@go-to-k/cdkd 0.281.20 → 0.281.22

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as CFN_TEMPLATE_URL_LIMIT, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as synthesisStatusMessage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerForeground, G as getAccountInfo, Gt as resolveCaptureObservedState, H as isTerminationProtectionPropagationError, Ht as getLegacyStateBucketName, I as ProviderRegistry, It as runDockerStreaming, J as normalizeAwsTagsToCfn, Jt as resolveStateBucketWithDefaultAndSource, K as refStateLookupFromResource, Kt as resolveSkipPrefix, L as findActionableSilentDrops, Lt as AssetManifestLoader, M as yellow, Mt as buildDockerImage, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as formatDockerLoginError, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as getDockerCmd, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_BODY_LIMIT, R as findSilentDropProperties, Rt as getDockerImageBySourceHash, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveApp, V as disableInstanceApiTermination, Vt as getDefaultStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveAutoAssetStorage, X as assertRegionMatch, Xt as stateBucketExistenceConfirmed, Y as resolveExplicitPhysicalId, Yt as resolveUseCdkBootstrapAssets, Z as coerceCfnBoolean, Zt as warnDeprecatedNoPrefixCliFlag, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as MIGRATE_TMP_PREFIX, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as derivePartitionAndUrlSuffix, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as uploadCfnTemplate, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefault, r as DeployEngine, rn as expectedOwnerParam, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findLargeInlineResources, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as Synthesizer } from "./deploy-engine-C3-CvvrB.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-DQd1PUUv.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Cv9YCLsx.js";
+import { t as ASGProvider } from "./asg-provider-pvAc9MXZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13320,6 +13320,51 @@ const TABLE_ACTIVE_WAIT_ATTEMPTS = 60;
 * genuinely wedged capacity edit still fails in a minute rather than ten.
 */
 const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
+/**
+* Is this `WarmThroughput` VALUE one cdkd will actually put on the wire
+* (issue #1760)?
+*
+* The single definition of the send rule. `create()` and `update()` call it
+* where they used to inline `if (properties['WarmThroughput'])`, and the
+* bag-level {@link declaresWarmThroughput} below calls it too — so the drift
+* side cannot answer "the template declared one" for a value the write side
+* silently skips. That divergence is not hypothetical: with the two sites
+* spelled independently, respelling either as `!== undefined` leaves every
+* test green while the pair starts disagreeing on `WarmThroughput: null`, and
+* the disagreement re-creates the exact phantom drift this issue removed —
+* cdkd sends nothing, AWS still computes 12000/4000, the readback emits it as
+* though the template had asked, and `--revert` can never clear it because the
+* write gate skips the falsy value. Keep this the ONLY spelling of the rule.
+*
+* Deliberately TRUTHINESS, because that is what the wire has always done.
+*/
+function isSendableWarmThroughput(value) {
+	return Boolean(value);
+}
+/**
+* Does this desired-property bag DECLARE a table-level `WarmThroughput`?
+*
+* The drift-side question ("did cdkd send one for this resource"), answered by
+* {@link isSendableWarmThroughput} so it cannot drift from the write path.
+*
+* An ABSENT or EMPTY bag answers TRUE: the caller supplied nothing to decide
+* with, so both drift consumers keep the pre-#1760 behavior (emit it, compare
+* it) rather than dropping a key on the strength of a bag that was never
+* passed. That fallback is exactly why the write sites take the VALUE-level
+* predicate instead of this one — handing `create()` an absent bag must send
+* nothing, not send `undefined`.
+*
+* Note the empty-bag arm carries the same residual as the declared arm
+* (issue #1768): a `properties: {}` record keeps the AWS-computed value in its
+* snapshot, so a `--revert` on such a resource can re-send it. Left as-is
+* rather than dropped, because a bag that was never populated is not evidence
+* the template declared nothing — and a wrong DROP here is unrecoverable
+* phantom drift, while the residual is a loud, per-resource revert failure.
+*/
+function declaresWarmThroughput(properties) {
+	if (properties === void 0 || Object.keys(properties).length === 0) return true;
+	return isSendableWarmThroughput(properties["WarmThroughput"]);
+}
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
@@ -13376,7 +13421,7 @@ var DynamoDBTableProvider = class {
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
-			if (properties["WarmThroughput"]) createParams.WarmThroughput = properties["WarmThroughput"];
+			if (isSendableWarmThroughput(properties["WarmThroughput"])) createParams.WarmThroughput = properties["WarmThroughput"];
 			if (properties["StreamSpecification"]) createParams.StreamSpecification = {
 				StreamEnabled: true,
 				StreamViewType: properties["StreamSpecification"]["StreamViewType"]
@@ -13539,7 +13584,7 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["WarmThroughput"]) !== JSON.stringify(previousProperties["WarmThroughput"])) {
-				if (properties["WarmThroughput"]) {
+				if (isSendableWarmThroughput(properties["WarmThroughput"])) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						WarmThroughput: properties["WarmThroughput"]
@@ -14131,6 +14176,75 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* `AttributeDefinitions` is a SET, keyed by `AttributeName`: CFn accepts the
+	* members in any order and `DescribeTable` returns them in an order matching
+	* neither the request nor the template. Measured live (us-east-1,
+	* 2026-08-13): a `CreateTable` whose input declared
+	* `[{pk,S}, {gsipk,S}]` read back as `[{gsipk,S}, {pk,S}]` on the create
+	* response AND on every later `DescribeTable`. The comparator compares
+	* arrays positionally, so without this declaration the reorder is permanent
+	* phantom drift on a table nobody touched — reachable whenever the drift
+	* baseline is the template `properties` rather than `observedProperties`
+	* (after a reverse-replacement rollback, which strips `observedProperties`,
+	* or on a resource deployed before observed-capture existed; on the ordinary
+	* path both sides come from the same readback and already agree, which is
+	* why routine runs never surfaced it). Issue #1760, the
+	* `AWS::DynamoDB::Table` twin of issue #1742's `AWS::DynamoDB::GlobalTable`
+	* finding.
+	*
+	* `KeySchema` is deliberately NOT declared, at the table level or the index
+	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
+	* HIDE a real key change rather than remove a phantom one.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::DynamoDB::Table") return [];
+		return ["AttributeDefinitions"];
+	}
+	/**
+	* `WarmThroughput` is reported by AWS for EVERY table, whether or not the
+	* template ever asked for one. Measured live (us-east-1, 2026-08-13) on a
+	* `CreateTable` whose input declared NO `WarmThroughput`:
+	*
+	* ```
+	* "WarmThroughput": { "ReadUnitsPerSecond": 12000,
+	*                     "WriteUnitsPerSecond": 4000, "Status": "ACTIVE" }
+	* ```
+	*
+	* so `readCurrentState`'s emit-when-present guard could never do what its
+	* comment claimed ("only on tables that set warm throughput"). That value is
+	* AWS-computed and AWS-owned — it only ever increases as the table's traffic
+	* grows, and it cannot be lowered — so once it is frozen into an
+	* `observedProperties` baseline, a later AWS-side increase surfaces as drift
+	* on a property the user never declared and `--revert` would issue a
+	* decrease AWS rejects. `readCurrentState` therefore emits it only when the
+	* DESIRED bag declares it (the fix issue #1742 PROPOSES for the per-index
+	* sibling — still open and unlanded at the time of writing, so this is the
+	* first site to carry the shape), never as a blanket drop:
+	* `AWS::DynamoDB::Table` accepts an explicit `WarmThroughput` and a real
+	* change to one must stay visible. Known residual on that declared arm
+	* (issue #1768): AWS may GROW a declared value, which is reported as drift —
+	* correctly, cdkd holds a value AWS no longer has — but `--revert` then
+	* issues a decrease AWS rejects, surfacing as a per-resource revert failure
+	* rather than as a silent wrong answer.
+	*
+	* This declaration is the OTHER half: a state record written by an earlier
+	* binary already carries the computed value in `observedProperties`, so the
+	* gate alone would flip every such table to a one-sided `WarmThroughput`
+	* drift (baseline has it, the AWS side no longer emits it) until the next
+	* deploy refreshed the capture. Ignoring the path on BOTH sides when the
+	* template declares nothing covers the transition and the steady state
+	* alike; a table that DOES declare `WarmThroughput` is compared normally.
+	* Same per-resource scoping seam as `AWS::ApiGatewayV2::Integration`'s
+	* `TlsConfig` (issue #1602): an absent / empty bag falls back to the
+	* type-level answer of COMPARING, since hiding a real drift is the worse
+	* failure.
+	*/
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::Table") return [];
+		if (declaresWarmThroughput(properties)) return [];
+		return ["WarmThroughput"];
+	}
+	/**
 	* Read the AWS-current DynamoDB table configuration in CFn-property shape.
 	*
 	* `DescribeTable` returns every field cdkd manages in one call. AWS uses
@@ -14142,8 +14256,18 @@ var DynamoDBTableProvider = class {
 	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
 	*    API response carries `StreamEnabled` too. We surface both since the
 	*    drift comparator only descends into keys present in state.
-	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount` and
-	*    sizing fields that cdkd never sets; the comparator filters them.
+	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount`,
+	*    `IndexArn` and sizing fields cdkd never sets, and they are forwarded
+	*    VERBATIM. This used to claim "the comparator filters them" — it does
+	*    NOT, and issue #1767 quotes that sentence as the bug: the filter is
+	*    `calculateResourceDrift`'s state-keys-only walk, which only reaches an
+	*    absent TOP-LEVEL key. These are members of an array under a key the
+	*    baseline DOES carry, and arrays compare positionally, so every
+	*    AWS-managed member participates — `ItemCount` MOVES as data lands, so
+	*    an in-use table with an index drifts against its own
+	*    `observedProperties` on the ordinary path. Fixing it needs a full
+	*    reverse-mapper plus the same migration companion this issue's
+	*    `WarmThroughput` gate needed, hence a separate issue.
 	*
 	* Returns `undefined` when the table is gone (`ResourceNotFoundException`).
 	*
@@ -14153,8 +14277,12 @@ var DynamoDBTableProvider = class {
 	* drift, and the result key is omitted entirely when AWS reports no user
 	* tags (matches `create()`'s behavior of only sending Tags when the
 	* template carries them).
+	*
+	* `properties` is the DESIRED bag (the state-recorded template intent every
+	* caller passes) and is consulted for exactly one field, `WarmThroughput` —
+	* see {@link getDriftUnknownPaths} for the measurement and the reasoning.
 	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (!table) return void 0;
@@ -14173,7 +14301,7 @@ var DynamoDBTableProvider = class {
 				if (table.OnDemandThroughput.MaxWriteRequestUnits !== void 0) odt["MaxWriteRequestUnits"] = table.OnDemandThroughput.MaxWriteRequestUnits;
 				if (Object.keys(odt).length > 0) result["OnDemandThroughput"] = odt;
 			}
-			if (table.WarmThroughput) {
+			if (table.WarmThroughput && declaresWarmThroughput(properties)) {
 				const wt = {};
 				if (table.WarmThroughput.ReadUnitsPerSecond !== void 0) wt["ReadUnitsPerSecond"] = table.WarmThroughput.ReadUnitsPerSecond;
 				if (table.WarmThroughput.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = table.WarmThroughput.WriteUnitsPerSecond;
@@ -65699,6 +65827,61 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
+//#endregion
+//#region src/utils/ecr-uri.ts
+/**
+* Matching the HOST half of an ECR image URI:
+* `<acct>.dkr.ecr.<region>.<urlSuffix>/`.
+*
+* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
+* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
+* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
+* silently classified a real ECR image as a user-managed one — skipping the
+* `docker login` it needs.
+*/
+const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
+/**
+* The account + region of an ECR image URI, or `undefined` when the URI is not
+* an ECR registry host for the region it names.
+*
+* Lives in `src/utils/` rather than beside its first caller because it has TWO
+* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
+* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
+* image that may carry a digest or no tag at all). Before issue #1758 they each
+* carried their own copy of the hardcoded commercial pattern, and fixing only
+* the pull path left `cdkd local run-task` broken outside the commercial
+* partition; ONE definition is what stops them drifting apart again.
+*
+* The module is deliberately free of AWS SDK imports, which is what lets
+* `ecs-task-resolver.ts` consume it without breaking the invariant that module
+* documents about itself (it resolves secrets through a separate module for
+* exactly that reason).
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const region = m[2];
+	if (m[3] !== derivePartitionAndUrlSuffix(region).urlSuffix) return void 0;
+	return {
+		accountId: m[1],
+		region
+	};
+}
+/**
+* True when the URI has the ECR HOST SHAPE but its suffix does not belong to
+* the region it names — i.e. exactly the case {@link parseEcrRegistryHost}
+* rejects for a reason the caller may want to report.
+*
+* The two rejections are worth telling apart at a call site that degrades
+* silently: a genuinely public image and a registry in a partition
+* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
+* `undefined`, and only the second is a cdkd gap rather than a user choice.
+*/
+function looksLikeEcrHostWithForeignSuffix(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	return m !== null && m[3] !== derivePartitionAndUrlSuffix(m[2]).urlSuffix;
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -66318,13 +66501,14 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). cdkd could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). cdkd local run-task v1 only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(substituted);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(substituted);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri: substituted,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
+	if (looksLikeEcrHostWithForeignSuffix(substituted)) getLogger().child("ecs-task-resolver").debug(`Image '${substituted}' has an ECR host shape but a URL suffix that does not belong to its region's partition; treating it as a public image (no docker login).`);
 	return {
 		kind: "public",
 		uri: substituted
@@ -66361,12 +66545,12 @@ function classifyResolvedImage(uri, cdkAssetContainerRepo) {
 		if (hashMatch) out.assetHash = hashMatch[1];
 		return out;
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(uri);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(uri);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -66952,50 +67136,25 @@ async function buildContainerImage$1(...args) {
 
 //#endregion
 //#region src/local/ecr-puller.ts
-/**
-* ECR pull fallback for `cdkd local invoke` / `cdkd local start-api` /
-* `cdkd local run-task`. When the image URI resolves to an ECR repo but
-* doesn't match any cdk.out asset (typical when invoking a stack
-* deployed elsewhere or sharing a centralized registry), cdkd
-* authenticates against the target registry and runs `docker pull`.
-*
-* **Cross-account / cross-region** (#455):
-*   - Same-account, same-region: fast path. No STS hop. The default
-*     credential chain is used directly for `ecr:GetAuthorizationToken`.
-*   - `ecrRoleArn` is provided: `sts:AssumeRole` is issued via the
-*     default credential chain to obtain temporary credentials for the
-*     target account. The resulting credentials authenticate the ECR
-*     client (regardless of region — the ECR client is built for the
-*     URI's region, which can differ from the caller's profile region).
-*   - Cross-account, NO `ecrRoleArn`: cdkd falls through to the
-*     default credential chain. This works when the caller has been
-*     granted cross-account `ecr:GetAuthorizationToken` +
-*     `ecr:BatchGetImage` permissions on the target repository via an
-*     IAM policy; otherwise AWS rejects the call with `AccessDenied`
-*     and the user is pointed at `--ecr-role-arn`.
-*
-* The `--no-pull` semantics (C3 in the design doc):
-*   - When NOT set: `ecrLogin` + `docker pull <uri>`.
-*   - When set: skip `docker pull`. If the image isn't in the local
-*     cache, the subsequent `docker run` will fail; we surface a clearer
-*     "image not in local cache" error here so the user knows to drop
-*     `--no-pull` or pre-pull manually.
-*/
-/** Regex matching the `<acct>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` shape. */
-const ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
+/** The URL suffix an ECR registry host uses in `region`'s partition (issue #1758). */
+function ecrUrlSuffix(region) {
+	return derivePartitionAndUrlSuffix(region).urlSuffix;
+}
 /**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
 */
 function parseEcrUri(imageUri) {
-	const m = ECR_URI_REGEX.exec(imageUri);
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const m = /^([^:]+):(.+)$/.exec(imageUri.slice(imageUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
-		accountId: m[1],
-		region: m[2],
-		repository: m[3],
-		tag: m[4]
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2]
 	};
 }
 /**
@@ -67134,7 +67293,7 @@ async function ecrLogin(client, accountId, region) {
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 	try {
 		await runDockerStreaming([
 			"login",
@@ -74346,7 +74505,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.20");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.22");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;