@go-to-k/cdkd 0.283.13 → 0.283.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-BdKa1DA4.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-B8gQpv93.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CrVgG0Pj.js";
+import { t as ASGProvider } from "./asg-provider-CgnPBnOS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -68858,12 +68858,21 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 * `--stack-region`, bucket resolution failure) logs at warn and returns
 * `undefined`. Auth failures and other genuine errors propagate.
 *
-* Read-only against state — no lock acquisition or save path here.
+* No lock acquisition and no `state.json` write path here. That is NOT the
+* same as "read-only against the bucket", and the difference was mis-stated
+* until issue #1836: {@link buildCrossStackResolver}'s exports-index lookup
+* goes through {@link ExportIndexStore}, whose `load` REBUILDS the index from
+* the per-stack state files on a miss and PUTs the rebuilt object
+* (`cdkd/_index/{region}/exports.json`). So an `Fn::ImportValue` lookup from a
+* `cdkd local` command can write that one derived key. Keeping the index KEY
+* the same spelling the state records carry is what keeps that write CORRECT
+* rather than an empty index — see the note on `consumerRegion` below.
 */
 async function loadStateForStack(stackName, synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1";
+	const region = canonicalizeRegion(opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68872,7 +68881,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		return;
 	}
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68882,7 +68891,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		await stateBackend.verifyBucketExists();
@@ -68891,15 +68900,58 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			logger.warn(`${prefix}: no cdkd state found for stack '${stackName}' in bucket '${stateBucket}'. Was it deployed via 'cdkd deploy'? Falling back.`);
 			return;
 		}
+		/**
+		* Issue #1836: EXACT match first, case-insensitive second.
+		*
+		* `S3StateBackend.listStacks` dedupes on the EXACT `{stack}\0{region}` pair,
+		* so `cdkd/MyStack/US-EAST-1/state.json` and
+		* `cdkd/MyStack/us-east-1/state.json` are two DISTINCT refs — and
+		* ListObjectsV2 returns them in ASCII order, i.e. the upper-cased one FIRST.
+		* A fold-only `find` therefore hands `--stack-region us-east-1` the OTHER
+		* record, silently reading state the user did not name; the pre-fold `===`
+		* got that case right. So the fold is the RECOVERY for a case mismatch, never
+		* an override of a spelling that exists verbatim.
+		*
+		* `candidate` is therefore the spelling the USER supplied, not the folded
+		* one (round 3 of the #1836 review): the fold at each command's handler
+		* entry and at the `--from-state` factory is what an SDK client needs, but
+		* feeding it to this compare made the exact-match rule unreachable from any
+		* real CLI invocation — every candidate was already canonical, so `exact`
+		* could only ever match an already-canonical record and `--stack-region
+		* US-EAST-1` read the `us-east-1` one while REPORTING it as the exact
+		* spelling. `opts.rawStackRegion` carries the unfolded value here; the
+		* recovery arm folds both sides itself, so nothing upstream has to.
+		*
+		* When more than one ref is canonical-equal the choice is announced, because
+		* either answer reads some record the user did not spell out in full and the
+		* silence is what made the original miss hard to diagnose. The wording
+		* states which of the two rules decided it — and does so from the same
+		* `exact` binding the choice was made from, so it cannot claim an exact
+		* match the compare did not make.
+		*/
+		const findByRegion = (candidate, source) => {
+			const exact = refs.find((r) => r.region === candidate);
+			const folded = refs.filter((r) => canonicalizeRegion(r.region) === canonicalizeRegion(candidate));
+			const chosen = exact ?? folded[0];
+			if (folded.length > 1 && chosen) {
+				const how = exact ? `matches ${source} '${candidate}' exactly` : `no record spells ${source} '${candidate}' exactly, so this is a case-insensitive recovery`;
+				logger.warn(`${prefix}: stack '${stackName}' has state under ${folded.length} case-variant spellings of ${source} '${candidate}' (${folded.map((r) => r.region ?? "(legacy)").join(", ")}). Reading '${chosen.region ?? "(legacy)"}' — ${how}.`);
+			}
+			return chosen;
+		};
+		let synthMatch;
+		if (!opts.stackRegion && synthRegion) synthMatch = findByRegion(synthRegion, "the synth-derived stack region");
 		let targetRegion;
 		if (opts.stackRegion) {
-			if (!refs.find((r) => r.region === opts.stackRegion)) {
+			const requestedRegion = opts.rawStackRegion ?? opts.stackRegion;
+			const found = findByRegion(requestedRegion, "--stack-region");
+			if (!found) {
 				const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${opts.stackRegion}' (available: ${seen}). Falling back.`);
+				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${requestedRegion}' (available: ${seen}). Falling back.`);
 				return;
 			}
-			targetRegion = opts.stackRegion;
-		} else if (synthRegion && refs.some((r) => r.region === synthRegion)) targetRegion = synthRegion;
+			targetRegion = found.region ?? requestedRegion;
+		} else if (synthRegion && synthMatch) targetRegion = synthMatch.region ?? synthRegion;
 		else if (refs.length === 1) targetRegion = refs[0].region ?? synthRegion ?? region;
 		else {
 			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
@@ -68948,7 +69000,8 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 async function loadBootstrapContainerRepo(synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const rawRegion = opts.region ?? opts.rawStackRegion ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68956,8 +69009,9 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68967,16 +69021,25 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		const markerKey = getBootstrapMarkerKey(region);
-		const body = await stateBackend.getRawObject(markerKey);
+		let resolvedKey = markerKey;
+		let body = await stateBackend.getRawObject(markerKey);
+		if (body === null && rawRegion !== region) {
+			const rawKey = getBootstrapMarkerKey(rawRegion);
+			body = await stateBackend.getRawObject(rawKey);
+			if (body !== null) {
+				resolvedKey = rawKey;
+				logger.debug(`${prefix}: bootstrap marker found at the un-folded key '${rawKey}' (no '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+			}
+		}
 		if (body === null) {
-			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}' in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}'${rawRegion !== region ? ` (nor '${getBootstrapMarkerKey(rawRegion)}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
 			return;
 		}
-		const marker = parseBootstrapMarker(body, markerKey);
+		const marker = parseBootstrapMarker(body, resolvedKey);
 		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
 		return marker.containerRepo;
 	} catch (err) {
@@ -69015,13 +69078,14 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 	const prefix = opts.logPrefix ?? "--from-state";
 	let stateBucket;
 	try {
-		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, consumerRegion);
+		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
 	} catch (err) {
 		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	const stateConfig = {
@@ -69029,7 +69093,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		prefix: opts.statePrefix
 	};
 	const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	try {
@@ -69061,9 +69125,10 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 					logger.debug(`${prefix}: failed to list stacks during Fn::ImportValue fallback for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
 					return;
 				}
+				const canonicalConsumerRegion = canonicalizeRegion(consumerRegion);
 				for (const ref of refs) {
 					const region = ref.region ?? consumerRegion;
-					if (region !== consumerRegion) continue;
+					if (canonicalizeRegion(region) !== canonicalConsumerRegion) continue;
 					try {
 						const got = await stateBackend.getState(ref.stackName, region);
 						if (!got || !got.state.outputs) continue;
@@ -69080,14 +69145,31 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 				}
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				try {
-					const got = await stateBackend.getState(producerStack, producerRegion);
+				const readOutput = (got) => {
 					if (!got || !got.state.outputs) return void 0;
 					if (!(outputName in got.state.outputs)) return void 0;
 					const value = got.state.outputs[outputName];
 					if (typeof value === "string") return value;
 					if (typeof value === "number" || typeof value === "boolean") return String(value);
 					return JSON.stringify(value);
+				};
+				try {
+					const got = await stateBackend.getState(producerStack, producerRegion);
+					if (got) return readOutput(got);
+					const canonicalProducerRegion = canonicalizeRegion(producerRegion);
+					const refs = await stateBackend.listStacks();
+					for (const ref of refs) {
+						if (ref.stackName !== producerStack) continue;
+						const region = ref.region ?? producerRegion;
+						if (region === producerRegion) continue;
+						if (canonicalizeRegion(region) !== canonicalProducerRegion) continue;
+						const recovered = readOutput(await stateBackend.getState(producerStack, region));
+						if (recovered !== void 0) {
+							logger.debug(`${prefix}: Fn::GetStackOutput '${producerStack}.${outputName}' resolved from the case-variant state record '${region}' (no record spells '${producerRegion}' exactly).`);
+							return recovered;
+						}
+					}
+					return;
 				} catch (err) {
 					logger.debug(`${prefix}: state read failed for Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}): ${err instanceof Error ? err.message : String(err)}`);
 					return;
@@ -69127,6 +69209,7 @@ var S3LocalStateProvider = class {
 		const loaded = await loadStateForStack(stackName, synthRegion, {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stackRegion !== void 0 && { stackRegion: this.opts.stackRegion },
+			...this.opts.rawStackRegion !== void 0 && { rawStackRegion: this.opts.rawStackRegion },
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
@@ -69193,12 +69276,16 @@ var S3LocalStateProvider = class {
 */
 const fromStateFactory = (options) => {
 	const opts = options;
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
+	const stackRegion = canonicalizeRegion(opts.stackRegion) || void 0;
+	const rawStackRegion = opts.rawStackRegion || opts.stackRegion || void 0;
 	return new S3LocalStateProvider({
 		statePrefix: opts.statePrefix,
 		...opts.stateBucket !== void 0 && { stateBucket: opts.stateBucket },
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile },
-		...opts.stackRegion !== void 0 && { stackRegion: opts.stackRegion }
+		...stackRegion !== void 0 && { stackRegion },
+		...rawStackRegion !== void 0 && { rawStackRegion }
 	});
 };
 /**
@@ -72380,6 +72467,10 @@ async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let apiFilter = target;
 	if (options.api !== void 0) {
 		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
@@ -74722,6 +74813,10 @@ async function localRunTaskCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
@@ -74766,12 +74861,12 @@ async function localRunTaskCommand(target, options) {
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const candidate = pickCandidateStack(parseEcsTarget(target).stackPattern, stacks);
 		stateProvider = createLocalStateProvider$1(options, candidate?.stackName ?? "", candidate?.region);
-		const imageContext = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
+		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
-			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
+			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) await applyCrossStackResolverToTask(task, {
 				resources: imageContext?.stateResources ?? {},
@@ -74881,9 +74976,48 @@ async function assumeTaskRole(roleArn, region) {
 	}
 }
 /**
+* Region the cross-stack resolver is scoped to for `cdkd local run-task`
+* (issue #1836).
+*
+* This value does THREE things (round 3 said TWO and was wrong — corrected in
+* round 4), and the first is why the state record's own spelling outranks the env
+* chain:
+*
+* 1. it becomes the exports-index KEY `cdkd/_index/{region}/exports.json`;
+* 2. it is the same-region filter of the index-miss per-stack scan; and
+* 3. via `SubstitutionContext.consumerRegion`, it is cdk-local's DEFAULT producer
+*    region for an `Fn::GetStackOutput` that carries no explicit `Region` — i.e.
+*    it becomes the `cdkd/{producer}/{region}/state.json` key that intrinsic
+*    reads.
+*
+* All three land in `buildCrossStackResolver` (`local-state-loader.ts`), whose
+* `resolveImport` scan (2) and — since round 4 — `resolveGetStackOutput` (3) fold
+* BOTH sides for the comparison / recovery, while (1) is deliberately raw.
+*
+* `local invoke` / `local invoke-agentcore` both pass `loaded.region` there; this
+* command passed a FOLDED env-chain value instead, so the two commands keyed one
+* index differently — and a key the state records do not spell makes
+* `ExportIndexStore`'s rebuild filter match zero refs and PUT an EMPTY index,
+* permanently degrading every `Fn::ImportValue` to the O(N) scan. Keyed by a
+* record's spelling the filter always matches.
+*
+* The env-chain arm remains for the case where no state record was loaded at all
+* (nothing in the task needed one), and it stays FOLDED for the reason the rest
+* of this file folds: both env-var links escape the handler-entry `--region`
+* fold, and a raw upper-cased spelling reaches an S3 key and an SDK client.
+*
+* @internal exported for unit tests.
+*/
+function resolveEcsConsumerRegion(stateRecordRegion, options, synthRegion) {
+	if (stateRecordRegion) return stateRecordRegion;
+	return canonicalizeRegion((options.region || process.env["AWS_REGION"]) ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+}
+/**
 * Build the substitution context the ECS task resolver consumes (issue
-* #264). Returns `undefined` when no container's `Image` field needs
-* substitution — the resolver behaves as before in that case.
+* #264), plus the region of the state record it loaded (if any — issue #1836;
+* see {@link resolveEcsConsumerRegion} for what reads it). `context` is
+* `undefined` when no container's `Image` field needs substitution — the
+* resolver behaves as before in that case.
 *
 * Tier 1 (pseudo parameters) fires `sts:GetCallerIdentity` once for
 * `${AWS::AccountId}`; region / partition / URL suffix come from the CLI
@@ -74902,10 +75036,11 @@ async function assumeTaskRole(roleArn, region) {
 */
 async function buildEcsImageResolutionContext$1(candidate, stateProvider, options) {
 	const logger = getLogger();
-	if (!candidate) return void 0;
+	if (!candidate) return {};
 	const needs = detectEcsImageResolutionNeeds(candidate);
-	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return;
+	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return {};
 	const ctx = {};
+	let stateRecordRegion;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
 		const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
@@ -74929,13 +75064,17 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const wantsState = needs.needsStateResources || needs.needsEnvOrSecretSubstitution;
 	if (stateProvider && wantsState) {
 		const loaded = await stateProvider.load(candidate.stackName, candidate.region);
-		if (loaded) ctx.stateResources = loaded.resources;
+		if (loaded) {
+			ctx.stateResources = loaded.resources;
+			stateRecordRegion = loaded.region;
+		}
 	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	if (needs.needsAssetRepoMarker && options.fromState) {
 		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
 			statePrefix: options.statePrefix,
 			...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+			...options.rawStackRegion !== void 0 && { rawStackRegion: options.rawStackRegion },
 			...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
 			...options.region !== void 0 && { region: options.region },
 			...options.profile !== void 0 && { profile: options.profile },
@@ -74943,7 +75082,10 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 		});
 		if (containerRepo !== void 0) ctx.cdkAssetContainerRepo = containerRepo;
 	}
-	return ctx;
+	return {
+		context: ctx,
+		...stateRecordRegion !== void 0 && { stateRecordRegion }
+	};
 }
 function pickCandidateStack(stackPattern, stacks) {
 	if (stackPattern === null) {
@@ -75376,6 +75518,10 @@ async function localInvokeAgentCoreCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
@@ -76266,16 +76412,37 @@ function emitA2aResult(result) {
 function platformToArchitecture(platform) {
 	return platform === "linux/amd64" ? "x86_64" : "arm64";
 }
+/**
+* Copy the developer's AWS credentials + region into the container env for the
+* DEFAULT (no `--assume-role`) path.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in; the credentials
+* are copied verbatim (an AKID / session token is case-SENSITIVE, so lower-casing
+* the whole pass-through list would corrupt every one of them). The value lands
+* in the container's own `AWS_REGION`, i.e. in every SDK client the agent builds,
+* and SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition).
+*
+* Folding only inside `applyAgentCoreCredentialEnv`'s assume-role arm — which is
+* where issue #1814 stopped, and what round 3 of the #1836 review found still
+* open here after the same gap was closed in `local-invoke.ts` — made ONE command
+* yield two different container regions for the same shell: `cn-north-1` with
+* `--assume-role`, `CN-NORTH-1` without.
+*/
 function forwardAwsEnv$1(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
@@ -76578,6 +76745,10 @@ async function localInvokeCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let imagePlan;
 	let containerId;
 	let stopLogs;
@@ -76731,29 +76902,12 @@ async function localInvokeCommand(target, options) {
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
 			...envResult.resolved
 		};
-		let assumeSucceeded = false;
-		if (resolvedAssumeRoleArn) {
-			const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-			try {
-				const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion);
-				dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
-				dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
-				dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
-				if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
-				assumeSucceeded = true;
-			} catch (err) {
-				const reason = err instanceof Error ? err.message : String(err);
-				logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
-			}
-		}
-		if (!assumeSucceeded) {
-			forwardAwsEnv(dockerEnv);
-			applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
-			if (profileCredsFile) {
-				dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
-				dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
-			}
-		}
+		await applyLambdaCredentialEnv(dockerEnv, {
+			...resolvedAssumeRoleArn && { assumeRoleArn: resolvedAssumeRoleArn },
+			...options.region !== void 0 && { region: options.region },
+			...profileCredentials && { profileCredentials },
+			...profileCredsFile && { profileCredsFile }
+		});
 		let debugPort;
 		if (options.debugPort) {
 			debugPort = Number(options.debugPort);
@@ -77153,6 +77307,55 @@ async function readStdin() {
 	return Buffer.concat(chunks).toString("utf-8");
 }
 /**
+* Inject AWS credentials into the container env. Precedence:
+*   1. `--assume-role` → STS-issued temp creds for the resolved ARN (on
+*      STS failure, warn + fall through to dev creds). Swapping the
+*      developer's credentials for the function's deployed execution role
+*      degrades rather than hard-errors: this is a developer-loop tool, not
+*      a security boundary, and the most common cause is the role's
+*      `AssumeRolePolicy` not trusting the developer's IAM principal (a
+*      config gap, not a cdkd bug).
+*   2. dev shell creds (`forwardAwsEnv` — which folds the region case for the
+*      same reason arm 1 does) + `--profile` overlay
+*      ({@link applyProfileCredentialsOverlay}) + the bind-mounted
+*      credentials-file env so handler `fromIni({ profile })` resolves.
+*      Applied in that order: the overlay intentionally wins over whatever
+*      `forwardAwsEnv` copied, and the credentials-file env is additive.
+*
+* Extracted from `localInvokeCommand`'s body by issue
+* [#1836](https://github.com/go-to-k/cdkd/issues/1836) and shaped to mirror
+* `applyAgentCoreCredentialEnv` in `local-invoke-agentcore.ts` (the sibling
+* issue [#1814](https://github.com/go-to-k/cdkd/issues/1814) fixed), so a unit
+* test can lock the STS-client region binding with a mocked STS instead of
+* driving the full synth + docker pipeline.
+*/
+async function applyLambdaCredentialEnv(dockerEnv, args) {
+	const logger = getLogger();
+	let assumeSucceeded = false;
+	if (args.assumeRoleArn) {
+		const stsRegion = canonicalizeRegion(args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
+		try {
+			const creds = await assumeLambdaExecutionRole(args.assumeRoleArn, stsRegion);
+			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+			dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+			dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
+			assumeSucceeded = true;
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+		}
+	}
+	if (!assumeSucceeded) {
+		forwardAwsEnv(dockerEnv);
+		applyProfileCredentialsOverlay(dockerEnv, args.profileCredentials, false);
+		if (args.profileCredsFile) {
+			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = args.profileCredsFile.containerPath;
+			dockerEnv["AWS_PROFILE"] = args.profileCredsFile.profileName;
+		}
+	}
+}
+/**
 * Assume the Lambda execution role and return temporary credentials.
 *
 * Closes the "developer has admin creds, the deployed function has narrow
@@ -77192,17 +77395,30 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 *
 * Region is inherited from `AWS_REGION` / `AWS_DEFAULT_REGION` so
 * `aws.config.region` inside the handler works without extra setup.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in, the credentials
+* are copied verbatim. This is the DEFAULT path — no `--assume-role` — and it
+* carries the same exposure the assume-role branch had: the value lands in the
+* container's own `AWS_REGION`, i.e. in every SDK client the handler builds, and
+* SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition). Folding only inside `applyLambdaCredentialEnv`'s
+* assume-role arm made ONE command yield two different container regions for the
+* same shell — `cn-north-1` with `--assume-role`, `CN-NORTH-1` without.
 */
 function forwardAwsEnv(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 /**
@@ -78448,7 +78664,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.13");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;