stackRegionResolver({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			logger,
+			siblings: result.stacks.filter((s) => !s.region).map((s) => s.stackName)
+		})(stackInfo.stackName, stackInfo.region);
 		logger.info(`Target stack: ${stackInfo.stackName} (${targetRegion})`);
+		if (targetRegion !== effectiveRegion.region) {
+			targetClients = new AwsClients({
+				region: targetRegion,
+				...options.profile && { profile: options.profile }
+			});
+			setAwsClients(targetClients);
+			process.env["AWS_REGION"] = targetRegion;
+			process.env["AWS_DEFAULT_REGION"] = targetRegion;
+		}
+		const regionClients = targetClients ?? awsClients;
+		const providerRegistry = new ProviderRegistry();
+		registerAllProviders(providerRegistry, providerClasses);
 		const assetRedirect = await createAssetRedirectResolver({
 			stateBackend,
 			stsRegion: region,
@@ -20298,7 +20590,7 @@ async function importCommand(stackArg, options) {
 		let migrationTree;
 		if (migrationCfnStackName) {
 			logger.info(`Resolving physical IDs from CloudFormation stack '${migrationCfnStackName}' (recursive)...`);
-			migrationTree = await getCloudFormationResourceTree(migrationCfnStackName, awsClients.cloudFormation);
+			migrationTree = await getCloudFormationResourceTree(migrationCfnStackName, regionClients.cloudFormation);
 			const mergeStats = mergeCfnDerivedOverrides({
 				cfnMapping: migrationTree.resources,
 				template,
@@ -20318,7 +20610,7 @@ async function importCommand(stackArg, options) {
 		const selectiveMode = overrides.size > 0 && !options.auto && !options.migrateFromCloudformation;
 		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also auto-resolve the rest.`);
 		if (!selectiveMode && !migrationCfnStackName) {
-			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
+			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, regionClients.cloudFormation);
 			if (cfnResources) {
 				const mergeStats = mergeCfnDerivedOverrides({
 					cfnMapping: cfnResources,
@@ -20418,7 +20710,7 @@ async function importCommand(stackArg, options) {
 					return;
 				}
 			}
-			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, awsClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, awsClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
+			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, regionClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, regionClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
 			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
@@ -20442,14 +20734,14 @@ async function importCommand(stackArg, options) {
 				accountId: accountIdForNestedSynth,
 				logger,
 				assetRedirect,
-				cfnClient: awsClients.cloudFormation
+				cfnClient: regionClients.cloudFormation
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
 				if (orphaned > 0) logger.warn(`--migrate-from-cloudformation: ${orphaned} of ${resources.length} template resource(s) were NOT imported into cdkd. After the CloudFormation stack is retired, those resources remain in AWS but are unmanaged by both CloudFormation and cdkd.`);
 				await retireCloudFormationStack({
 					cfnStackName: migrationCfnStackName,
-					cfnClient: awsClients.cloudFormation,
+					cfnClient: regionClients.cloudFormation,
 					yes: options.yes,
 					stateBucket,
 					...options.profile && { s3ClientOpts: { profile: options.profile } },
@@ -20462,6 +20754,7 @@ async function importCommand(stackArg, options) {
 			});
 		}
 	} finally {
+		targetClients?.destroy();
 		awsClients.destroy();
 	}
 }
@@ -21388,12 +21681,24 @@ function constructPathField(path) {
 }
 
 //#endregion
-//#region src/cli/commands/local-aws-failure.ts
+//#region src/utils/local-aws-failure.ts
 function describeLocalAwsFailureForWarn(err, operation) {
-	if (err instanceof CdkdError) return displaySafe(err.message);
+	if (err instanceof CdkdError) return withoutTrailingPeriod(displaySafe(err.message));
 	const rendered = describeAwsFailureForWarn(err, operation);
 	if (rendered === describeCredentialLoadFailure(err)) getLogger().debug(safeMsg`${operation}: the AWS SDK's own failure message was: ${thrownText(err)}`);
-	return displaySafe(rendered);
+	return withoutTrailingPeriod(displaySafe(rendered));
+}
+function withoutTrailingPeriod(text) {
+	return text.endsWith(".") && !text.endsWith("..") ? text.slice(0, -1) : text;
+}
+function redactedAwsCause(err, message) {
+	if (!(err instanceof Error)) return void 0;
+	let source = err;
+	if (err instanceof CdkdError) for (let depth = 0; depth < 3 && source.cause instanceof Error && !hasSdkMetadata(source); depth++) source = source.cause;
+	return redactedCause(source, message);
+}
+function hasSdkMetadata(error) {
+	return error.$metadata !== void 0;
 }
 function thrownText(err) {
 	try {
@@ -21414,7 +21719,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
 	} catch (err) {
-		logger.warn(`${prefix}: could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Falling back.`);
+		logger.warn(`${prefix}: could not resolve state bucket: ${describeLocalAwsFailureForWarn(err, "state bucket resolution")}. Falling back.`);
 		return;
 	}
 	const awsClients = new AwsClients({
@@ -21431,7 +21736,11 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
-		await stateBackend.verifyBucketExists();
+		try {
+			await stateBackend.verifyBucketExists();
+		} catch (err) {
+			throw new StateError(`${prefix}: could not access state bucket ${displayIdent(stateBucket)}: ${describeStateBucketAccessFailure(err)}.`, redactedAwsCause(err, "S3 HeadBucket (state bucket) failed"));
+		}
 		const refs = (await stateBackend.listStacks()).filter((r) => r.stackName === stackName);
 		if (refs.length === 0) {
 			logger.warn(`${prefix}: no cdkd state found for stack '${stackName}' in bucket '${stateBucket}'. Was it deployed via 'cdkd deploy'? Falling back.`);
@@ -21534,7 +21843,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
 	} catch (err) {
-		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
+		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${describeLocalAwsFailureForWarn(err, "state bucket resolution")}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
 	const clientRegion = canonicalizeRegion(opts.region) || void 0;
@@ -21554,7 +21863,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		await stateBackend.verifyBucketExists();
 	} catch (err) {
 		awsClients.destroy();
-		logger.warn(`${prefix}: cross-stack resolver could not access state bucket '${stateBucket}': ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
+		logger.warn(`${prefix}: cross-stack resolver could not access state bucket ${displayIdent(stateBucket)}: ${describeStateBucketAccessFailure(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
 	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend, { profile: opts.profile });
@@ -21650,6 +21959,15 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		}
 	};
 }
+function describeStateBucketAccessFailure(err) {
+	const operation = "S3 HeadBucket (state bucket)";
+	if (!(err instanceof CdkdError) || err.cause === void 0) return describeLocalAwsFailureForWarn(err, operation);
+	const cause = err.cause;
+	if (cause.name === "NotFound" || cause.name === "NoSuchBucket") return describeLocalAwsFailureForWarn(err, operation);
+	const inner = cause.cause;
+	if (!(cause instanceof CdkdError) && inner instanceof Error && (inner.name === "Unknown" || inner.message === "UnknownError")) return describeLocalAwsFailureForWarn(new CdkdError(cause.message, "STATE_ERROR"), operation);
+	return describeLocalAwsFailureForWarn(cause, operation);
+}
 
 //#endregion
 //#region src/local/s3-local-state-provider.ts
@@ -23318,6 +23636,10 @@ async function pullEcrImage(imageUri, options) {
 			if (!identity.Account) throw new LocalInvokeBuildError$1("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
 			callerAccount = identity.Account;
 			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
+		} catch (err) {
+			if (err instanceof LocalInvokeBuildError$1) throw err;
+			const rendered = describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)");
+			throw new LocalInvokeBuildError$1(`STS GetCallerIdentity failed while preparing the ECR pull: ${rendered}. Verify your AWS credentials.`, redactedAwsCause(err, "STS GetCallerIdentity failed"));
 		} finally {
 			sts.destroy();
 		}
@@ -23388,8 +23710,8 @@ async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger)
 		};
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
-		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`, err instanceof Error ? err : void 0);
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${rendered}. Verify the role exists and its trust policy permits the caller's identity to assume it.`, redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -23397,7 +23719,14 @@ async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger)
 async function ecrLogin(client, target) {
 	const { accountId, region, registryHost } = target;
 	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
-	const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
+	let response;
+	try {
+		response = await client.send(new GetAuthorizationTokenCommand({}));
+	} catch (err) {
+		const rendered = describeLocalAwsFailureForWarn(err, "ECR GetAuthorizationToken");
+		throw new LocalInvokeBuildError$1(`ECR GetAuthorizationToken failed (account=${displayIdent(accountId)}, region=${displayIdent(region)}): ${rendered}. Verify the credentials can call ecr:GetAuthorizationToken.`, redactedAwsCause(err, "ECR GetAuthorizationToken failed"));
+	}
+	const authData = response.authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
@@ -25222,19 +25551,21 @@ async function resolveProfileCredentials(profile) {
 		}),
 		profile
 	});
+	const shownProfile = displayIdent(profile);
+	const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
-			const shownProfile = displayIdent(profile);
-			const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
-			throw new Error(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`);
-		}
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new CdkdError(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`, "LOCAL_PROFILE_CREDENTIALS_UNUSABLE");
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
 			...creds.sessionToken && { sessionToken: creds.sessionToken }
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "--profile credential resolution");
+		throw new CdkdError(`--profile ${shownProfile}: could not resolve the profile's credentials: ${rendered}. For SSO profiles, ${ssoHint}.`, "LOCAL_PROFILE_CREDENTIALS_FAILED", redactedAwsCause(err, "credential resolution failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -25256,12 +25587,16 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_START_API_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
 			sessionToken: creds.SessionToken
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole");
+		throw new CdkdError(`--assume-role: STS AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) failed: ${rendered}.`, "LOCAL_START_API_ASSUMEROLE_FAILED", redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -25686,7 +26021,7 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${describeLocalAwsFailureForWarn(err, "SecretsManager GetSecretValue")}.`);
 	}
 	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
@@ -25712,7 +26047,7 @@ async function resolveSsm(entry, shape, client) {
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${describeLocalAwsFailureForWarn(err, "SSM GetParameter")}.`);
 	}
 }
 
@@ -26588,8 +26923,12 @@ async function resolvePlaceholderAccount(arn, source) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`);
+		if (!account) throw new CdkdError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`, "LOCAL_RUN_TASK_PLACEHOLDER_NO_ACCOUNT");
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity");
+		throw new CdkdError(`--assume-task-role: STS GetCallerIdentity failed while resolving the task role's account: ${rendered}.`, "LOCAL_RUN_TASK_GET_CALLER_IDENTITY_FAILED", redactedAwsCause(err, "STS GetCallerIdentity failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -26607,12 +26946,16 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_RUN_TASK_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
 			sessionToken: creds.SessionToken
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole");
+		throw new CdkdError(`--assume-task-role: STS AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) failed: ${rendered}.`, "LOCAL_RUN_TASK_ASSUMEROLE_FAILED", redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -28850,4 +29193,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BYoddGM7.js.map
+//# sourceMappingURL=program-MMwB_CTT.js.map