@go-to-k/cdkd 0.283.12 → 0.283.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-DHOpGcMS.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-B8gQpv93.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BKR0cF_X.js";
+import { t as ASGProvider } from "./asg-provider-CgnPBnOS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -20534,6 +20534,128 @@ var SSMParameterProvider = class {
 		return out;
 	}
 	/**
+	* Build the `Arn` attribute for an SSM parameter (issue #1824).
+	*
+	* WHY THIS EXISTS. An output / cross-resource `Fn::GetAtt` reads the CACHED
+	* `resource.attributes[<CFnName>]` in
+	* `IntrinsicFunctionResolver.constructAttribute`, which never calls a
+	* provider's `getAttribute` — and for an `*Arn` name the resolver's shape
+	* guard HARD-FAILS rather than degrading when the cached value is missing and
+	* the physicalId is name-shaped (an SSM physicalId IS the parameter name). So
+	* `new cdk.CfnOutput(this, 'ParamArn', { value: param.attrArn })` failed the
+	* deploy until the ARN was cached under its CFn name.
+	*
+	* SOURCE DECISION — CONSTRUCTED, not read back. `PutParameter` returns only
+	* `Version` / `Tier`, so there were exactly two candidate sources, and the
+	* rejected one is recorded here so the call stays challengeable:
+	*
+	*  - `GetParameter`'s `Parameter.ARN` is authoritative, and cdkd already
+	*    issues that call in `readCurrentState` / `import`, so it needs no new IAM
+	*    permission. It was REJECTED on COST: it would be a brand-new round trip
+	*    on EVERY parameter create AND every update, and SSM parameters are among
+	*    the most numerous resources in real CDK stacks — a 50-parameter stack
+	*    would pay 50 extra reads for a value that is a pure function of data
+	*    cdkd already holds, against a project whose whole premise is removing
+	*    round trips.
+	*  - CONSTRUCTION is deterministic. The parameter ARN is the documented
+	*    `arn:{partition}:ssm:{region}:{account}:parameter/{name}`, with the
+	*    name's leading `/` folded into the separator — the same formula
+	*    `aws-cdk-lib`'s `StringParameter.parameterArn` uses — so nothing has to
+	*    be discovered from AWS. It is also the established idiom in this repo for
+	*    "the create response carries no ARN": `AppSyncProvider.buildAppSyncArn`
+	*    and the four `CloudControlProvider` enrichment sites (KMS key, ECR
+	*    repository x2, Kinesis stream) all construct through the same
+	*    `getAccountInfo` + `derivePartitionAndUrlSuffix` + `fabricated`-refusal
+	*    pair this method reuses.
+	*
+	* The PARTITION is DERIVED, never hardcoded `arn:aws:` — that hardcoding is an
+	* active bug class here (#1794 / #1815), and on a `cn-` / `us-gov-` deploy it
+	* would record an ARN naming a partition the parameter is not in.
+	*
+	* The `fabricated`-account guard (#1730 / #1746) is honored by REFUSING rather
+	* than by substituting: `getAccountInfo` catches its own STS failure and
+	* answers the placeholder `123456789012`, which carries no wildcard and is
+	* therefore invisible to `isPlaceholderArn`, so a fabricated id must yield NO
+	* attribute instead of a plausible-looking wrong one. Returning `undefined`
+	* degrades to exactly the pre-fix behavior — the resolver's shape guard fails
+	* LOUDLY on the name-shaped physicalId — never to a silently wrong value.
+	*
+	* DEGRADATION ON THE UPDATE PATH is a DELIBERATE trade-off, not one this
+	* design avoids. An update result's `attributes` REPLACE the state record's
+	* rather than merging into it (`deploy-engine.ts`:
+	* `result.attributes ?? (wasReplaced ? undefined : currentResource.attributes)`),
+	* so whenever this method degrades during an `update` the returned map carries
+	* no `Arn` and the create-time one is DROPPED. Construction does not prevent
+	* that — it only swaps WHICH dependency can fail, STS plus the client's region
+	* resolver instead of SSM — so read the source decision above as buying one
+	* fewer round trip and nothing else.
+	*
+	* The alternative is to return NO `attributes` at all on the degraded path, so
+	* the engine's `??` carries the previous map forward and the `Arn` survives.
+	* That is REJECTED: the same map carries `Type` / `Value`, which are the values
+	* THIS update just sent. Carrying the previous map forward would answer
+	* `Fn::GetAtt [Param, Value]` with the SUPERSEDED value — silently, and to a
+	* question cdkd can answer correctly — and would hand `cdkd drift` a baseline
+	* AWS does not hold. Dropping the `Arn` instead degrades to the resolver's LOUD
+	* `*Arn` shape-guard failure, which is exactly the pre-fix behavior, and the
+	* resource's next UPDATE re-records it. A loud missing value beats a quiet
+	* wrong one — the same reasoning the `fabricated`-account arm above applies.
+	*
+	* Two honest bounds on that "next update re-records it". `getAccountInfo`
+	* caches a SUCCESSFUL identity for the process, so within one deploy only a run
+	* whose FIRST `GetCallerIdentity` fails degrades at all — but the 10s
+	* fabricated-answer TTL then covers every parameter created in that window
+	* rather than a random subset. And a plain re-deploy does NOT heal it: a
+	* resource whose resolved properties equal its state record is skipped with no
+	* provider call, so healing needs a real property change (issue
+	* [#1852](https://github.com/go-to-k/cdkd/issues/1852), which also covers the
+	* resolver message that currently misattributes this to a missing enrichment).
+	*
+	* NEVER THROWS, and that is enforced here rather than asserted at the call
+	* sites. `create` calls this AFTER `PutParameter` has already committed a
+	* parameter, so a throw would surface as a failed create over a missing
+	* ATTRIBUTE — leaving an orphan that makes the next deploy hit
+	* `ParameterAlreadyExists` (the issue #376 class), and the cleanup that exists
+	* for that is deliberately out of reach by then. `getAccountInfo` catches its
+	* own STS failure, but `config.region()` is a resolver that can reject, so the
+	* whole body is wrapped: an unexpected failure degrades to "no Arn recorded"
+	* exactly as the fabricated-account arm does.
+	*/
+	async buildParameterArn(name) {
+		try {
+			return await this.buildParameterArnUnguarded(name);
+		} catch (error) {
+			this.logger.warn(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`);
+			return;
+		}
+	}
+	/**
+	* {@link buildParameterArn}'s body. Only that method may call it.
+	*
+	* `name` is always a parameter NAME, never an ARN, and that is an INVARIANT
+	* rather than an assumption this method has to defend (issue #1824 review
+	* round 3). Both callers pass a value SSM has just accepted as a
+	* `PutParameter` `Name`, and that field forbids an ARN outright — "You can't
+	* enter the Amazon Resource Name (ARN) for a parameter, only the parameter
+	* name itself", plus a name charset of `a-zA-Z0-9_.-` and `/` that excludes
+	* `:`. So an ARN-shaped id fails at `PutParameter` several statements ABOVE
+	* this method on both paths, and a guard here could only ever fire against a
+	* mock. Round 2 added exactly such a guard, believing an ARN could arrive from
+	* `cdkd import --resource Param=arn:...`; it can, but the defect is that the
+	* import RECORDED it, so the fix belongs at the import boundary — where
+	* `import()` now refuses it — and not here. Do not re-add it.
+	*/
+	async buildParameterArnUnguarded(name) {
+		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
+		if (accountInfo.fabricated) {
+			this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+			return;
+		}
+		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+		const qualifiedName = name.startsWith("/") ? name.slice(1) : name;
+		return `arn:${partition}:ssm:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:parameter/${qualifiedName}`;
+	}
+	/**
 	* Create an SSM parameter
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -20575,11 +20697,13 @@ var SSMParameterProvider = class {
 				throw innerError;
 			}
 			this.logger.debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			const arn = await this.buildParameterArn(name);
 			return {
 				physicalId: name,
 				attributes: {
 					Type: type,
-					Value: value
+					Value: value,
+					...arn !== void 0 && { Arn: arn }
 				}
 			};
 		} catch (error) {
@@ -20626,12 +20750,14 @@ var SSMParameterProvider = class {
 				this.logger.debug(`Updated tags for SSM parameter ${physicalId}`);
 			}
 			this.logger.debug(`Successfully updated SSM parameter ${logicalId}`);
+			const arn = await this.buildParameterArn(physicalId);
 			return {
 				physicalId,
 				wasReplaced: false,
 				attributes: {
 					Type: type,
-					Value: value
+					Value: value,
+					...arn !== void 0 && { Arn: arn }
 				}
 			};
 		} catch (error) {
@@ -20742,6 +20868,57 @@ var SSMParameterProvider = class {
 		return result;
 	}
 	/**
+	* Refuse a physical id SSM's WRITE APIs could never accept (issue #1824
+	* review round 3).
+	*
+	* An SSM parameter's physicalId must always be the parameter NAME, because
+	* that is the only thing the write APIs take. `PutParameterRequest.Name`:
+	* "You can't enter the Amazon Resource Name (ARN) for a parameter, only the
+	* parameter name itself", with a name charset of `a-zA-Z0-9_.-` plus `/` as
+	* the hierarchy separator; `DeleteParameterRequest.Name` repeats the ARN
+	* prohibition verbatim. A COLON therefore cannot appear in any writable name,
+	* which is the single predicate used here — it covers both shapes
+	* `GetParameter` additionally accepts and this method has to stop:
+	*
+	*  - an ARN (`arn:aws:ssm:us-east-1:111122223333:parameter/foo`), and
+	*  - a version / label SELECTOR (`GetParameterRequest.Name`: "To query by
+	*    parameter label, use `"Name": "name:label"`. To query by parameter
+	*    version, use `"Name": "name:version"`").
+	*
+	* Both sail through this provider's existence check, so before this guard the
+	* value was RECORDED as the physicalId and the damage landed later and
+	* elsewhere: `cdkd deploy` failing at `PutParameter({Name: physicalId})` with
+	* a `ValidationException` after a `Value` change, and `cdkd destroy` failing
+	* identically at `DeleteParameter`. This is where the bad value ENTERS
+	* (`--resource` / `Properties.Name`), so it is where it is stopped.
+	*
+	* REFUSED, NOT NORMALIZED to the name, and the ARN grammar is the reason. The
+	* mapping back is genuinely ambiguous rather than merely awkward:
+	*
+	*  - The leading `/` is NOT recoverable. `arn:…:parameter/foo` is the ARN of
+	*    BOTH the simple name `foo` and the one-level hierarchical name `/foo`,
+	*    since the name's leading slash IS the separator — `aws-cdk-lib`'s
+	*    `arnForParameterName` renders the two to the identical string, and that
+	*    is precisely why CDK needs an explicit `simpleName` flag whenever the
+	*    name is a token. Guessing wrong writes a physicalId naming a DIFFERENT
+	*    parameter, i.e. converts a loud failure into a silent wrong-resource
+	*    write.
+	*  - A parameter SHARED from another account has no name form at all
+	*    ("For parameters shared with you from another account, you must use the
+	*    full ARN"), so for that shape there is nothing to normalize TO.
+	*
+	* A refusal is a loud, fixable error, and the message names the exact command
+	* that prints the name to pass instead.
+	*/
+	refuseUnwritableParameterId(input, explicit) {
+		if (!explicit.includes(":")) return;
+		const isArn = explicit.startsWith("arn:");
+		const shape = isArn ? "an ARN" : "a version / label selector";
+		const remedy = input.knownPhysicalId === explicit ? `pass the parameter NAME instead: --resource ${input.logicalId}=<parameterName>` : `set Properties.Name to the parameter NAME rather than ${shape}`;
+		const whyNotDerived = isArn ? " cdkd deliberately does NOT derive the name from the ARN: the leading \"/\" is not recoverable (arn:...:parameter/foo is the ARN of BOTH the simple name \"foo\" and the hierarchical name \"/foo\"), and a parameter shared from another account has no name form at all — so a derived name could silently address a DIFFERENT parameter." : "";
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived} Read the name AWS holds with: aws ssm get-parameter --name '${explicit}' --query Parameter.Name --output text`, input.resourceType, input.logicalId);
+	}
+	/**
 	* Adopt an existing SSM parameter into cdkd state.
 	*
 	* SSM physical IDs ARE the parameter names (`/foo/bar`). The CDK template
@@ -20749,19 +20926,25 @@ var SSMParameterProvider = class {
 	* covers most cases.
 	*
 	* Lookup order:
-	*  1. `--resource` override or `Properties.Name` → verify via `GetParameter`.
+	*  1. `--resource` override or `Properties.Name` → refuse it outright when it
+	*     is not a writable NAME (see {@link refuseUnwritableParameterId} — note
+	*     `GetParameter` accepts an ARN and a `name:version` selector while every
+	*     write API rejects both), else verify via `GetParameter`.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
-		if (explicit) try {
-			await this.ssmClient.send(new GetParameterCommand({ Name: explicit }));
-			return {
-				physicalId: explicit,
-				attributes: {}
-			};
-		} catch (err) {
-			if (err instanceof ParameterNotFound) return null;
-			throw err;
+		if (explicit) {
+			this.refuseUnwritableParameterId(input, explicit);
+			try {
+				const arn = (await this.ssmClient.send(new GetParameterCommand({ Name: explicit }))).Parameter?.ARN;
+				return {
+					physicalId: explicit,
+					attributes: { ...arn !== void 0 && { Arn: arn } }
+				};
+			} catch (err) {
+				if (err instanceof ParameterNotFound) return null;
+				throw err;
+			}
 		}
 		return null;
 	}
@@ -33740,16 +33923,20 @@ var RDSProvider = class {
 		});
 		try {
 			const tags = this.buildTags(properties);
-			await this.getClient().send(new CreateDBSubnetGroupCommand({
+			const created = await this.getClient().send(new CreateDBSubnetGroupCommand({
 				DBSubnetGroupName: dbSubnetGroupName,
 				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
 				SubnetIds: properties["SubnetIds"],
 				...tags.length > 0 && { Tags: tags }
 			}));
 			this.logger.debug(`Successfully created DBSubnetGroup ${logicalId}: ${dbSubnetGroupName}`);
+			const dbSubnetGroupArn = created.DBSubnetGroup?.DBSubnetGroupArn;
 			return {
 				physicalId: dbSubnetGroupName,
-				attributes: { DBSubnetGroupName: dbSubnetGroupName }
+				attributes: {
+					DBSubnetGroupName: dbSubnetGroupName,
+					...dbSubnetGroupArn !== void 0 && { DBSubnetGroupArn: dbSubnetGroupArn }
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -33773,7 +33960,10 @@ var RDSProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { DBSubnetGroupName: physicalId }
+				attributes: {
+					DBSubnetGroupName: physicalId,
+					...arn !== void 0 && { DBSubnetGroupArn: arn }
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -34379,10 +34569,10 @@ var RDSProvider = class {
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }));
+			const arn = (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }))).DBSubnetGroups?.[0]?.DBSubnetGroupArn;
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: { ...arn !== void 0 && { DBSubnetGroupArn: arn } }
 			};
 		} catch (err) {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
@@ -68668,12 +68858,21 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 * `--stack-region`, bucket resolution failure) logs at warn and returns
 * `undefined`. Auth failures and other genuine errors propagate.
 *
-* Read-only against state — no lock acquisition or save path here.
+* No lock acquisition and no `state.json` write path here. That is NOT the
+* same as "read-only against the bucket", and the difference was mis-stated
+* until issue #1836: {@link buildCrossStackResolver}'s exports-index lookup
+* goes through {@link ExportIndexStore}, whose `load` REBUILDS the index from
+* the per-stack state files on a miss and PUTs the rebuilt object
+* (`cdkd/_index/{region}/exports.json`). So an `Fn::ImportValue` lookup from a
+* `cdkd local` command can write that one derived key. Keeping the index KEY
+* the same spelling the state records carry is what keeps that write CORRECT
+* rather than an empty index — see the note on `consumerRegion` below.
 */
 async function loadStateForStack(stackName, synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1";
+	const region = canonicalizeRegion(opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68682,7 +68881,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		return;
 	}
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68692,7 +68891,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		await stateBackend.verifyBucketExists();
@@ -68701,15 +68900,58 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			logger.warn(`${prefix}: no cdkd state found for stack '${stackName}' in bucket '${stateBucket}'. Was it deployed via 'cdkd deploy'? Falling back.`);
 			return;
 		}
+		/**
+		* Issue #1836: EXACT match first, case-insensitive second.
+		*
+		* `S3StateBackend.listStacks` dedupes on the EXACT `{stack}\0{region}` pair,
+		* so `cdkd/MyStack/US-EAST-1/state.json` and
+		* `cdkd/MyStack/us-east-1/state.json` are two DISTINCT refs — and
+		* ListObjectsV2 returns them in ASCII order, i.e. the upper-cased one FIRST.
+		* A fold-only `find` therefore hands `--stack-region us-east-1` the OTHER
+		* record, silently reading state the user did not name; the pre-fold `===`
+		* got that case right. So the fold is the RECOVERY for a case mismatch, never
+		* an override of a spelling that exists verbatim.
+		*
+		* `candidate` is therefore the spelling the USER supplied, not the folded
+		* one (round 3 of the #1836 review): the fold at each command's handler
+		* entry and at the `--from-state` factory is what an SDK client needs, but
+		* feeding it to this compare made the exact-match rule unreachable from any
+		* real CLI invocation — every candidate was already canonical, so `exact`
+		* could only ever match an already-canonical record and `--stack-region
+		* US-EAST-1` read the `us-east-1` one while REPORTING it as the exact
+		* spelling. `opts.rawStackRegion` carries the unfolded value here; the
+		* recovery arm folds both sides itself, so nothing upstream has to.
+		*
+		* When more than one ref is canonical-equal the choice is announced, because
+		* either answer reads some record the user did not spell out in full and the
+		* silence is what made the original miss hard to diagnose. The wording
+		* states which of the two rules decided it — and does so from the same
+		* `exact` binding the choice was made from, so it cannot claim an exact
+		* match the compare did not make.
+		*/
+		const findByRegion = (candidate, source) => {
+			const exact = refs.find((r) => r.region === candidate);
+			const folded = refs.filter((r) => canonicalizeRegion(r.region) === canonicalizeRegion(candidate));
+			const chosen = exact ?? folded[0];
+			if (folded.length > 1 && chosen) {
+				const how = exact ? `matches ${source} '${candidate}' exactly` : `no record spells ${source} '${candidate}' exactly, so this is a case-insensitive recovery`;
+				logger.warn(`${prefix}: stack '${stackName}' has state under ${folded.length} case-variant spellings of ${source} '${candidate}' (${folded.map((r) => r.region ?? "(legacy)").join(", ")}). Reading '${chosen.region ?? "(legacy)"}' — ${how}.`);
+			}
+			return chosen;
+		};
+		let synthMatch;
+		if (!opts.stackRegion && synthRegion) synthMatch = findByRegion(synthRegion, "the synth-derived stack region");
 		let targetRegion;
 		if (opts.stackRegion) {
-			if (!refs.find((r) => r.region === opts.stackRegion)) {
+			const requestedRegion = opts.rawStackRegion ?? opts.stackRegion;
+			const found = findByRegion(requestedRegion, "--stack-region");
+			if (!found) {
 				const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${opts.stackRegion}' (available: ${seen}). Falling back.`);
+				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${requestedRegion}' (available: ${seen}). Falling back.`);
 				return;
 			}
-			targetRegion = opts.stackRegion;
-		} else if (synthRegion && refs.some((r) => r.region === synthRegion)) targetRegion = synthRegion;
+			targetRegion = found.region ?? requestedRegion;
+		} else if (synthRegion && synthMatch) targetRegion = synthMatch.region ?? synthRegion;
 		else if (refs.length === 1) targetRegion = refs[0].region ?? synthRegion ?? region;
 		else {
 			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
@@ -68758,7 +69000,8 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 async function loadBootstrapContainerRepo(synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const rawRegion = opts.region ?? opts.rawStackRegion ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68766,8 +69009,9 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68777,16 +69021,25 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		const markerKey = getBootstrapMarkerKey(region);
-		const body = await stateBackend.getRawObject(markerKey);
+		let resolvedKey = markerKey;
+		let body = await stateBackend.getRawObject(markerKey);
+		if (body === null && rawRegion !== region) {
+			const rawKey = getBootstrapMarkerKey(rawRegion);
+			body = await stateBackend.getRawObject(rawKey);
+			if (body !== null) {
+				resolvedKey = rawKey;
+				logger.debug(`${prefix}: bootstrap marker found at the un-folded key '${rawKey}' (no '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+			}
+		}
 		if (body === null) {
-			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}' in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}'${rawRegion !== region ? ` (nor '${getBootstrapMarkerKey(rawRegion)}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
 			return;
 		}
-		const marker = parseBootstrapMarker(body, markerKey);
+		const marker = parseBootstrapMarker(body, resolvedKey);
 		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
 		return marker.containerRepo;
 	} catch (err) {
@@ -68825,13 +69078,14 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 	const prefix = opts.logPrefix ?? "--from-state";
 	let stateBucket;
 	try {
-		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, consumerRegion);
+		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
 	} catch (err) {
 		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	const stateConfig = {
@@ -68839,7 +69093,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		prefix: opts.statePrefix
 	};
 	const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	try {
@@ -68871,9 +69125,10 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 					logger.debug(`${prefix}: failed to list stacks during Fn::ImportValue fallback for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
 					return;
 				}
+				const canonicalConsumerRegion = canonicalizeRegion(consumerRegion);
 				for (const ref of refs) {
 					const region = ref.region ?? consumerRegion;
-					if (region !== consumerRegion) continue;
+					if (canonicalizeRegion(region) !== canonicalConsumerRegion) continue;
 					try {
 						const got = await stateBackend.getState(ref.stackName, region);
 						if (!got || !got.state.outputs) continue;
@@ -68890,14 +69145,31 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 				}
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				try {
-					const got = await stateBackend.getState(producerStack, producerRegion);
+				const readOutput = (got) => {
 					if (!got || !got.state.outputs) return void 0;
 					if (!(outputName in got.state.outputs)) return void 0;
 					const value = got.state.outputs[outputName];
 					if (typeof value === "string") return value;
 					if (typeof value === "number" || typeof value === "boolean") return String(value);
 					return JSON.stringify(value);
+				};
+				try {
+					const got = await stateBackend.getState(producerStack, producerRegion);
+					if (got) return readOutput(got);
+					const canonicalProducerRegion = canonicalizeRegion(producerRegion);
+					const refs = await stateBackend.listStacks();
+					for (const ref of refs) {
+						if (ref.stackName !== producerStack) continue;
+						const region = ref.region ?? producerRegion;
+						if (region === producerRegion) continue;
+						if (canonicalizeRegion(region) !== canonicalProducerRegion) continue;
+						const recovered = readOutput(await stateBackend.getState(producerStack, region));
+						if (recovered !== void 0) {
+							logger.debug(`${prefix}: Fn::GetStackOutput '${producerStack}.${outputName}' resolved from the case-variant state record '${region}' (no record spells '${producerRegion}' exactly).`);
+							return recovered;
+						}
+					}
+					return;
 				} catch (err) {
 					logger.debug(`${prefix}: state read failed for Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}): ${err instanceof Error ? err.message : String(err)}`);
 					return;
@@ -68937,6 +69209,7 @@ var S3LocalStateProvider = class {
 		const loaded = await loadStateForStack(stackName, synthRegion, {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stackRegion !== void 0 && { stackRegion: this.opts.stackRegion },
+			...this.opts.rawStackRegion !== void 0 && { rawStackRegion: this.opts.rawStackRegion },
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
@@ -69003,12 +69276,16 @@ var S3LocalStateProvider = class {
 */
 const fromStateFactory = (options) => {
 	const opts = options;
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
+	const stackRegion = canonicalizeRegion(opts.stackRegion) || void 0;
+	const rawStackRegion = opts.rawStackRegion || opts.stackRegion || void 0;
 	return new S3LocalStateProvider({
 		statePrefix: opts.statePrefix,
 		...opts.stateBucket !== void 0 && { stateBucket: opts.stateBucket },
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile },
-		...opts.stackRegion !== void 0 && { stackRegion: opts.stackRegion }
+		...stackRegion !== void 0 && { stackRegion },
+		...rawStackRegion !== void 0 && { rawStackRegion }
 	});
 };
 /**
@@ -72190,6 +72467,10 @@ async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let apiFilter = target;
 	if (options.api !== void 0) {
 		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
@@ -74532,6 +74813,10 @@ async function localRunTaskCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
@@ -74576,12 +74861,12 @@ async function localRunTaskCommand(target, options) {
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const candidate = pickCandidateStack(parseEcsTarget(target).stackPattern, stacks);
 		stateProvider = createLocalStateProvider$1(options, candidate?.stackName ?? "", candidate?.region);
-		const imageContext = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
+		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
-			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
+			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) await applyCrossStackResolverToTask(task, {
 				resources: imageContext?.stateResources ?? {},
@@ -74691,9 +74976,48 @@ async function assumeTaskRole(roleArn, region) {
 	}
 }
 /**
+* Region the cross-stack resolver is scoped to for `cdkd local run-task`
+* (issue #1836).
+*
+* This value does THREE things (round 3 said TWO and was wrong — corrected in
+* round 4), and the first is why the state record's own spelling outranks the env
+* chain:
+*
+* 1. it becomes the exports-index KEY `cdkd/_index/{region}/exports.json`;
+* 2. it is the same-region filter of the index-miss per-stack scan; and
+* 3. via `SubstitutionContext.consumerRegion`, it is cdk-local's DEFAULT producer
+*    region for an `Fn::GetStackOutput` that carries no explicit `Region` — i.e.
+*    it becomes the `cdkd/{producer}/{region}/state.json` key that intrinsic
+*    reads.
+*
+* All three land in `buildCrossStackResolver` (`local-state-loader.ts`), whose
+* `resolveImport` scan (2) and — since round 4 — `resolveGetStackOutput` (3) fold
+* BOTH sides for the comparison / recovery, while (1) is deliberately raw.
+*
+* `local invoke` / `local invoke-agentcore` both pass `loaded.region` there; this
+* command passed a FOLDED env-chain value instead, so the two commands keyed one
+* index differently — and a key the state records do not spell makes
+* `ExportIndexStore`'s rebuild filter match zero refs and PUT an EMPTY index,
+* permanently degrading every `Fn::ImportValue` to the O(N) scan. Keyed by a
+* record's spelling the filter always matches.
+*
+* The env-chain arm remains for the case where no state record was loaded at all
+* (nothing in the task needed one), and it stays FOLDED for the reason the rest
+* of this file folds: both env-var links escape the handler-entry `--region`
+* fold, and a raw upper-cased spelling reaches an S3 key and an SDK client.
+*
+* @internal exported for unit tests.
+*/
+function resolveEcsConsumerRegion(stateRecordRegion, options, synthRegion) {
+	if (stateRecordRegion) return stateRecordRegion;
+	return canonicalizeRegion((options.region || process.env["AWS_REGION"]) ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+}
+/**
 * Build the substitution context the ECS task resolver consumes (issue
-* #264). Returns `undefined` when no container's `Image` field needs
-* substitution — the resolver behaves as before in that case.
+* #264), plus the region of the state record it loaded (if any — issue #1836;
+* see {@link resolveEcsConsumerRegion} for what reads it). `context` is
+* `undefined` when no container's `Image` field needs substitution — the
+* resolver behaves as before in that case.
 *
 * Tier 1 (pseudo parameters) fires `sts:GetCallerIdentity` once for
 * `${AWS::AccountId}`; region / partition / URL suffix come from the CLI
@@ -74712,10 +75036,11 @@ async function assumeTaskRole(roleArn, region) {
 */
 async function buildEcsImageResolutionContext$1(candidate, stateProvider, options) {
 	const logger = getLogger();
-	if (!candidate) return void 0;
+	if (!candidate) return {};
 	const needs = detectEcsImageResolutionNeeds(candidate);
-	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return;
+	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return {};
 	const ctx = {};
+	let stateRecordRegion;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
 		const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
@@ -74739,13 +75064,17 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const wantsState = needs.needsStateResources || needs.needsEnvOrSecretSubstitution;
 	if (stateProvider && wantsState) {
 		const loaded = await stateProvider.load(candidate.stackName, candidate.region);
-		if (loaded) ctx.stateResources = loaded.resources;
+		if (loaded) {
+			ctx.stateResources = loaded.resources;
+			stateRecordRegion = loaded.region;
+		}
 	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	if (needs.needsAssetRepoMarker && options.fromState) {
 		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
 			statePrefix: options.statePrefix,
 			...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+			...options.rawStackRegion !== void 0 && { rawStackRegion: options.rawStackRegion },
 			...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
 			...options.region !== void 0 && { region: options.region },
 			...options.profile !== void 0 && { profile: options.profile },
@@ -74753,7 +75082,10 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 		});
 		if (containerRepo !== void 0) ctx.cdkAssetContainerRepo = containerRepo;
 	}
-	return ctx;
+	return {
+		context: ctx,
+		...stateRecordRegion !== void 0 && { stateRecordRegion }
+	};
 }
 function pickCandidateStack(stackPattern, stacks) {
 	if (stackPattern === null) {
@@ -75186,6 +75518,10 @@ async function localInvokeAgentCoreCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
@@ -76076,16 +76412,37 @@ function emitA2aResult(result) {
 function platformToArchitecture(platform) {
 	return platform === "linux/amd64" ? "x86_64" : "arm64";
 }
+/**
+* Copy the developer's AWS credentials + region into the container env for the
+* DEFAULT (no `--assume-role`) path.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in; the credentials
+* are copied verbatim (an AKID / session token is case-SENSITIVE, so lower-casing
+* the whole pass-through list would corrupt every one of them). The value lands
+* in the container's own `AWS_REGION`, i.e. in every SDK client the agent builds,
+* and SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition).
+*
+* Folding only inside `applyAgentCoreCredentialEnv`'s assume-role arm — which is
+* where issue #1814 stopped, and what round 3 of the #1836 review found still
+* open here after the same gap was closed in `local-invoke.ts` — made ONE command
+* yield two different container regions for the same shell: `cn-north-1` with
+* `--assume-role`, `CN-NORTH-1` without.
+*/
 function forwardAwsEnv$1(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
@@ -76388,6 +76745,10 @@ async function localInvokeCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let imagePlan;
 	let containerId;
 	let stopLogs;
@@ -76541,29 +76902,12 @@ async function localInvokeCommand(target, options) {
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
 			...envResult.resolved
 		};
-		let assumeSucceeded = false;
-		if (resolvedAssumeRoleArn) {
-			const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-			try {
-				const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion);
-				dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
-				dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
-				dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
-				if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
-				assumeSucceeded = true;
-			} catch (err) {
-				const reason = err instanceof Error ? err.message : String(err);
-				logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
-			}
-		}
-		if (!assumeSucceeded) {
-			forwardAwsEnv(dockerEnv);
-			applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
-			if (profileCredsFile) {
-				dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
-				dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
-			}
-		}
+		await applyLambdaCredentialEnv(dockerEnv, {
+			...resolvedAssumeRoleArn && { assumeRoleArn: resolvedAssumeRoleArn },
+			...options.region !== void 0 && { region: options.region },
+			...profileCredentials && { profileCredentials },
+			...profileCredsFile && { profileCredsFile }
+		});
 		let debugPort;
 		if (options.debugPort) {
 			debugPort = Number(options.debugPort);
@@ -76963,6 +77307,55 @@ async function readStdin() {
 	return Buffer.concat(chunks).toString("utf-8");
 }
 /**
+* Inject AWS credentials into the container env. Precedence:
+*   1. `--assume-role` → STS-issued temp creds for the resolved ARN (on
+*      STS failure, warn + fall through to dev creds). Swapping the
+*      developer's credentials for the function's deployed execution role
+*      degrades rather than hard-errors: this is a developer-loop tool, not
+*      a security boundary, and the most common cause is the role's
+*      `AssumeRolePolicy` not trusting the developer's IAM principal (a
+*      config gap, not a cdkd bug).
+*   2. dev shell creds (`forwardAwsEnv` — which folds the region case for the
+*      same reason arm 1 does) + `--profile` overlay
+*      ({@link applyProfileCredentialsOverlay}) + the bind-mounted
+*      credentials-file env so handler `fromIni({ profile })` resolves.
+*      Applied in that order: the overlay intentionally wins over whatever
+*      `forwardAwsEnv` copied, and the credentials-file env is additive.
+*
+* Extracted from `localInvokeCommand`'s body by issue
+* [#1836](https://github.com/go-to-k/cdkd/issues/1836) and shaped to mirror
+* `applyAgentCoreCredentialEnv` in `local-invoke-agentcore.ts` (the sibling
+* issue [#1814](https://github.com/go-to-k/cdkd/issues/1814) fixed), so a unit
+* test can lock the STS-client region binding with a mocked STS instead of
+* driving the full synth + docker pipeline.
+*/
+async function applyLambdaCredentialEnv(dockerEnv, args) {
+	const logger = getLogger();
+	let assumeSucceeded = false;
+	if (args.assumeRoleArn) {
+		const stsRegion = canonicalizeRegion(args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
+		try {
+			const creds = await assumeLambdaExecutionRole(args.assumeRoleArn, stsRegion);
+			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+			dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+			dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
+			assumeSucceeded = true;
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+		}
+	}
+	if (!assumeSucceeded) {
+		forwardAwsEnv(dockerEnv);
+		applyProfileCredentialsOverlay(dockerEnv, args.profileCredentials, false);
+		if (args.profileCredsFile) {
+			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = args.profileCredsFile.containerPath;
+			dockerEnv["AWS_PROFILE"] = args.profileCredsFile.profileName;
+		}
+	}
+}
+/**
 * Assume the Lambda execution role and return temporary credentials.
 *
 * Closes the "developer has admin creds, the deployed function has narrow
@@ -77002,17 +77395,30 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 *
 * Region is inherited from `AWS_REGION` / `AWS_DEFAULT_REGION` so
 * `aws.config.region` inside the handler works without extra setup.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in, the credentials
+* are copied verbatim. This is the DEFAULT path — no `--assume-role` — and it
+* carries the same exposure the assume-role branch had: the value lands in the
+* container's own `AWS_REGION`, i.e. in every SDK client the handler builds, and
+* SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition). Folding only inside `applyLambdaCredentialEnv`'s
+* assume-role arm made ONE command yield two different container regions for the
+* same shell — `cn-north-1` with `--assume-role`, `CN-NORTH-1` without.
 */
 function forwardAwsEnv(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 /**
@@ -78258,7 +78664,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;