@go-to-k/cdkd 0.282.4 → 0.282.6

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveUseCdkBootstrapAssets, A as green, An as ProvisioningError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bn as withErrorHandling, Bt as runDockerStreaming, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as LocalInvokeBuildError$1, Ct as stringifyValue, D as bold, Dn as MissingCdkCliError, Dt as loadPublishableAssetManifest, E as formatResourceLine, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Ft as validateContainerRepoName, G as getAccountInfo, Gt as getDefaultStateBucketName, H as isTerminationProtectionPropagationError, Ht as getDockerImageBySourceHash, I as ProviderRegistry, It as buildDockerImage, J as normalizeAwsTagsToCfn, Jt as resolveAutoAssetStorage, K as refStateLookupFromResource, Kt as getLegacyStateBucketName, L as findActionableSilentDrops, Lt as formatDockerLoginError, M as yellow, Mn as ResourceUpdateNotSupportedError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as StackHasActiveImportsError, Nt as parseBootstrapMarker, O as cyan, On as NestedStackChildDirectDestroyError, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as StackTerminationProtectionError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefaultAndSource, R as findSilentDropProperties, Rt as getDockerCmd, S as extractDeploymentEventError, Sn as DeployCancelledError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalStartServiceError, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as Synthesizer, V as disableInstanceApiTermination, Vt as AssetManifestLoader, W as cfnRefValueFromPhysicalId, Wt as synthesisStatusMessage, X as assertRegionMatch, Xt as resolveSkipPrefix, Y as resolveExplicitPhysicalId, Yt as resolveCaptureObservedState, Z as coerceCfnBoolean, Zt as resolveStateBucketWithDefault, _ as createPreDeleteFinalSnapshot, _n as setAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as findLargeInlineResources, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as PARTITION_TABLE, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as processStackMessages, dt as DiffCalculator, en as stateBucketExistenceConfirmed, et as readConfigString, f as computeImplicitDeleteEdges, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as resetAwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as getAwsClients, ht as isThrottlingError, i as DeploymentEventsReader, in as MIGRATE_TMP_PREFIX, it as requireConfigString, j as red, jn as ResourceTimeoutError, jt as ensureAssetStorage, k as gray, kn as PartialFailureError, kt as AssetModeResolver, l as replayRollback, ln as derivePartitionAndUrlSuffix, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AwsClients, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as CFN_TEMPLATE_BODY_LIMIT, nt as requireConfigArray, o as planFailedOps, on as uploadCfnTemplate, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as resolveBucketRegion, pt as withRetry, q as WAFv2WebACLProvider, qt as resolveApp, r as DeployEngine, rn as CFN_TEMPLATE_URL_LIMIT, rt as requireConfigObject, s as planRollback, sn as expectedOwnerParam, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as warnDeprecatedNoPrefixCliFlag, tt as replayWarn, u as withResourceDeadline, un as AssemblyReader, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vt as LockManager, w as isStatefulRecreateTargetSync, wn as LocalMigrateError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as CdkdError, yt as S3StateBackend, z as CloudControlProvider, zn as normalizeAwsError, zt as runDockerForeground } from "./deploy-engine-CnxJLy3Y.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-4K_iJ2rV.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-D9VJTwn3.js";
+import { t as ASGProvider } from "./asg-provider-Dm_dVhvQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1164,17 +1164,7 @@ async function bootstrapCommand(options) {
 			}));
 			logger.info("✓ Enabled bucket encryption (AES-256)");
 			logger.debug("Setting bucket policy...");
-			const bucketPolicy = {
-				Version: "2012-10-17",
-				Statement: [{
-					Sid: "DenyExternalAccess",
-					Effect: "Deny",
-					Principal: "*",
-					Action: "s3:*",
-					Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
-					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-				}]
-			};
+			const bucketPolicy = buildDenyExternalAccessPolicy(bucketName, accountId, await stateBucketS3.config.region());
 			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
 				ExpectedBucketOwner: accountId,
@@ -58779,17 +58769,7 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	await s3.send(new PutBucketPolicyCommand({
 		Bucket: bucketName,
 		...await expectedOwnerParam(s3),
-		Policy: JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Sid: "DenyExternalAccess",
-				Effect: "Deny",
-				Principal: "*",
-				Action: "s3:*",
-				Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
-				Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-			}]
-		})
+		Policy: JSON.stringify(buildDenyExternalAccessPolicy(bucketName, accountId, await s3.config.region()))
 	}));
 	logger.info("✓ Applied versioning, encryption, and account-only access policy");
 	return s3;
@@ -68399,20 +68379,64 @@ function ecrUrlSuffix(region) {
 	return derivePartitionAndUrlSuffix(region).urlSuffix;
 }
 /**
+* Lower-case the REGISTRY HOST of an image reference and leave the repository
+* path and tag byte-identical.
+*
+* A registry host is a DNS name and therefore case-INSENSITIVE, but docker's
+* credential store is keyed on the hostname VERBATIM: measured against a real
+* daemon with a `DOCKER_CONFIG` holding auth for
+* `<acct>.dkr.ecr.us-east-1.amazonaws.com`, a pull of
+* `<acct>.dkr.ecr.US-EAST-1.amazonaws.com/...` sent NO credentials at all
+* (`no basic auth credentials`) while the lower-cased spelling authenticated
+* and failed with a token error instead. So cdkd logging in to one spelling
+* and pulling from another authenticates against neither.
+*
+* The repository path and tag are deliberately NOT folded: only the domain is
+* case-insensitive, docker already requires the path to be lower case, and
+* rewriting it would change WHICH image is pulled.
+*
+* "Everything before the first `/`" is NOT the same thing as "the host", which
+* is why the first component is tested rather than assumed. Docker treats it
+* as a registry only when it contains a `.` or a `:` or is exactly
+* `localhost`; otherwise it is the first segment of a Docker Hub repository
+* PATH (`MyOrg/MyRepo:tag` is `docker.io/MyOrg/MyRepo:tag`). Folding that
+* would name a DIFFERENT image. Today every caller is behind the strict ECR
+* host check so the distinction is inert, but this is exported under a generic
+* name and the contract has to be the real one.
+*/
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return host.toLowerCase() + imageUri.slice(slash);
+}
+/** Docker's rule for "component 1 is a registry, not a repository segment". */
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+/**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
+*
+* The host is canonicalized BEFORE the registry-host match, so a mixed-case
+* genuine ECR host classifies as ECR (and its `region` comes back in the
+* spelling the ECR endpoint and the `docker login` both use) rather than
+* falling through to the anonymous-pull path.
 */
 function parseEcrUri(imageUri) {
-	const host = parseEcrRegistryHost(imageUri);
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const host = parseEcrRegistryHost(canonicalUri);
 	if (!host) return void 0;
-	const m = /^([^:]+):(.+)$/.exec(imageUri.slice(imageUri.indexOf("/") + 1));
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
 		accountId: host.accountId,
-		region: host.region,
+		region: canonicalizeRegion(host.region),
 		repository: m[1],
-		tag: m[2]
+		tag: m[2],
+		canonicalUri
 	};
 }
 /**
@@ -68452,17 +68476,24 @@ function isCredentialFresh(creds) {
 *
 * Auto-detects cross-account from `STS:GetCallerIdentity` and assumes
 * the supplied role when set. Returns the image URI the caller should
-* pass to `docker run` (same as the input — no rewriting).
+* pass to `docker run`: the input with its registry HOST lower-cased and
+* its repository path + tag untouched (issue #1801). That is the SAME
+* spelling `docker pull` / `docker image inspect` were handed here, and
+* the same one the DERIVED `docker login` endpoint names — an
+* AWS-reported `proxyEndpoint` still wins over that fallback (it can be
+* a VPC-endpoint host), which is correct: AWS names the endpoint its own
+* token authenticates, and it reports it lower-cased.
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
 	if (!parsed) throw new LocalInvokeBuildError$1(`Image URI '${imageUri}' is not an ECR URI. cdkd local invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
-	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+	const canonicalUri = parsed.canonicalUri;
+	const callerRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
 	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
-		await verifyImageInLocalCache(imageUri);
-		return imageUri;
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
 	}
 	const callerIdentityKey = callerRegion ?? "_unset";
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
@@ -68502,13 +68533,13 @@ async function pullEcrImage(imageUri, options) {
 	} finally {
 		ecr.destroy();
 	}
-	logger.info(`Pulling ${imageUri}...`);
+	logger.info(`Pulling ${canonicalUri}...`);
 	try {
-		await runDockerForeground(["pull", imageUri]);
+		await runDockerForeground(["pull", canonicalUri]);
 	} catch (err) {
-		throw new LocalInvokeBuildError$1(`docker pull ${imageUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${err.message}`);
 	}
-	return imageUri;
+	return canonicalUri;
 }
 /**
 * Assume the supplied role via the SDK default credential chain and
@@ -69722,6 +69753,7 @@ function clampConcurrency(input) {
 async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let apiFilter = target;
 	if (options.api !== void 0) {
 		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
@@ -71128,10 +71160,18 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options)
 *
 * Region precedence: `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION` >
 * the state record's region (returned by the active `LocalStateProvider`).
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the state
+* record's region — and all three consumers: the STS client built for
+* `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion);
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -72055,6 +72095,7 @@ async function localRunTaskCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
@@ -72224,6 +72265,14 @@ async function assumeTaskRole(roleArn, region) {
 * load) routes through the active {@link LocalStateProvider} so both
 * `--from-state` and `--from-cfn-stack` produce the same downstream
 * context shape (issue #606).
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the
+* synth-derived stack region — and all three consumers: the STS client built
+* for `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function buildEcsImageResolutionContext$1(candidate, stateProvider, options) {
 	const logger = getLogger();
@@ -72233,7 +72282,7 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const ctx = {};
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 		if (!region) logger.warn("Resolver references ${AWS::Region} but cdkd could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.");
 		let accountId;
 		try {
@@ -73901,6 +73950,7 @@ async function localInvokeCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let imagePlan;
 	let containerId;
 	let stopLogs;
@@ -74381,10 +74431,18 @@ function envHasCrossStackIntrinsic(templateEnv) {
 *
 * Region precedence (mirrors `local-run-task`): `--region` > `AWS_REGION`
 * > `AWS_DEFAULT_REGION` > the synth-derived stack region.
+*
+* The resolved region is CANONICALIZED (issue #1795) before anything consumes
+* it. That covers all four sources — `--region`, both env vars, and the
+* synth-derived stack region — and all three consumers: the STS client built
+* for `${AWS::AccountId}`, the `${AWS::URLSuffix}` / `${AWS::Partition}`
+* derivation, and the `${AWS::Region}` value itself.
+*
+* @internal exported for unit tests.
 */
 async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion);
 	if (!region) logger.warn("--from-state: resolver references ${AWS::Region} but cdkd could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.");
 	let accountId;
 	try {
@@ -75763,7 +75821,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.6");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;