@go-to-k/cdkd 0.282.3 → 0.282.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveUseCdkBootstrapAssets, A as green, An as ProvisioningError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bn as withErrorHandling, Bt as runDockerStreaming, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as LocalInvokeBuildError$1, Ct as stringifyValue, D as bold, Dn as MissingCdkCliError, Dt as loadPublishableAssetManifest, E as formatResourceLine, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Ft as validateContainerRepoName, G as getAccountInfo, Gt as getDefaultStateBucketName, H as isTerminationProtectionPropagationError, Ht as getDockerImageBySourceHash, I as ProviderRegistry, It as buildDockerImage, J as normalizeAwsTagsToCfn, Jt as resolveAutoAssetStorage, K as refStateLookupFromResource, Kt as getLegacyStateBucketName, L as findActionableSilentDrops, Lt as formatDockerLoginError, M as yellow, Mn as ResourceUpdateNotSupportedError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as StackHasActiveImportsError, Nt as parseBootstrapMarker, O as cyan, On as NestedStackChildDirectDestroyError, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as StackTerminationProtectionError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefaultAndSource, R as findSilentDropProperties, Rt as getDockerCmd, S as extractDeploymentEventError, Sn as DeployCancelledError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalStartServiceError, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as Synthesizer, V as disableInstanceApiTermination, Vt as AssetManifestLoader, W as cfnRefValueFromPhysicalId, Wt as synthesisStatusMessage, X as assertRegionMatch, Xt as resolveSkipPrefix, Y as resolveExplicitPhysicalId, Yt as resolveCaptureObservedState, Z as coerceCfnBoolean, Zt as resolveStateBucketWithDefault, _ as createPreDeleteFinalSnapshot, _n as setAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as findLargeInlineResources, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as PARTITION_TABLE, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as processStackMessages, dt as DiffCalculator, en as stateBucketExistenceConfirmed, et as readConfigString, f as computeImplicitDeleteEdges, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as resetAwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as getAwsClients, ht as isThrottlingError, i as DeploymentEventsReader, in as MIGRATE_TMP_PREFIX, it as requireConfigString, j as red, jn as ResourceTimeoutError, jt as ensureAssetStorage, k as gray, kn as PartialFailureError, kt as AssetModeResolver, l as replayRollback, ln as derivePartitionAndUrlSuffix, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AwsClients, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as CFN_TEMPLATE_BODY_LIMIT, nt as requireConfigArray, o as planFailedOps, on as uploadCfnTemplate, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as resolveBucketRegion, pt as withRetry, q as WAFv2WebACLProvider, qt as resolveApp, r as DeployEngine, rn as CFN_TEMPLATE_URL_LIMIT, rt as requireConfigObject, s as planRollback, sn as expectedOwnerParam, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as warnDeprecatedNoPrefixCliFlag, tt as replayWarn, u as withResourceDeadline, un as AssemblyReader, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vt as LockManager, w as isStatefulRecreateTargetSync, wn as LocalMigrateError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as CdkdError, yt as S3StateBackend, z as CloudControlProvider, zn as normalizeAwsError, zt as runDockerForeground } from "./deploy-engine-DGH5aBd0.js";
+import { $ as configStringRefusal, $t as resolveUseCdkBootstrapAssets, A as green, An as PartialFailureError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bn as normalizeAwsError, Bt as runDockerStreaming, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as DeployCancelledError, Ct as stringifyValue, D as bold, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalStartServiceError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackTerminationProtectionError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as getDefaultStateBucketName, H as isTerminationProtectionPropagationError, Ht as getDockerImageBySourceHash, I as ProviderRegistry, It as buildDockerImage, J as normalizeAwsTagsToCfn, Jt as resolveAutoAssetStorage, K as refStateLookupFromResource, Kt as getLegacyStateBucketName, L as findActionableSilentDrops, Lt as formatDockerLoginError, M as yellow, Mn as ResourceTimeoutError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceUpdateNotSupportedError, Nt as parseBootstrapMarker, O as cyan, On as MissingCdkCliError, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as StackHasActiveImportsError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefaultAndSource, R as findSilentDropProperties, Rt as getDockerCmd, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalMigrateError, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as Synthesizer, V as disableInstanceApiTermination, Vn as withErrorHandling, Vt as AssetManifestLoader, W as cfnRefValueFromPhysicalId, Wt as synthesisStatusMessage, X as assertRegionMatch, Xt as resolveSkipPrefix, Y as resolveExplicitPhysicalId, Yt as resolveCaptureObservedState, Z as coerceCfnBoolean, Zt as resolveStateBucketWithDefault, _ as createPreDeleteFinalSnapshot, _n as resetAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as findLargeInlineResources, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as CdkdError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as PARTITION_TABLE, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as AssemblyReader, dt as DiffCalculator, en as stateBucketExistenceConfirmed, et as readConfigString, f as computeImplicitDeleteEdges, fn as processStackMessages, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as getAwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as AwsClients, ht as isThrottlingError, i as DeploymentEventsReader, in as MIGRATE_TMP_PREFIX, it as requireConfigString, j as red, jn as ProvisioningError, jt as ensureAssetStorage, k as gray, kn as NestedStackChildDirectDestroyError, kt as AssetModeResolver, l as replayRollback, ln as canonicalizeRegion, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as resolveBucketRegion, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as CFN_TEMPLATE_BODY_LIMIT, nt as requireConfigArray, o as planFailedOps, on as uploadCfnTemplate, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as withRetry, q as WAFv2WebACLProvider, qt as resolveApp, r as DeployEngine, rn as CFN_TEMPLATE_URL_LIMIT, rt as requireConfigObject, s as planRollback, sn as expectedOwnerParam, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as warnDeprecatedNoPrefixCliFlag, tt as replayWarn, u as withResourceDeadline, un as derivePartitionAndUrlSuffix, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as setAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as LocalInvokeBuildError$1, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xt as shouldRetainResource, y as refusesFinalSnapshot, yt as S3StateBackend, z as CloudControlProvider, zt as runDockerForeground } from "./deploy-engine-Cg_wFdJP.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BPaZaY_z.js";
+import { t as ASGProvider } from "./asg-provider-Dl8-YYQR.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -20350,7 +20350,7 @@ const EC2_NETWORK_ACL_ENTRY_ID_FORMAT = {
 * `DestinationCidrBlock || DestinationIpv6CidrBlock || DestinationPrefixListId`
 * chain resolves them.
 */
-const ROUTE_DESTINATION_KEYS = [
+const ROUTE_DESTINATION_KEYS$1 = [
 	"DestinationCidrBlock",
 	"DestinationIpv6CidrBlock",
 	"DestinationPrefixListId"
@@ -20377,7 +20377,7 @@ const ROUTE_DESTINATION_KEYS = [
 * `resolvedProps`, which it records for every resource that does NOT narrow.
 */
 function narrowRouteDestinations(properties) {
-	const declared = ROUTE_DESTINATION_KEYS.filter((key) => Boolean(properties[key]));
+	const declared = ROUTE_DESTINATION_KEYS$1.filter((key) => Boolean(properties[key]));
 	const narrowed = { ...properties };
 	for (const losingKey of declared.slice(1)) delete narrowed[losingKey];
 	return {
@@ -59107,6 +59107,36 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { VpcId: vpcId }
 		};
 	},
+	"AWS::EC2::Route": (physicalId, properties) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<routeTableId>|<destination>'), got ${parts.length}: '${physicalId}'`);
+		const [routeTableId, destination] = parts;
+		if (!routeTableId.trim() || !destination.trim()) throw new Error(`empty part in '<routeTableId>|<destination>': '${physicalId}'`);
+		return {
+			resourceIdentifier: {
+				RouteTableId: routeTableId,
+				CidrBlock: resolveRouteDestination(destination, properties)
+			},
+			propertiesOverlay: { RouteTableId: routeTableId }
+		};
+	},
+	"AWS::EC2::EIP": (physicalId) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<publicIp>|<allocationId>'), got ${parts.length}: '${physicalId}'. CloudFormation identifies an AWS::EC2::EIP by BOTH fields, and neither can be recovered from the other; re-deploy the resource to refresh state`);
+		const [first, second] = parts;
+		if (!first.trim() || !second.trim()) throw new Error(`empty part in '<publicIp>|<allocationId>': '${physicalId}'`);
+		const allocationFirst = first.startsWith(EIP_ALLOCATION_ID_PREFIX);
+		const publicIp = allocationFirst ? second : first;
+		const allocationId = allocationFirst ? first : second;
+		if (!allocationId.startsWith(EIP_ALLOCATION_ID_PREFIX) || !EIP_PUBLIC_IP_PATTERN.test(publicIp)) throw new Error(`'${physicalId}' is not an '<publicIp>|<allocationId>' pair: CloudFormation identifies an AWS::EC2::EIP by [PublicIp, AllocationId], so one segment must be an allocation id ('${EIP_ALLOCATION_ID_PREFIX}…') and the other a dotted-quad public IP. State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state`);
+		return {
+			resourceIdentifier: {
+				PublicIp: publicIp,
+				AllocationId: allocationId
+			},
+			propertiesOverlay: {}
+		};
+	},
 	"AWS::ApiGateway::Deployment": restApiChildSplitter({
 		resourceType: "AWS::ApiGateway::Deployment",
 		childField: "DeploymentId",
@@ -59167,6 +59197,21 @@ const COMPOSITE_ID_SPLITTERS = {
 			Namespace: namespace
 		} };
 	},
+	"AWS::Lambda::EventInvokeConfig": (physicalId) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::Lambda::EventInvokeConfig (expected '<functionName>|<qualifier>' or a bare function name)");
+		const separator = physicalId.indexOf("|");
+		if (separator === -1) return { resourceIdentifier: {
+			FunctionName: physicalId,
+			Qualifier: "$LATEST"
+		} };
+		const functionName = physicalId.slice(0, separator);
+		const qualifier = physicalId.slice(separator + 1);
+		if (!functionName.trim() || !qualifier.trim()) throw new Error(`empty part in '<functionName>|<qualifier>': '${physicalId}'`);
+		return { resourceIdentifier: {
+			FunctionName: functionName,
+			Qualifier: qualifier
+		} };
+	},
 	"AWS::Lambda::Permission": (physicalId, properties) => {
 		const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
 		return {
@@ -59179,11 +59224,44 @@ const COMPOSITE_ID_SPLITTERS = {
 	}
 };
 /**
-* The two values CFn's `AWS::EC2::VPCGatewayAttachment.AttachmentType` takes.
-* The field is `readOnlyProperties`, so cdkd never sends it — it only has to
-* be reproduced for the IMPORT identifier map.
-*/
-const GATEWAY_ATTACHMENT_TYPES = ["InternetGateway", "VPN"];
+* The prefix every EC2 Elastic IP allocation id carries. Used to discriminate
+* the two segments of an `AWS::EC2::EIP` physicalId by SHAPE rather than by
+* position — see the splitter for why the order is not relied on.
+*/
+const EIP_ALLOCATION_ID_PREFIX = "eipalloc-";
+/**
+* The other half of the same discriminator: an Elastic IP's public address is
+* always a dotted quad (EIPs are IPv4-only). Shape-only — the octet RANGES are
+* not checked, because this exists to tell the two segments apart, not to
+* validate an address AWS itself minted.
+*/
+const EIP_PUBLIC_IP_PATTERN = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+const GATEWAY_ATTACHMENT_TYPE_IGW = "IGW";
+const GATEWAY_ATTACHMENT_TYPE_VGW = "VGW";
+/**
+* The values AWS actually uses for `AWS::EC2::VPCGatewayAttachment`'s
+* `AttachmentType`, plus the two spellings issue #1691 guessed.
+*
+* `IGW` / `VGW` are what every real writer produces: Cloud Control stores the
+* primaryIdentifier verbatim, so a CC-written cdkd state record carries one of
+* them as segment 0. `InternetGateway` / `VPN` were never written by anything —
+* they were produced by THIS table on the way OUT, and CloudFormation rejects
+* them (`Invalid request provided: Invalid Attachment Type 'InternetGateway'`;
+* the IMPORT changeset never reaches CREATE_COMPLETE). They are kept purely as
+* input compatibility, so a physicalId hand-written from the old comment, or
+* supplied via `cdkd import --resource`, normalizes instead of falling through
+* to the property-derivation arms. Nothing in cdkd can put them in state.
+*
+* `Object.hasOwn` at the lookup site, not a bare index: a bare index on an
+* object literal answers for inherited members too, so a first segment of
+* `constructor` would resolve to a function rather than missing.
+*/
+const GATEWAY_ATTACHMENT_TYPE_ALIASES = {
+	[GATEWAY_ATTACHMENT_TYPE_IGW]: GATEWAY_ATTACHMENT_TYPE_IGW,
+	[GATEWAY_ATTACHMENT_TYPE_VGW]: GATEWAY_ATTACHMENT_TYPE_VGW,
+	InternetGateway: GATEWAY_ATTACHMENT_TYPE_IGW,
+	VPN: GATEWAY_ATTACHMENT_TYPE_VGW
+};
 /**
 * Resolve `AttachmentType` for an `AWS::EC2::VPCGatewayAttachment` from the
 * first segment of cdkd's composite physicalId plus the recorded properties.
@@ -59191,19 +59269,154 @@ const GATEWAY_ATTACHMENT_TYPES = ["InternetGateway", "VPN"];
 * The Cloud-Control-written shape already carries the attachment type verbatim
 * (it is the CFn primaryIdentifier's first field). The SDK-written shape
 * carries the gateway id instead, so the type is derived from WHICH gateway
-* property cdkd recorded — never hardcoded to `InternetGateway`, which would
-* ship a wrong identifier for a VPN attachment and make CFn's identifier-match
-* reject the import.
+* property cdkd recorded — never hardcoded to the internet-gateway value, which
+* would ship a wrong identifier for a VPN attachment and make CFn's
+* identifier-match reject the import.
+*
+* The VALUES are `IGW` / `VGW`, measured live (Cloud Control `ListResources`,
+* us-east-1, 2026-08-13) against a VPC carrying both an internet-gateway and a
+* virtual-private-gateway attachment:
+*
+*   `IGW|vpc-…` -> {"AttachmentType":"IGW","VpcId":"vpc-…"}
+*   `VGW|vpc-…` -> {"AttachmentType":"VGW","VpcId":"vpc-…"}
+*
+* The registry schema does not enumerate them (`AttachmentType` is a bare
+* `{"type": "string"}` whose description only says it distinguishes the two
+* kinds), which is how the spelled-out `InternetGateway` / `VPN` guesses this
+* function shipped with in issue #1691 went unnoticed: they are plausible, they
+* satisfy every unit test written against them, and CFn only rejects them at
+* changeset-create time — measured 2026-08-13 as `Invalid request provided:
+* Invalid Attachment Type 'InternetGateway'` (issue #1771).
 */
 function resolveGatewayAttachmentType(firstSegment, properties) {
-	if (GATEWAY_ATTACHMENT_TYPES.includes(firstSegment)) return firstSegment;
-	if (typeof properties["InternetGatewayId"] === "string" && properties["InternetGatewayId"]) return "InternetGateway";
-	if (typeof properties["VpnGatewayId"] === "string" && properties["VpnGatewayId"]) return "VPN";
-	if (firstSegment.startsWith("igw-")) return "InternetGateway";
-	if (firstSegment.startsWith("vgw-")) return "VPN";
+	if (Object.hasOwn(GATEWAY_ATTACHMENT_TYPE_ALIASES, firstSegment)) return GATEWAY_ATTACHMENT_TYPE_ALIASES[firstSegment];
+	if (typeof properties["InternetGatewayId"] === "string" && properties["InternetGatewayId"]) return GATEWAY_ATTACHMENT_TYPE_IGW;
+	if (typeof properties["VpnGatewayId"] === "string" && properties["VpnGatewayId"]) return GATEWAY_ATTACHMENT_TYPE_VGW;
+	if (firstSegment.startsWith("igw-")) return GATEWAY_ATTACHMENT_TYPE_IGW;
+	if (firstSegment.startsWith("vgw-")) return GATEWAY_ATTACHMENT_TYPE_VGW;
 	throw new Error(`cannot determine AttachmentType for AWS::EC2::VPCGatewayAttachment: cdkd state's properties carry neither 'InternetGatewayId' nor 'VpnGatewayId', and the physical id segment '${firstSegment}' is not a recognized gateway id. State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state.`);
 }
 /**
+* The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
+* order — the same order (and the same list) `narrowRouteDestinations` in
+* `src/provisioning/providers/ec2-provider.ts` resolves them in when it decides
+* which one `createRoute` actually sends, i.e. which one ends up in the
+* physicalId's destination segment. Restated here rather than imported so this
+* command does not pull the EC2 provider (and its SDK client) into the export
+* module graph.
+*/
+const ROUTE_DESTINATION_KEYS = [
+	"DestinationCidrBlock",
+	"DestinationIpv6CidrBlock",
+	"DestinationPrefixListId"
+];
+/**
+* Resolve the value CFn's read-only `AWS::EC2::Route.CidrBlock` identifier
+* field holds, from cdkd's physicalId destination segment plus the recorded
+* properties.
+*
+* The segment is the starting point — it is the destination cdkd sent to
+* `CreateRoute` (SDK path) or the `CidrBlock` AWS itself reported (Cloud Control
+* path), and `CidrBlock` holds whichever destination kind the route declares,
+* measured live; see the splitter's comment. But it is NOT returned verbatim:
+* EC2 clears host bits on the way in, so the SDK path can have stored a
+* destination AWS never held, and the identifier is always the CANONICAL form.
+*
+* The recorded properties are then read to CROSS-CHECK it, the way
+* {@link resolveGatewayAttachmentType} reads them to recover a field cdkd never
+* stores. Two very different things can make them disagree, and conflating them
+* is why this is not a plain warn:
+*
+*  - **Benign.** One side carries AWS's CANONICALIZED CIDR and the other what
+*    the user wrote; CFn documents rewriting e.g. `100.68.0.18/18` to
+*    `100.68.0.0/18`. The identifier is CORRECT here, so refusing would block an
+*    export that would have succeeded. Both sides are compared in canonical
+*    form, so this case never even registers as a divergence.
+*  - **Dangerous.** If state is merely stale, the id's destination can name a
+*    DIFFERENT route that still exists in the same table. IMPORT then succeeds
+*    against the wrong resource, and phase 2's UPDATE reconciles it to the
+*    template — REPLACING, i.e. DELETING, a route the user never targeted.
+*    Silently continuing here trades an opaque failure for data loss.
+*
+* So the outcome depends on whether the benign explanation is DECIDABLE, which
+* {@link routeDestinationNormalizationIsModelled} answers per declared value.
+* When every declared destination is a shape cdkd models — an IPv4 CIDR or a
+* prefix-list id — normalization either explains the difference or it does not,
+* and a non-match is refused. When any declared destination is an IPv6 CIDR,
+* whose AWS-side canonicalization cdkd does not reproduce, the divergence is
+* reported as a WARNING naming the replace-the-wrong-route outcome, because
+* refusing on an undecidable signal would block exports that are fine.
+*
+* Properties that declare NO destination at all are NOT treated as suspicious:
+* a partial / hand-edited state record must not become a refusal, and the id
+* alone is enough to build the identifier.
+*/
+function resolveRouteDestination(segment, properties) {
+	const identifier = canonicalizeIpv4Cidr(segment) ?? segment;
+	const declared = ROUTE_DESTINATION_KEYS.filter((key) => typeof properties[key] === "string" && properties[key] !== "");
+	if (declared.length === 0) return identifier;
+	const declaredValues = declared.map((key) => String(properties[key]));
+	if (declaredValues.some((value) => (canonicalizeIpv4Cidr(value) ?? value) === identifier)) return identifier;
+	const shared = `AWS::EC2::Route: cdkd state's recorded properties declare ${declared.map((key) => `${key}='${String(properties[key])}'`).join(", ")}, but the physical id's destination segment is '${segment}'. CloudFormation identifies the route by the destination, so IMPORT would adopt whatever route currently sits at '${identifier}' — and if that is a DIFFERENT route than the template declares, phase 2 would then REPLACE (delete) it. The state entry is stale; re-deploy the resource to refresh it`;
+	if (declaredValues.every((value) => routeDestinationNormalizationIsModelled(value))) throw new Error(`${shared}.`);
+	getLogger().warn(`${shared}, or pass the resource through 'cdkd import --resource' with the correct id. Continuing with the physical id because at least one recorded destination is an IPv6 CIDR, whose AWS-side canonicalization cdkd does not model — so the difference may be benign.`);
+	return identifier;
+}
+/**
+* An EC2 managed prefix list id (`pl-` + hex). Matched EXACTLY rather than by
+* prefix so a malformed value falls into the unmodelled class instead of being
+* treated as a comparable destination.
+*/
+const ROUTE_PREFIX_LIST_ID_PATTERN = /^pl-[0-9a-f]+$/;
+/**
+* True when cdkd models how AWS normalizes this destination value, i.e. when a
+* mismatch against the physical id's segment is CONCLUSIVE rather than possibly
+* explained by a rewrite cdkd cannot reproduce.
+*
+* Two classes qualify:
+*   - an IPv4 CIDR, whose host-bit rewrite {@link canonicalizeIpv4Cidr} reproduces;
+*   - a prefix-list id, measured to be stored verbatim on both sides, so a
+*     `pl-AAA` vs `pl-BBB` difference is a genuine wrong-route signal.
+*
+* An IPv6 CIDR does not: AWS canonicalizes those too (zero-run compression,
+* host-bit clearing) and cdkd does not reproduce it, so a mismatch there could
+* still be the same route written two ways.
+*/
+function routeDestinationNormalizationIsModelled(value) {
+	return canonicalizeIpv4Cidr(value) !== void 0 || ROUTE_PREFIX_LIST_ID_PATTERN.test(value);
+}
+/**
+* Return the host-bit-cleared form of an IPv4 CIDR (`100.68.0.18/18` ->
+* `100.68.0.0/18`), or `undefined` when the input is not an IPv4 CIDR at all
+* (an IPv6 CIDR, a `pl-…` prefix-list id, or anything malformed).
+*
+* This exists to recognize the ONE benign reason an `AWS::EC2::Route`'s stored
+* destination can differ from its physicalId segment: AWS rewrites a
+* non-canonical CIDR on `CreateRoute`, and the Cloud Control path records what
+* AWS returned while the template kept what the user wrote. Returning
+* `undefined` for the shapes it does not model is load-bearing — the caller
+* uses it to decide whether a divergence is conclusive or merely unexplained.
+*/
+function canonicalizeIpv4Cidr(value) {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(value);
+	if (!match) return void 0;
+	const octets = [
+		match[1],
+		match[2],
+		match[3],
+		match[4]
+	].map(Number);
+	const prefixLength = Number(match[5]);
+	if (prefixLength > 32 || octets.some((octet) => octet > 255)) return void 0;
+	const network = ((octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0 & (prefixLength === 0 ? 0 : 4294967295 << 32 - prefixLength >>> 0)) >>> 0;
+	return `${[
+		network >>> 24,
+		network >>> 16 & 255,
+		network >>> 8 & 255,
+		network & 255
+	].join(".")}/${prefixLength}`;
+}
+/**
 * Build a splitter for an `AWS::ApiGateway::*` child type whose CFn primary
 * identifier is the parent `RestApiId` plus one child field.
 *
@@ -60201,7 +60414,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * IMPORT pre-flight and this resolution.
 */
 function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
-	const compositeIdentifier = COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType];
+	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
 		const value = compositeIdentifier.resolve({
@@ -60215,7 +60428,7 @@ function resolveResourceIdentifier(resourceType, logicalId, physicalId, properti
 		};
 	}
 	if (entry.fields.length === 1) return { resourceIdentifier: { [entry.fields[0]]: physicalId } };
-	const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
+	const splitter = Object.hasOwn(COMPOSITE_ID_SPLITTERS, resourceType) ? COMPOSITE_ID_SPLITTERS[resourceType] : void 0;
 	if (!splitter) throw new Error(`resource type uses a composite primary identifier (${entry.fields.length} fields: ${entry.fields.join(", ")}); add an entry to COMPOSITE_ID_SPLITTERS in src/cli/commands/export.ts that parses cdkd's physicalId for this type, or destroy the resource first and let CFn create it fresh`);
 	let result;
 	try {
@@ -68186,20 +68399,64 @@ function ecrUrlSuffix(region) {
 	return derivePartitionAndUrlSuffix(region).urlSuffix;
 }
 /**
+* Lower-case the REGISTRY HOST of an image reference and leave the repository
+* path and tag byte-identical.
+*
+* A registry host is a DNS name and therefore case-INSENSITIVE, but docker's
+* credential store is keyed on the hostname VERBATIM: measured against a real
+* daemon with a `DOCKER_CONFIG` holding auth for
+* `<acct>.dkr.ecr.us-east-1.amazonaws.com`, a pull of
+* `<acct>.dkr.ecr.US-EAST-1.amazonaws.com/...` sent NO credentials at all
+* (`no basic auth credentials`) while the lower-cased spelling authenticated
+* and failed with a token error instead. So cdkd logging in to one spelling
+* and pulling from another authenticates against neither.
+*
+* The repository path and tag are deliberately NOT folded: only the domain is
+* case-insensitive, docker already requires the path to be lower case, and
+* rewriting it would change WHICH image is pulled.
+*
+* "Everything before the first `/`" is NOT the same thing as "the host", which
+* is why the first component is tested rather than assumed. Docker treats it
+* as a registry only when it contains a `.` or a `:` or is exactly
+* `localhost`; otherwise it is the first segment of a Docker Hub repository
+* PATH (`MyOrg/MyRepo:tag` is `docker.io/MyOrg/MyRepo:tag`). Folding that
+* would name a DIFFERENT image. Today every caller is behind the strict ECR
+* host check so the distinction is inert, but this is exported under a generic
+* name and the contract has to be the real one.
+*/
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return host.toLowerCase() + imageUri.slice(slash);
+}
+/** Docker's rule for "component 1 is a registry, not a repository segment". */
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+/**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
+*
+* The host is canonicalized BEFORE the registry-host match, so a mixed-case
+* genuine ECR host classifies as ECR (and its `region` comes back in the
+* spelling the ECR endpoint and the `docker login` both use) rather than
+* falling through to the anonymous-pull path.
 */
 function parseEcrUri(imageUri) {
-	const host = parseEcrRegistryHost(imageUri);
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const host = parseEcrRegistryHost(canonicalUri);
 	if (!host) return void 0;
-	const m = /^([^:]+):(.+)$/.exec(imageUri.slice(imageUri.indexOf("/") + 1));
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
 		accountId: host.accountId,
-		region: host.region,
+		region: canonicalizeRegion(host.region),
 		repository: m[1],
-		tag: m[2]
+		tag: m[2],
+		canonicalUri
 	};
 }
 /**
@@ -68239,17 +68496,24 @@ function isCredentialFresh(creds) {
 *
 * Auto-detects cross-account from `STS:GetCallerIdentity` and assumes
 * the supplied role when set. Returns the image URI the caller should
-* pass to `docker run` (same as the input — no rewriting).
+* pass to `docker run`: the input with its registry HOST lower-cased and
+* its repository path + tag untouched (issue #1801). That is the SAME
+* spelling `docker pull` / `docker image inspect` were handed here, and
+* the same one the DERIVED `docker login` endpoint names — an
+* AWS-reported `proxyEndpoint` still wins over that fallback (it can be
+* a VPC-endpoint host), which is correct: AWS names the endpoint its own
+* token authenticates, and it reports it lower-cased.
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
 	if (!parsed) throw new LocalInvokeBuildError$1(`Image URI '${imageUri}' is not an ECR URI. cdkd local invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
-	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+	const canonicalUri = parsed.canonicalUri;
+	const callerRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
 	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
-		await verifyImageInLocalCache(imageUri);
-		return imageUri;
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
 	}
 	const callerIdentityKey = callerRegion ?? "_unset";
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
@@ -68289,13 +68553,13 @@ async function pullEcrImage(imageUri, options) {
 	} finally {
 		ecr.destroy();
 	}
-	logger.info(`Pulling ${imageUri}...`);
+	logger.info(`Pulling ${canonicalUri}...`);
 	try {
-		await runDockerForeground(["pull", imageUri]);
+		await runDockerForeground(["pull", canonicalUri]);
 	} catch (err) {
-		throw new LocalInvokeBuildError$1(`docker pull ${imageUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${err.message}`);
 	}
-	return imageUri;
+	return canonicalUri;
 }
 /**
 * Assume the supplied role via the SDK default credential chain and
@@ -69509,6 +69773,7 @@ function clampConcurrency(input) {
 async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let apiFilter = target;
 	if (options.api !== void 0) {
 		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
@@ -70915,10 +71180,18 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options)
 *
 * Region precedence: `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION` >
 * the state record's region (returned by the active `LocalStateProvider`).
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the state
+* record's region — and all three consumers: the STS client built for
+* `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion);
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -71842,6 +72115,7 @@ async function localRunTaskCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
@@ -72011,6 +72285,14 @@ async function assumeTaskRole(roleArn, region) {
 * load) routes through the active {@link LocalStateProvider} so both
 * `--from-state` and `--from-cfn-stack` produce the same downstream
 * context shape (issue #606).
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the
+* synth-derived stack region — and all three consumers: the STS client built
+* for `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function buildEcsImageResolutionContext$1(candidate, stateProvider, options) {
 	const logger = getLogger();
@@ -72020,7 +72302,7 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const ctx = {};
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 		if (!region) logger.warn("Resolver references ${AWS::Region} but cdkd could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.");
 		let accountId;
 		try {
@@ -73688,6 +73970,7 @@ async function localInvokeCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let imagePlan;
 	let containerId;
 	let stopLogs;
@@ -74168,10 +74451,18 @@ function envHasCrossStackIntrinsic(templateEnv) {
 *
 * Region precedence (mirrors `local-run-task`): `--region` > `AWS_REGION`
 * > `AWS_DEFAULT_REGION` > the synth-derived stack region.
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the
+* synth-derived stack region — and all three consumers: the STS client built
+* for `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion);
 	if (!region) logger.warn("--from-state: resolver references ${AWS::Region} but cdkd could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.");
 	let accountId;
 	try {
@@ -75550,7 +75841,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;