@go-to-k/cdkd 0.283.10 → 0.283.12

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefaultAndSource, A as cyan, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as findSilentDropProperties, Bt as runDockerForeground, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalMigrateError, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as IntrinsicFunctionResolver, Gn as isThrottlingError, Gt as synthesisStatusMessage, H as slowCcOperationTimeoutMs, Hn as withErrorHandling, Ht as AssetManifestLoader, I as collectInlinePolicyNamesManagedBySiblings, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as refStateLookupFromResource, Jt as resolveApp, K as cfnRefValueFromPhysicalId, Kn as markNonRetryable, Kt as getDefaultStateBucketName, L as clearOnUpdateRemoval, Lt as buildDockerImage, M as green, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as red, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as formatResourceLine, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as assertRegionMatch, Qt as resolveStateBucketWithDefault, R as ProviderRegistry, Rt as formatDockerLoginError, S as unsupportedFinalSnapshotError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as isMarkedNonRetryable, Ut as getDockerImageBySourceHash, V as CloudControlProvider, Vn as normalizeAwsError, Vt as runDockerStreaming, W as isTerminationProtectionPropagationError, Wn as isRetryableTransientError, Wt as Synthesizer, X as normalizeAwsTagsToCfn, Xt as resolveCaptureObservedState, Y as WAFv2WebACLProvider, Yt as resolveAutoAssetStorage, Z as resolveExplicitPhysicalId, Zt as resolveSkipPrefix, _ as buildFinalSnapshotIdentifier, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as requireConfigObject, b as isFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketDomainName, d as deleteSkipReason, dn as derivePartitionAndUrlSuffix, dt as s3BucketWebsiteUrl, en as resolveUseCdkBootstrapAssets, et as configBooleanRefusal, f as withResourceDeadline, fn as AssemblyReader, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AwsClients, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveBucketRegion, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigArray, j as gray, jn as PartialFailureError, jt as ensureAssetStorage, k as bold, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as readConfigString, o as planFailedOps, on as findLargeInlineResources, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as processStackMessages, pt as DiffCalculator, q as getAccountInfo, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as replayWarn, s as planRollback, sn as uploadCfnTemplate, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as canonicalizeRegion, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as extractDeploymentEventError, wn as DeployCancelledError, wt as WorkGraph, x as refusesFinalSnapshot, xn as CdkdError, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as getDockerCmd } from "./deploy-engine-Bvr31OQ0.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-DHOpGcMS.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CrBdHIgB.js";
+import { t as ASGProvider } from "./asg-provider-BKR0cF_X.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -36881,7 +36881,7 @@ var Route53Provider = class {
 				physicalId: zoneId,
 				attributes: {
 					Id: zoneId,
-					NameServers: nameServers.join(",")
+					NameServers: nameServers
 				}
 			};
 		} catch (error) {
@@ -36915,7 +36915,7 @@ var Route53Provider = class {
 				wasReplaced: false,
 				attributes: {
 					Id: physicalId,
-					NameServers: nameServers.join(",")
+					NameServers: nameServers
 				}
 			};
 		} catch (error) {
@@ -37023,7 +37023,7 @@ var Route53Provider = class {
 	async getHostedZoneAttribute(physicalId, attributeName) {
 		switch (attributeName) {
 			case "Id": return physicalId;
-			case "NameServers": return ((await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? []).join(",");
+			case "NameServers": return (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			default: return;
 		}
 	}
@@ -65786,6 +65786,363 @@ function createEventsPruneCommand() {
 	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index (full purge)", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
 }
 
+//#endregion
+//#region src/utils/ecr-uri.ts
+/**
+* The ECR registry-host FORM TABLE — the ONE place the host forms AWS serves are
+* spelled (issue #1793).
+*
+* The forms used to be spelled TWICE, here and in `src/cli/commands/gc.ts`,
+* and the two already disagreed: gc carried the `-fips` and `on.aws` forms
+* while this module matched only the plain one, so a genuine FIPS or dual-stack
+* registry was not recognized here AT ALL and `cdkd local invoke` /
+* `run-task` classified it as a public image (anonymous pull, no
+* `docker login`).
+*
+* **What is shared is this TABLE, not the whole matcher** — read that precisely,
+* because the unification is deliberately PARTIAL. gc builds its pattern from
+* the table through {@link ecrRegistryHostPattern}; this module's own
+* {@link ECR_URI_HOST_REGEX} re-spells the alternation from the table's LABELS
+* column and cannot use that builder at all (its doc says why). So the shared
+* fact is which label runs AWS serves and which of them carry a FIXED suffix —
+* which is exactly what had drifted — while each matcher keeps its own
+* acceptance rule, deliberately: gc matches the suffix against the union over
+* every partition and {@link parseEcrRegistryHost} pairs it WITH the region (see
+* `gc.ts`'s `AWS_URL_SUFFIXES` doc for why the two strictnesses must not merge).
+*
+* A THIRD, looser spelling of "this is an ECR registry host" still lives outside
+* this table — `isCdkAssetImageUri`'s `host.includes('.dkr.ecr.')` in
+* `src/local/ecs-task-resolver.ts`, which recognizes only the plain form and is
+* case-SENSITIVE. It is tracked as issue #1846 rather than folded in here: it
+* must keep tolerating an UNRESOLVED host
+* (`${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}`), so it cannot
+* simply become a call to either matcher.
+*
+* Every row is read off the AWS-published `ecr` endpoint list
+* (https://docs.aws.amazon.com/general/latest/gr/ecr.html) plus the docker
+* push / pull examples in the ECR user guide's "Making requests to Amazon ECR
+* registries", rather than inferred:
+*
+* - `<acct>.dkr.ecr.<region>.<urlSuffix>` — the IPv4-only registry endpoint,
+*   every partition.
+* - `<acct>.dkr.ecr-fips.<region>.<urlSuffix>` — the FIPS IPv4 endpoint, served
+*   in `us-east-1` / `us-east-2` / `us-west-1` / `us-west-2` /
+*   `us-gov-east-1` / `us-gov-west-1` — i.e. only in partitions whose suffix is
+*   `amazonaws.com`, which is why pairing it with the region's own partition
+*   suffix is exactly right rather than merely convenient.
+* - `<acct>.dkr-ecr.<region>.on.aws` — the dual-stack (IPv4 + IPv6) endpoint.
+* - `<acct>.dkr-ecr-fips.<region>.on.aws` — the dual-stack FIPS endpoint, in the
+*   same six regions as the IPv4 FIPS form. This one was missing from BOTH
+*   copies of the grammar; unifying them is what surfaced it.
+*
+* The two dual-stack forms carry a FIXED suffix, so their check is that literal
+* rather than the region's partition suffix — the TIGHTEST available check for
+* them, not a relaxation: `on.aws` is an AWS-owned domain, so unlike a captured
+* suffix it cannot be substituted by a host someone else owns. They are
+* accepted for ANY region rather than only the partitions AWS documents them
+* in, deliberately: under-accepting is precisely the issue #1764 failure (a
+* cdkd table lagging AWS made a GENUINE registry classify as public), and the
+* suffix being AWS-owned means the widening cannot point a `docker login`
+* anywhere but AWS.
+*/
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{ labels: "dkr.ecr-fips" },
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws"
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws"
+	}
+];
+/**
+* {@link ECR_REGISTRY_HOST_FORMS} ordered LONGEST LABELS FIRST, so
+* `dkr.ecr-fips` is tried before its own `dkr.ecr` prefix instead of relying on
+* backtracking.
+*/
+const ECR_HOST_FORMS_LONGEST_FIRST = [...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length);
+/**
+* {@link ECR_REGISTRY_HOST_FORMS} keyed by its (already lower-case) labels, for
+* resolving which suffix rule the matched form wants.
+*/
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((form) => [form.labels, form]));
+/**
+* The host half of an ECR image URI as a regex SOURCE string, built from
+* {@link ECR_REGISTRY_HOST_FORMS} (issue #1793).
+*
+* ONE consumer: `cdkd gc`, which passes loose non-capturing sub-patterns and
+* matches the suffix against the union over every partition.
+*
+* **This module does NOT call it**, and that is structural rather than an
+* oversight — {@link ECR_URI_HOST_REGEX} re-spells the alternation from the
+* table's LABELS column instead. The strict matcher needs the suffix CAPTURED,
+* at a FIXED group index, to pair it with the region; this builder inlines a
+* `fixedUrlSuffix` as an UNCAPTURED literal, so the capturing-group count would
+* differ per alternative and the group index of the suffix would depend on which
+* form matched. Making the fixed suffix capturing to even the count is not the
+* fix either: it would hand gc a group it does not want, ahead of the tag /
+* digest groups it reads BY POSITION. So the sharable unit is the table, not the
+* pattern — and the cross-matcher test in `tests/unit/cli/gc.test.ts` is driven
+* off the table, so a row added there must work on BOTH sides or the suite reds.
+*
+* Every group this function ADDS is non-capturing, and that is load-bearing
+* rather than stylistic, for the same by-position reason: `gc.ts` reads its ECR
+* tag / digest by GROUP INDEX, and a capturing group here would silently shift
+* them. The caller's own three sub-patterns are interpolated verbatim, so
+* whether THOSE capture is the caller's business.
+*/
+function ecrRegistryHostPattern(segments) {
+	const forms = ECR_HOST_FORMS_LONGEST_FIRST.map((form) => {
+		const suffix = form.fixedUrlSuffix === void 0 ? segments.partitionUrlSuffix : escapeRegExp(form.fixedUrlSuffix);
+		return `${escapeRegExp(form.labels)}\\.${segments.region}\\.${suffix}`;
+	});
+	return `${segments.accountId}\\.(?:${forms.join("|")})`;
+}
+/**
+* Matching the HOST half of an ECR image URI:
+* `<acct>.<labels>.<region>.<urlSuffix>/`.
+*
+* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
+* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
+* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
+* silently classified a real ECR image as a user-managed one — skipping the
+* `docker login` it needs.
+*
+* The LABELS are captured too, because which suffix is expected depends on
+* WHICH form matched (issue #1793) — the dual-stack forms carry a fixed
+* `on.aws` rather than the region's partition suffix.
+*
+* Built from {@link ECR_REGISTRY_HOST_FORMS}'s LABELS column rather than through
+* {@link ecrRegistryHostPattern}: the builder cannot serve this matcher's fixed
+* capture-group layout (see its doc). The table is what the two matchers share.
+*
+* The `i` flag makes the labels case-INSENSITIVE (issue #1792). DNS is
+* case-insensitive, so `<acct>.DKR.ECR.<region>.<suffix>` names the same host,
+* but the labels were spelled as case-sensitive literals — and unlike the
+* issue #1786 defect one layer over, the host then did not match the SHAPE at
+* all, so `parseEcrRegistryHost` returned `undefined` AND
+* {@link looksLikeEcrHostWithForeignSuffix} returned `false`, i.e. not even the
+* issue #1764 diagnostic fired.
+*
+* Widening the shape is the right fix rather than a refusal because DOCKER
+* accepts an upper-cased registry host, so cdkd is not made to `docker login`
+* for a URI docker will then reject. `distribution/reference`'s grammar spells
+* `domain-component` as `([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])`
+* while the repository PATH is `alpha-numeric := [a-z0-9]+`, and
+* `ParseNormalizedNamed` raises `repository name must be lowercase` for the
+* REMOTE NAME only — `splitDockerDomain` performs no case folding on the
+* domain. This change never touches the repository path.
+*
+* What docker does NOT fold is its CREDENTIAL STORE, which is keyed on the
+* hostname verbatim (measured in issue #1801: a pull of an upper-cased host
+* sent no credentials at all, while the lower-cased spelling authenticated).
+* That is why the fix here is only the SHAPE match: the login / pull spelling
+* is reconciled one layer up by `ecr-puller.ts`'s `canonicalizeImageUriHost`,
+* which every docker-facing consumer already routes through. Issue #1817
+* tracks moving that fold in here.
+*
+* **Every verdict issues #1792 / #1793 changed, in full** — `p` is
+* {@link parseEcrRegistryHost}, `d` is
+* {@link looksLikeEcrHostWithForeignSuffix} (the issue #1764 diagnostic), `S`
+* is the region's own partition suffix and `F` a foreign one. The table is
+* spelled out because the DIAGNOSTIC-ONLY rows are the easy ones to omit: `p`
+* is unchanged there, so a summary that tracks only the parse verdict reads as
+* "no change" while a warning that never used to fire now does.
+*
+* ```text
+*   host                              before        after         what changed
+*   <a>.dkr.ecr.<r>.S                 p=ok  d=f     p=ok  d=f     nothing
+*   <a>.dkr.ecr.<r>.F                 p=und d=TRUE  p=und d=TRUE  nothing
+*   <a>.dkr.ecr.<r>.on.aws            p=und d=TRUE  p=und d=TRUE  nothing (*)
+*   <a>.DKR.ECR.<r>.S                 p=und d=f     p=ok  d=f     #1792 PARSE
+*   <a>.DKR.ECR.<r>.F                 p=und d=f     p=und d=TRUE  #1792 diag only
+*   <a>.dkr.ecr-fips.<r>.S            p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr.ecr-fips.<r>.F            p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr-ecr.<r>.on.aws            p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr-ecr-fips.<r>.on.aws       p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr-ecr.<r>.S                 p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr-ecr-fips.<r>.S            p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr.ecr-fips.<r>.on.aws       p=und d=f     p=und d=TRUE  #1793 diag only
+* ```
+*
+* (*) `dkr.ecr` + `on.aws` is the one mispairing that ALREADY reported `true`
+* before the change: the pre-#1793 pattern matched the plain labels against a
+* wildcard `([^/]+)` suffix, so `on.aws` was simply a suffix that is not
+* `amazonaws.com`. Every other row that flips `d` was previously refused at the
+* SHAPE, which is why both verdicts were quiet.
+*
+* The five `d`-only flips are an improvement in kind — a host AWS does not serve
+* now says so instead of passing silently as a public image — but the caller's
+* MESSAGE was written for the #1764 partition-gap case and now over-claims for a
+* form/suffix mispairing (`amazonaws.com` IS `us-east-1`'s partition suffix).
+* `src/local/ecs-task-resolver.ts` owns that wording; recorded on issue #1846.
+*/
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${ECR_HOST_FORMS_LONGEST_FIRST.map((form) => escapeRegExp(form.labels)).join("|")})\\.([^.]+)\\.([^/]+)/`, "i");
+/**
+* A region segment cdkd is willing to treat as a region id.
+*
+* Case is not the only way the `startsWith` partition classification can be
+* side-stepped: any leading junk defeats it the same way, and the captured
+* segment does not stay inert — it becomes an `ECRClient({region})` and is
+* interpolated into the fallback `docker login` endpoint. Measured before this
+* guard: `…dkr.ecr. us-iso-east-1.amazonaws.com/…` (leading space) and a
+* combining-mark form both parsed, yielding regions `" us-iso-east-1"` and
+* `"us-i̇so-east-1"`. Neither leaks credentials — an ACCEPTED suffix is always
+* an AWS-owned domain — but a region id is ASCII alphanumeric plus `-`, so
+* anything else is a malformed host and refusing it keeps the classification
+* honest.
+*
+* TESTED AGAINST THE RAW SEGMENT, BEFORE `toLowerCase()`, and that order is the
+* whole point: `String.prototype.toLowerCase` performs full Unicode case
+* folding, so the Kelvin sign U+212A folds to a plain ASCII `k`. Checking the
+* FOLDED segment therefore accepts `us-eKst-1` and yields the region
+* `us-ekst-1` — a region the host does not name — which is precisely the
+* class of substitution this guard exists to refuse. Matching `[A-Za-z0-9-]`
+* on the raw capture keeps case-insensitivity (the point of issue #1786) while
+* admitting only characters that fold to themselves.
+*
+* ONE DELIBERATE SIDE EFFECT, called out because it is a withdrawal rather than
+* an addition: a malformed-region host is now classified as an ordinary public
+* image with NO cdkd-side signal at all — neither the ECR verdict nor the #1764
+* foreign-suffix diagnostic. Both arms change, not just the foreign one:
+* `<acct>.dkr.ecr.us_east_1.example.com/…` used to log the partition-gap
+* warning and now logs nothing, and `<acct>.dkr.ecr.us_east_1.amazonaws.com/…`
+* used to be ACCEPTED as ECR and is now refused. That is the correct verdict
+* rather than a regression — the diagnostic's whole subject is "this suffix does
+* not belong to its region's PARTITION", and a segment that is not a region id
+* has no partition to belong to, so reporting it would send the reader hunting
+* for a table entry that could never exist — but it does mean a typo'd region
+* gets no cdkd-side hint, only docker's own pull failure. Both arms are pinned
+* by tests so a future widening of the guard cannot flip them silently.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* A URL suffix cdkd is willing to compare against the partition table.
+*
+* The SAME raw-capture rule as the region, and for the same reason one layer
+* over: the suffix is folded before the comparison, so a code point folding
+* into ASCII can impersonate a partition's suffix. This became reachable the
+* moment issue #1764 landed `aws-isoe`'s `cloud.adc-e.uk` — that suffix
+* contains a `k`, so `…dkr.ecr.eu-isoe-west-1.cloud.adc-e.uK/…` (Kelvin
+* sign) folded onto it and was ACCEPTED. Not a credential leak, since UTS-46
+* maps U+212A to `k` too and the host resolves to the real AWS domain, but it
+* falsifies the invariant the region guard's comment above states, so both
+* captures are held to the same rule rather than only the one that was
+* measured first.
+*
+* Dots are admitted because a suffix is a dotted DNS name; every other
+* character is refused, so the accepted set stays exactly the partition
+* table's own literals.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* The ONE case-normalization boundary of this module (issue #1786).
+*
+* DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
+* `us-iso-east-1.amazonaws.com` name the same host — but both halves of the
+* #1758 suffix check were case-SENSITIVE, in OPPOSITE directions:
+*
+* - an upper-cased REGION fails every `startsWith` prefix test in
+*   `derivePartitionAndUrlSuffix`, so it falls through to the commercial
+*   partition whose suffix is `amazonaws.com` — which is exactly what an ISO
+*   look-alike host carries, so the strict check ACCEPTED it (the bypass);
+* - an upper-cased region or SUFFIX on a GENUINE host stopped matching its own
+*   partition's suffix, so a real ECR registry was REJECTED and the caller
+*   silently classified it as a user-managed image — the #1758 regression, one
+*   layer up.
+*
+* The normalization lives HERE rather than inside `derivePartitionAndUrlSuffix`
+* because this is the boundary where an untrusted, DNS-shaped string enters
+* cdkd, and keeping it in ONE function means both exported entry points below —
+* and the suffix COMPARISON itself — cannot drift apart.
+*
+* This does NOT duplicate `canonicalizeRegion`, which issue #1795 added inside
+* `derivePartitionAndUrlSuffix` so the mapping folds its own input. The two
+* answer different questions and both are needed: that one makes the partition
+* LOOKUP case-insensitive for every caller, while these guards decide whether
+* the captured segments are a region id and a URL suffix AT ALL. Folding alone
+* cannot do that — folding is precisely what turns `us-eKst-1` into the
+* plausible `us-ekst-1` (see the guards' own comments), so a fold-only helper
+* makes the substitution easier to reach, not harder. Double-folding is a
+* no-op, which is why the redundant `toLowerCase()` calls below are left in
+* rather than removed: they keep this function the single answer for the
+* comparison even if the helper's behaviour changes again.
+*
+* The derived suffix is lower-cased too. Every entry in the partition table is
+* a lower-case literal today, so that is a no-op; it is there so this function
+* stays the single answer even if that table ever gains a mixed-case entry.
+*/
+function matchEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	if (!CANONICAL_REGION_SEGMENT.test(m[3])) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(m[4])) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(m[2].toLowerCase());
+	if (!form) return void 0;
+	const region = m[3].toLowerCase();
+	return {
+		accountId: m[1],
+		region,
+		suffix: m[4].toLowerCase(),
+		expectedSuffix: (form.fixedUrlSuffix ?? derivePartitionAndUrlSuffix(region).urlSuffix).toLowerCase()
+	};
+}
+/**
+* The account + region of an ECR image URI, or `undefined` when the URI is not
+* an ECR registry host — either because it does not have one of the shapes
+* {@link ECR_REGISTRY_HOST_FORMS} lists, or because its suffix is not the one
+* the matched form carries for the region it names.
+*
+* Lives in `src/utils/` rather than beside its first caller because it has TWO
+* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
+* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
+* image that may carry a digest or no tag at all). Before issue #1758 they each
+* carried their own copy of the hardcoded commercial pattern, and fixing only
+* the pull path left `cdkd local run-task` broken outside the commercial
+* partition; ONE definition is what stops them drifting apart again.
+*
+* The module is deliberately free of AWS SDK imports, which is what lets
+* `ecs-task-resolver.ts` consume it without breaking the invariant that module
+* documents about itself (it resolves secrets through a separate module for
+* exactly that reason).
+*
+* The returned `region` is LOWER-CASED (issue #1786) — it is consumed as an SDK
+* client region by `ecr-puller.ts` and as the `region` of a `kind: 'ecr'` image
+* by `ecs-task-resolver.ts`, and the canonical spelling of an AWS region id is
+* lower case.
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = matchEcrRegistryHost(imageUri);
+	if (!m) return void 0;
+	if (m.suffix !== m.expectedSuffix) return void 0;
+	return {
+		accountId: m.accountId,
+		region: m.region
+	};
+}
+/**
+* True when the URI has one of the ECR HOST SHAPES but carries a suffix that
+* form does not serve for the region it names — i.e. exactly the case
+* {@link parseEcrRegistryHost} rejects for a reason the caller may want to
+* report.
+*
+* Since issue #1793 that covers a form / suffix MISPAIRING too, not only a
+* foreign suffix: `<acct>.dkr-ecr.<region>.amazonaws.com` and
+* `<acct>.dkr.ecr.<region>.on.aws` each spell one form's labels with the
+* other's suffix, and AWS serves neither.
+*
+* The two rejections are worth telling apart at a call site that degrades
+* silently: a genuinely public image and a registry in a partition
+* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
+* `undefined`, and only the second is a cdkd gap rather than a user choice.
+*/
+function looksLikeEcrHostWithForeignSuffix(imageUri) {
+	const m = matchEcrRegistryHost(imageUri);
+	return m !== void 0 && m.suffix !== m.expectedSuffix;
+}
+
 //#endregion
 //#region src/cli/commands/gc.ts
 /**
@@ -65845,10 +66202,6 @@ function parseOlderThan(value) {
 	const multiplier = match[2] === "d" ? 1440 * 60 * 1e3 : 3600 * 1e3;
 	return Math.round(num * multiplier);
 }
-/** Escape a literal string for embedding in a RegExp. */
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 /**
 * Characters that terminate an S3 key extracted from a URL-shaped string.
 * Whitespace / quotes never appear in cdkd's content-addressed asset keys
@@ -65886,30 +66239,50 @@ const GC_EXTRA_URL_SUFFIXES = [];
 */
 const URL_SUFFIX_ALTERNATION = `(?:${[...[.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
 /**
-* The HOST half of an ECR registry, as an alternation over the forms AWS
-* serves: `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
-* `<acct>.dkr.ecr-fips.<region>.<urlSuffix>`, and the short-form alias
-* `<acct>.dkr-ecr.<region>.on.aws`.
-*
-* Kept DELIBERATELY separate from the S3 matchers' shared
-* {@link URL_SUFFIX_ALTERNATION} rather than folded into it: `on.aws` is an
-* ECR-only endpoint, so adding it to the shared suffix set would also make
-* `https://<assetBucket>.s3.<region>.on.aws/<key>` a recognized S3 reference.
-* Widening either matcher only ever over-PROTECTS, but the two services' host
-* grammars genuinely differ and conflating them is how the next widening goes
-* wrong.
+* The HOST half of an ECR registry, built from the ONE authoritative FORM TABLE
+* in `src/utils/ecr-uri.ts` (issue #1793) instead of spelled a second time here.
+*
+* That module owns which segment spellings AWS serves — the plain
+* `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
+* `<acct>.dkr.ecr-fips.<region>.<urlSuffix>`, and the two dual-stack forms
+* `<acct>.dkr-ecr[-fips].<region>.on.aws` — while each matcher keeps its own
+* suffix-ACCEPTANCE rule on top: gc passes the union over every partition
+* ({@link URL_SUFFIX_ALTERNATION}), whereas `parseEcrRegistryHost` pairs the
+* captured suffix WITH the region. See the {@link AWS_URL_SUFFIXES} doc for why
+* the two strictnesses are deliberate and must not be merged.
+*
+* gc is the ONLY consumer of {@link ecrRegistryHostPattern}: the strict matcher
+* there needs the suffix captured at a fixed group index and so re-spells the
+* alternation off the same table's labels column. What the two share is the
+* TABLE, not the pattern — enough to stop the FORMS drifting, which is what had
+* gone wrong, and the cross-matcher test in `tests/unit/cli/gc.test.ts` is driven
+* off the table so a row added there must work on both sides.
+*
+* Sharing the table immediately brought a form gc was MISSING:
+* `<acct>.dkr-ecr-fips.<region>.on.aws`, the dual-stack FIPS endpoint. A form
+* missing here reads a live image as unreferenced and DELETES it, so this is the
+* irreversible direction — which is the whole argument for one definition.
+*
+* `on.aws` still does not reach the S3 matchers, and now cannot: it is an
+* ECR-only endpoint, so folding it into the shared suffix set would also make
+* `https://<assetBucket>.s3.<region>.on.aws/<key>` a recognized S3 reference —
+* and in the form table a fixed suffix travels WITH its own form rather than
+* sitting in a shared set, so that separation is mechanical instead of
+* remembered.
 *
 * Account and region are matched loosely on purpose (see the extractor doc):
 * collecting a reference from another account's or region's URI can only KEEP
-* more, never delete more — which is also why the two extra forms are worth
-* carrying even though cdkd's own publisher writes the plain one. Issue #1793
-* tracks deriving these host forms from ONE place shared with
-* `src/utils/ecr-uri.ts` instead of two hand-kept copies — that module matches
-* only the plain `dkr.ecr` form today, so the two already disagree.
+* more, never delete more — which is also why the extra forms are worth
+* carrying even though cdkd's own publisher writes the plain one.
 *
-* Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason.
+* Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason;
+* {@link ecrRegistryHostPattern} guarantees it for the groups IT adds.
 */
-const ECR_REGISTRY_HOST = `\\d{12}\\.(?:dkr\\.ecr(?:-fips)?\\.[a-z0-9-]+\\.${URL_SUFFIX_ALTERNATION}|dkr-ecr\\.[a-z0-9-]+\\.on\\.aws)`;
+const ECR_REGISTRY_HOST = ecrRegistryHostPattern({
+	accountId: "\\d{12}",
+	region: "[a-z0-9-]+",
+	partitionUrlSuffix: URL_SUFFIX_ALTERNATION
+});
 /**
 * cdkd's publishers write content-addressed keys (`<sha256>.<ext>`). A
 * second, name-independent pass collects every such token from every
@@ -65967,7 +66340,7 @@ function buildReferenceExtractors(marker) {
 	const s3UriRe = new RegExp(`s3://${bucket}/(${KEY_TERMINATORS}+)`, "g");
 	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/(${KEY_TERMINATORS}+)`, "g");
 	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "g");
+	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "gi");
 	const extractOnce = (value, refs) => {
 		for (const re of [
 			s3UriRe,
@@ -65976,7 +66349,7 @@ function buildReferenceExtractors(marker) {
 		]) for (const match of value.matchAll(re)) if (match[1]) refs.s3Keys.add(match[1]);
 		for (const match of value.matchAll(ecrRe)) {
 			if (match[1]) refs.imageTags.add(match[1]);
-			if (match[2]) refs.imageDigests.add(match[2]);
+			if (match[2]) refs.imageDigests.add(match[2].toLowerCase());
 		}
 		for (const match of value.matchAll(CONTENT_HASH_KEY_RE)) refs.s3Keys.add(match[0]);
 	};
@@ -69183,183 +69556,6 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
-//#endregion
-//#region src/utils/ecr-uri.ts
-/**
-* Matching the HOST half of an ECR image URI:
-* `<acct>.dkr.ecr.<region>.<urlSuffix>/`.
-*
-* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
-* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
-* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
-* silently classified a real ECR image as a user-managed one — skipping the
-* `docker login` it needs.
-*
-* KNOWN BOUND (issue #1792): the `dkr.ecr` LABELS are still matched
-* case-sensitively, so `<acct>.DKR.ECR.<region>.<suffix>/` does not match at
-* all. Audited deliberately while fixing issue #1786 rather than missed — that
-* issue's normalization covers the captured region + suffix, i.e. the strict
-* CHECK, whereas widening the shape MATCHER makes cdkd `docker login` to a
-* host shape it previously skipped, which is a behavior expansion wanting its
-* own decision. The failure direction here is the safe one: NO credentials are
-* sent on any of the four call sites. Traced — `local run-task` and
-* `local invoke-agentcore` fall through to an anonymous `docker pull` that
-* fails, while `local invoke` and `local start-api` REFUSE before any pull.
-*/
-const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
-/**
-* A region segment cdkd is willing to treat as a region id.
-*
-* Case is not the only way the `startsWith` partition classification can be
-* side-stepped: any leading junk defeats it the same way, and the captured
-* segment does not stay inert — it becomes an `ECRClient({region})` and is
-* interpolated into the fallback `docker login` endpoint. Measured before this
-* guard: `…dkr.ecr. us-iso-east-1.amazonaws.com/…` (leading space) and a
-* combining-mark form both parsed, yielding regions `" us-iso-east-1"` and
-* `"us-i̇so-east-1"`. Neither leaks credentials — an ACCEPTED suffix is always
-* an AWS-owned domain — but a region id is ASCII alphanumeric plus `-`, so
-* anything else is a malformed host and refusing it keeps the classification
-* honest.
-*
-* TESTED AGAINST THE RAW SEGMENT, BEFORE `toLowerCase()`, and that order is the
-* whole point: `String.prototype.toLowerCase` performs full Unicode case
-* folding, so the Kelvin sign U+212A folds to a plain ASCII `k`. Checking the
-* FOLDED segment therefore accepts `us-eKst-1` and yields the region
-* `us-ekst-1` — a region the host does not name — which is precisely the
-* class of substitution this guard exists to refuse. Matching `[A-Za-z0-9-]`
-* on the raw capture keeps case-insensitivity (the point of issue #1786) while
-* admitting only characters that fold to themselves.
-*
-* ONE DELIBERATE SIDE EFFECT, called out because it is a withdrawal rather than
-* an addition: a malformed-region host is now classified as an ordinary public
-* image with NO cdkd-side signal at all — neither the ECR verdict nor the #1764
-* foreign-suffix diagnostic. Both arms change, not just the foreign one:
-* `<acct>.dkr.ecr.us_east_1.example.com/…` used to log the partition-gap
-* warning and now logs nothing, and `<acct>.dkr.ecr.us_east_1.amazonaws.com/…`
-* used to be ACCEPTED as ECR and is now refused. That is the correct verdict
-* rather than a regression — the diagnostic's whole subject is "this suffix does
-* not belong to its region's PARTITION", and a segment that is not a region id
-* has no partition to belong to, so reporting it would send the reader hunting
-* for a table entry that could never exist — but it does mean a typo'd region
-* gets no cdkd-side hint, only docker's own pull failure. Both arms are pinned
-* by tests so a future widening of the guard cannot flip them silently.
-*/
-const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
-/**
-* A URL suffix cdkd is willing to compare against the partition table.
-*
-* The SAME raw-capture rule as the region, and for the same reason one layer
-* over: the suffix is folded before the comparison, so a code point folding
-* into ASCII can impersonate a partition's suffix. This became reachable the
-* moment issue #1764 landed `aws-isoe`'s `cloud.adc-e.uk` — that suffix
-* contains a `k`, so `…dkr.ecr.eu-isoe-west-1.cloud.adc-e.uK/…` (Kelvin
-* sign) folded onto it and was ACCEPTED. Not a credential leak, since UTS-46
-* maps U+212A to `k` too and the host resolves to the real AWS domain, but it
-* falsifies the invariant the region guard's comment above states, so both
-* captures are held to the same rule rather than only the one that was
-* measured first.
-*
-* Dots are admitted because a suffix is a dotted DNS name; every other
-* character is refused, so the accepted set stays exactly the partition
-* table's own literals.
-*/
-const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
-/**
-* The ONE case-normalization boundary of this module (issue #1786).
-*
-* DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
-* `us-iso-east-1.amazonaws.com` name the same host — but both halves of the
-* #1758 suffix check were case-SENSITIVE, in OPPOSITE directions:
-*
-* - an upper-cased REGION fails every `startsWith` prefix test in
-*   `derivePartitionAndUrlSuffix`, so it falls through to the commercial
-*   partition whose suffix is `amazonaws.com` — which is exactly what an ISO
-*   look-alike host carries, so the strict check ACCEPTED it (the bypass);
-* - an upper-cased region or SUFFIX on a GENUINE host stopped matching its own
-*   partition's suffix, so a real ECR registry was REJECTED and the caller
-*   silently classified it as a user-managed image — the #1758 regression, one
-*   layer up.
-*
-* The normalization lives HERE rather than inside `derivePartitionAndUrlSuffix`
-* because this is the boundary where an untrusted, DNS-shaped string enters
-* cdkd, and keeping it in ONE function means both exported entry points below —
-* and the suffix COMPARISON itself — cannot drift apart.
-*
-* This does NOT duplicate `canonicalizeRegion`, which issue #1795 added inside
-* `derivePartitionAndUrlSuffix` so the mapping folds its own input. The two
-* answer different questions and both are needed: that one makes the partition
-* LOOKUP case-insensitive for every caller, while these guards decide whether
-* the captured segments are a region id and a URL suffix AT ALL. Folding alone
-* cannot do that — folding is precisely what turns `us-eKst-1` into the
-* plausible `us-ekst-1` (see the guards' own comments), so a fold-only helper
-* makes the substitution easier to reach, not harder. Double-folding is a
-* no-op, which is why the redundant `toLowerCase()` calls below are left in
-* rather than removed: they keep this function the single answer for the
-* comparison even if the helper's behaviour changes again.
-*
-* The derived suffix is lower-cased too. Every entry in the partition table is
-* a lower-case literal today, so that is a no-op; it is there so this function
-* stays the single answer even if that table ever gains a mixed-case entry.
-*/
-function matchEcrRegistryHost(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
-	if (!m) return void 0;
-	if (!CANONICAL_REGION_SEGMENT.test(m[2])) return void 0;
-	if (!CANONICAL_URL_SUFFIX.test(m[3])) return void 0;
-	const region = m[2].toLowerCase();
-	return {
-		accountId: m[1],
-		region,
-		suffix: m[3].toLowerCase(),
-		expectedSuffix: derivePartitionAndUrlSuffix(region).urlSuffix.toLowerCase()
-	};
-}
-/**
-* The account + region of an ECR image URI, or `undefined` when the URI is not
-* an ECR registry host for the region it names.
-*
-* Lives in `src/utils/` rather than beside its first caller because it has TWO
-* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
-* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
-* image that may carry a digest or no tag at all). Before issue #1758 they each
-* carried their own copy of the hardcoded commercial pattern, and fixing only
-* the pull path left `cdkd local run-task` broken outside the commercial
-* partition; ONE definition is what stops them drifting apart again.
-*
-* The module is deliberately free of AWS SDK imports, which is what lets
-* `ecs-task-resolver.ts` consume it without breaking the invariant that module
-* documents about itself (it resolves secrets through a separate module for
-* exactly that reason).
-*
-* The returned `region` is LOWER-CASED (issue #1786) — it is consumed as an SDK
-* client region by `ecr-puller.ts` and as the `region` of a `kind: 'ecr'` image
-* by `ecs-task-resolver.ts`, and the canonical spelling of an AWS region id is
-* lower case.
-*/
-function parseEcrRegistryHost(imageUri) {
-	const m = matchEcrRegistryHost(imageUri);
-	if (!m) return void 0;
-	if (m.suffix !== m.expectedSuffix) return void 0;
-	return {
-		accountId: m.accountId,
-		region: m.region
-	};
-}
-/**
-* True when the URI has the ECR HOST SHAPE but its suffix does not belong to
-* the region it names — i.e. exactly the case {@link parseEcrRegistryHost}
-* rejects for a reason the caller may want to report.
-*
-* The two rejections are worth telling apart at a call site that degrades
-* silently: a genuinely public image and a registry in a partition
-* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
-* `undefined`, and only the second is a cdkd gap rather than a user choice.
-*/
-function looksLikeEcrHostWithForeignSuffix(imageUri) {
-	const m = matchEcrRegistryHost(imageUri);
-	return m !== void 0 && m.suffix !== m.expectedSuffix;
-}
-
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -78062,7 +78258,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.10");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.12");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;