@go-to-k/cdkd 0.283.1 → 0.283.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-InwDI9o0.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-DxpS3fJ9.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-R3IdAR_3.js";
+import { t as ASGProvider } from "./asg-provider-CtmogXk9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9139,15 +9139,24 @@ var SQSQueueProvider = class {
 		}
 	}
 	/**
-	* Construct SQS queue ARN from account/region/queue name
+	* Construct SQS queue ARN from account/region/queue name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the queue's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async constructArn(queueName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:sqs:${await this.sqsClient.config.region()}:${accountId}:${queueName}`;
+			const region = await this.sqsClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 		} catch {
 			this.logger.warn("Failed to construct SQS ARN from STS, using placeholder");
-			return `arn:aws:sqs:unknown:unknown:${queueName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:sqs:unknown:unknown:${queueName}`;
 		}
 	}
 	/**
@@ -18425,14 +18434,23 @@ var LogsLogGroupProvider = class {
 		}
 	}
 	/**
-	* Build log group ARN from name
+	* Build log group ARN from name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the log group's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async buildArn(logGroupName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:logs:${await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:${accountId}:log-group:${logGroupName}:*`;
+			const region = await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:logs:${region}:${accountId}:log-group:${logGroupName}:*`;
 		} catch {
-			return `arn:aws:logs:unknown:unknown:log-group:${logGroupName}:*`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:logs:unknown:unknown:log-group:${logGroupName}:*`;
 		}
 	}
 	/**
@@ -18693,9 +18711,12 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		try {
-			return `arn:aws:cloudwatch:${await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:*:alarm:${alarmName}`;
+			const region = await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:cloudwatch:${region}:*:alarm:${alarmName}`;
 		} catch {
-			return `arn:aws:cloudwatch:*:*:alarm:${alarmName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:cloudwatch:*:*:alarm:${alarmName}`;
 		}
 	}
 	/**
@@ -24983,13 +25004,23 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	/**
 	* Build the ARN for an API Gateway Stage, used for tag mutations.
 	*
-	* Format: `arn:aws:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
+	* Format:
+	* `arn:{partition}:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
 	* The double colon (`::`) is intentional: API Gateway tagging uses an
 	* account-id-less ARN.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Unlike the pure attribute builders this one is passed straight to
+	* `TagResource` / `UntagResource` as `resourceArn`, so in `aws-cn` /
+	* `aws-us-gov` a commercial literal does not just record a wrong string —
+	* it aims the tag mutation at an ARN that names no stage.
 	*/
 	async buildStageArn(restApiId, stageName) {
 		try {
-			return `arn:aws:apigateway:${await this.apiGatewayClient.config.region()}::/restapis/${restApiId}/stages/${stageName}`;
+			const region = await this.apiGatewayClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
 		} catch {
 			return;
 		}
@@ -38742,11 +38773,19 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	/**
 	* Build a namespace ARN from namespace ID.
-	* Format: arn:aws:servicediscovery:{region}:{account}:namespace/{namespaceId}
+	* Format: `arn:{partition}:servicediscovery:{region}:{account}:namespace/{namespaceId}`
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the namespace's `Arn`
+	* attribute, so a commercial-partition literal is silently wrong (but
+	* structurally valid, hence unrejected) in `aws-cn` / `aws-us-gov`.
 	*/
 	async buildNamespaceArn(namespaceId) {
 		const accountId = (await this.getStsClient().send(new GetCallerIdentityCommand({}))).Account || "";
-		return `arn:aws:servicediscovery:${await this.getClient().config.region()}:${accountId}:namespace/${namespaceId}`;
+		const region = await this.getClient().config.region();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${namespaceId}`;
 	}
 };
 
@@ -43394,12 +43433,35 @@ var BudgetsBudgetProvider = class {
 	}
 	/**
 	* Budget ARN for the tagging APIs (`ListTagsForResource` / `TagResource` /
-	* `UntagResource`). Budgets ARNs carry no region component. The `aws`
-	* partition is assumed — consistent with other providers that construct
-	* ARNs; non-`aws` partitions are not supported by cdkd today.
-	*/
-	budgetArn(accountId, budgetName) {
-		return `arn:aws:budgets::${accountId}:budget/${budgetName}`;
+	* `UntagResource`), and the `Arn` attribute recorded into state.
+	*
+	* Budgets ARNs carry no region component, but they DO carry a partition, so
+	* a region is still needed to name it. It is read from the RESOLVED region
+	* of the very client that receives this ARN — the same
+	* `getClient().config.region()` the `delete()` path already consults for
+	* its `assertRegionMatch` guard — and routed through the closed mapping
+	* `${AWS::Partition}` uses (issue #1815).
+	*
+	* Asking the CLIENT rather than `providerRegion` is what makes the ARN and
+	* its consumer agree. `providerRegion` is `process.env['AWS_REGION']`, and
+	* when that is unset `getClient()` builds `new BudgetsClient({})`, leaving
+	* the SDK to resolve the region from its OWN chain (`AWS_DEFAULT_REGION`,
+	* the `~/.aws/config` profile). So a profile-configured `cn-north-1` /
+	* `us-gov-*` caller would have derived the COMMERCIAL partition from an
+	* empty string while the client itself talked to a non-commercial endpoint
+	* — on the PRIMARY path, not a fallback.
+	*
+	* The `aws` partition USED to be hardcoded here on the stated assumption
+	* that non-`aws` partitions were unsupported. That was wrong in the quiet
+	* direction: the literal is structurally valid everywhere, so in `aws-cn` /
+	* `aws-us-gov` nothing rejected it — the ARN was simply recorded into state
+	* and handed to `TagResource` naming no budget. A client whose region is
+	* unset or unrecognized still derives to `aws`, so commercial output is
+	* unchanged byte for byte.
+	*/
+	async budgetArn(accountId, budgetName) {
+		const { partition } = derivePartitionAndUrlSuffix(await this.getClient().config.region() ?? "");
+		return `arn:${partition}:budgets::${accountId}:budget/${budgetName}`;
 	}
 	/**
 	* Convert a CFn `Spend` shape to the SDK shape. CFn templates carry
@@ -43555,7 +43617,7 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully created budget ${logicalId}: ${name}`);
 			return {
 				physicalId: name,
-				attributes: { Arn: this.budgetArn(accountId, name) }
+				attributes: { Arn: await this.budgetArn(accountId, name) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43582,7 +43644,7 @@ var BudgetsBudgetProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: this.budgetArn(accountId, physicalId) }
+				attributes: { Arn: await this.budgetArn(accountId, physicalId) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43698,7 +43760,7 @@ var BudgetsBudgetProvider = class {
 	async reconcileResourceTags(accountId, budgetName, oldTags, newTags) {
 		const sortedJson = (tags) => JSON.stringify([...tags].sort((a, b) => (a.Key ?? "").localeCompare(b.Key ?? "")));
 		if (sortedJson(oldTags) === sortedJson(newTags)) return;
-		const arn = this.budgetArn(accountId, budgetName);
+		const arn = await this.budgetArn(accountId, budgetName);
 		const newKeys = new Set(newTags.map((t) => t.Key));
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
@@ -43741,7 +43803,7 @@ var BudgetsBudgetProvider = class {
 	/**
 	* `Fn::GetAtt` support. CloudFormation documents no attributes for
 	* `AWS::Budgets::Budget`; `Arn` is served as a cdkd convenience (computed
-	* — Budgets ARNs are `arn:aws:budgets::{account}:budget/{name}`, verified
+	* — Budgets ARNs are `arn:{partition}:budgets::{account}:budget/{name}`, verified
 	* to exist via `DescribeBudget` first).
 	*/
 	async getAttribute(physicalId, resourceType, attributeName) {
@@ -43752,7 +43814,7 @@ var BudgetsBudgetProvider = class {
 				AccountId: accountId,
 				BudgetName: physicalId
 			}));
-			return this.budgetArn(accountId, physicalId);
+			return await this.budgetArn(accountId, physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
@@ -43777,7 +43839,7 @@ var BudgetsBudgetProvider = class {
 			}));
 			return {
 				physicalId: explicit,
-				attributes: { Arn: this.budgetArn(accountId, explicit) }
+				attributes: { Arn: await this.budgetArn(accountId, explicit) }
 			};
 		} catch (error) {
 			if (error instanceof NotFoundException$5) return null;
@@ -51573,13 +51635,33 @@ var S3DirectoryBucketProvider = class {
 		return { Arn: await this.buildBucketArn(bucketName) };
 	}
 	/**
-	* Directory bucket ARN: `arn:aws:s3express:{region}:{account}:bucket/{name}`.
+	* Directory bucket ARN:
+	* `arn:{partition}:s3express:{region}:{account}:bucket/{name}`.
 	* Also the `ResourceArn` for the S3 Control tag operations. Callers that
 	* already resolved the account (for the S3 Control `AccountId` parameter)
 	* pass it in so the STS lookup runs once per operation.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Here it is load-bearing TWICE over: the value is served as the bucket's
+	* `Arn` attribute AND passed to S3 Control as the `ResourceArn` of a tag
+	* mutation, so outside the commercial partition the wrong literal does not
+	* merely record a bad string — it aims the tag call at an ARN that does not
+	* name this bucket.
+	*
+	* KNOWN BOUND (pre-existing, not introduced by #1815): the region — and now
+	* the partition derived from it — comes from `s3Client`, while the tag
+	* calls that consume this ARN go through `s3ControlClient`, built from
+	* `providerRegion` (`process.env['AWS_REGION']`). Those two can disagree,
+	* so the ARN can name a different region than the client receiving it. The
+	* region SEGMENT already had this exposure before the partition rode along
+	* with it; unifying the two clients' region resolution is a separate change.
 	*/
 	async buildBucketArn(bucketName, accountId) {
-		return `arn:aws:s3express:${await this.getRegion()}:${accountId ?? await this.getAccountId()}:bucket/${bucketName}`;
+		const region = await this.getRegion();
+		const account = accountId ?? await this.getAccountId();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:s3express:${region}:${account}:bucket/${bucketName}`;
 	}
 	/**
 	* Create an S3 Express Directory Bucket
@@ -67114,6 +67196,75 @@ function createLocalStateProvider$1(options, cdkdStackName, synthRegion) {
 	return createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
 }
 
+//#endregion
+//#region src/local/intrinsic-image.ts
+/**
+* Boundary shim over cdk-local's container-image intrinsic resolver for
+* `cdkd local invoke` / `start-api` / `run-task` — resolves the canonical
+* CDK 2.x `Fn::Join` shape for ECR image URIs (`lambda.DockerImageCode.fromEcr`
+* / ECS `ContainerImage.fromEcrRepository`) and the same-stack ECR `Fn::GetAtt`
+* Arn / RepositoryUri synthesis. The implementation lives in cdk-local and
+* cdkd consumes it instead of carrying a byte-identical copy.
+* `ImageResolutionContext` is re-exported as a type. See cdk-local's
+* `src/local/intrinsic-image.ts`.
+*
+* Two of the three symbols are bare re-exports. `derivePseudoParametersFromRegion`
+* is NOT: it is wrapped, for the reason below.
+*/
+/**
+* Derive `${AWS::Region}` / `${AWS::AccountId}` / `${AWS::Partition}` /
+* `${AWS::URLSuffix}` for the `Fn::Join` `Code.ImageUri` path (issue #637),
+* with the region CANONICALIZED to its lower-case spelling first.
+*
+* ## Why this is a wrapper rather than a re-export
+*
+* Issue [#1795](https://github.com/go-to-k/cdkd/issues/1795) canonicalizes the
+* region inside `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`),
+* so every cdkd-OWNED region -> partition/suffix derivation inherits ONE
+* normalization point. This helper is a FOURTH derivation that the fix
+* structurally could not reach (issue
+* [#1814](https://github.com/go-to-k/cdkd/issues/1814)): the implementation is
+* cdk-local's, and it carries its own partition table whose prefix tests are
+* case-sensitive in the same direction. So an upper-cased `--region CN-NORTH-1`
+* still fell through to the commercial partition here and synthesized
+* `<acct>.dkr.ecr.CN-NORTH-1.amazonaws.com/...` — a `cn-` region carrying the
+* commercial suffix, a host that does not exist — at the five call sites, across
+* three files, that reach this symbol:
+*
+* - `src/cli/commands/local-start-api.ts` (the `Fn::Join` `Code.ImageUri` path)
+* - `src/cli/commands/local-invoke-agentcore.ts` (x3)
+* - `src/local/lambda-resolver.ts`
+*
+* The preferred fix is upstream — lower-casing the region inside cdk-local's
+* own implementation, which would keep exactly one normalization point. This
+* is the filed FALLBACK: a thin canonicalizing boundary over the re-export,
+* the same shape `docker-image-builder.ts` uses for its error-class boundary.
+* It stays correct if upstream later canonicalizes too, because
+* {@link canonicalizeRegion} is idempotent — double-folding is a no-op.
+*
+* Canonicalizing the INPUT (rather than post-processing the result) is what
+* makes this complete: the returned `region` is substituted as
+* `${AWS::Region}` into every ARN the resolver builds, so a raw upper-cased
+* value would misspell those too, not just the derived suffix.
+*
+* `undefined` passes through untouched — upstream answers `undefined` for a
+* missing region and that verdict is not this shim's to change.
+*
+* ## What this deliberately does NOT fix
+*
+* Case is only half the agreement between the two tables. cdk-local's table
+* predates the three rows cdkd's issue #1764 added, so `us-isof-` / `eu-isoe-` /
+* `eusc-` regions resolve COMMERCIAL here even when spelled canonically — a
+* table-COVERAGE divergence, orthogonal to case, filed as issue
+* [#1821](https://github.com/go-to-k/cdkd/issues/1821). Widening this wrapper
+* into a second partition authority would fix it, but that is a design call of
+* its own; the divergence is pinned by a unit case so it fails loudly rather
+* than staying latent.
+*/
+function derivePseudoParametersFromRegion$1(region, accountId) {
+	return derivePseudoParametersFromRegion(canonicalizeRegion(region), accountId);
+}
+
 //#endregion
 //#region src/local/lambda-resolver.ts
 var LocalInvokeResolutionError = class LocalInvokeResolutionError extends Error {
@@ -67323,7 +67474,7 @@ function extractImageUri$1(value, logicalId, stackName, resources, region) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const pseudoParameters = derivePseudoParametersFromRegion$1(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local invoke cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
@@ -71289,7 +71440,7 @@ function extractImageUri(value, logicalId, stackName, resources, region) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const pseudoParameters = derivePseudoParametersFromRegion$1(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
@@ -73366,6 +73517,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
@@ -73786,7 +73938,7 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 		getLogger().warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
 		return;
 	}
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	if (!region) throw new CdkdError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
 	const signed = await signAgentCoreInvocation({
 		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region),
@@ -73932,7 +74084,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		key: s3Source.key,
 		...s3Source.versionId !== void 0 && { versionId: s3Source.versionId }
 	};
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
 	let credentials;
 	if (assumeRoleArn) try {
@@ -73987,7 +74139,7 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 			resources: imageContext?.stateResources ?? loaded.resources,
 			consumerRegion: loaded.region
 		};
-		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion(loaded.region);
+		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 		if (pseudo) subContext.pseudoParameters = pseudo;
 		if (imageContext?.stateParameters) subContext.parameters = imageContext.stateParameters;
 		if (imageContext?.stateSensitiveParameters?.length) subContext.sensitiveParameters = new Set(imageContext.stateSensitiveParameters);
@@ -74043,7 +74195,7 @@ async function resolveFromS3BucketIntrinsic(resolved, stateProvider, loaded, ima
 		resources: imageContext?.stateResources ?? loaded.resources,
 		consumerRegion: loaded.region
 	};
-	const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion(loaded.region);
+	const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 	if (pseudo) subContext.pseudoParameters = pseudo;
 	const crossStackResolver = await stateProvider.buildCrossStackResolver(loaded.region);
 	if (crossStackResolver) subContext.crossStackResolver = crossStackResolver;
@@ -74071,7 +74223,7 @@ function describeIntrinsic(value) {
 */
 async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 	let accountId;
 	try {
 		accountId = await resolveCallerAccountId(region, options.profile);
@@ -74079,7 +74231,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		logger.warn(`--from-cfn-stack: STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. A same-stack ECR image URI referencing \${AWS::AccountId} may not resolve.`);
 	}
 	const context = {};
-	const pseudo = derivePseudoParametersFromRegion(region, accountId);
+	const pseudo = derivePseudoParametersFromRegion$1(region, accountId);
 	if (pseudo) context.pseudoParameters = pseudo;
 	const loaded = await stateProvider.load(candidate.stackName, candidate.region);
 	if (loaded) {
@@ -74123,7 +74275,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 	const logger = getLogger();
 	let assumeSucceeded = false;
 	if (args.assumeRoleArn) {
-		const stsRegion = args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+		const stsRegion = canonicalizeRegion(args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
 		try {
 			const creds = await assumeAgentCoreExecutionRole(args.assumeRoleArn, stsRegion);
 			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
@@ -76438,7 +76590,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;