@go-to-k/cdkd 0.283.13 → 0.283.15

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-BdKa1DA4.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-D-4ZvtGc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CrVgG0Pj.js";
+import { t as ASGProvider } from "./asg-provider-Dl2MK3if.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2991,6 +2991,28 @@ var IAMPolicyProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-managed-policy-provider.ts
 /**
+* Matches an AWS-managed IAM policy ARN in ANY AWS partition (issue #1815).
+*
+* AWS-managed policies are the ones whose ACCOUNT segment is the literal
+* `aws` — `arn:<partition>:iam::aws:policy/<path><name>` — as opposed to a
+* customer-managed policy, which carries a 12-digit account id. They exist
+* under every partition (`arn:aws-us-gov:iam::aws:policy/AdministratorAccess`
+* is a real, attachable ARN in GovCloud), so pinning the PARTITION segment to
+* the commercial `aws` recognised only a third of them.
+*
+* The partition is read OFF THE ARN rather than derived from a region through
+* `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`): that helper
+* answers "given a region, which partition am I in", which is the right
+* question when BUILDING an ARN (the seven sites PR #1834 fixed) and the wrong
+* one when CLASSIFYING an ARN the caller already holds. The loose
+* `aws[a-z0-9-]*` partition segment matches `IAM_ROLE_ARN_RE` in
+* `src/utils/role-arn.ts`; a closed partition list is precisely what goes
+* stale when AWS adds a partition, and here staleness fails DANGEROUS (see the
+* refusal's own comment — an unrecognised AWS-managed policy gets adopted, and
+* destroy then detaches it from every principal in the account).
+*/
+const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
+/**
 * AWS IAM Managed Policy Provider
 *
 * Implements resource provisioning for AWS::IAM::ManagedPolicy using the IAM SDK.
@@ -3002,7 +3024,7 @@ var IAMPolicyProvider = class {
 *   - Detach-before-delete cleanup (a ManagedPolicy with attached principals
 *     or with non-default versions cannot be deleted directly)
 *
-* Physical id is the policy ARN (`arn:aws:iam::<account>:policy/<path><name>`)
+* Physical id is the policy ARN (`arn:<partition>:iam::<account>:policy/<path><name>`)
 * since path is part of the identity — two policies with the same name in
 * different paths are distinct.
 */
@@ -3239,7 +3261,7 @@ var IAMManagedPolicyProvider = class {
 		const explicit = resolveExplicitPhysicalId(input, "ManagedPolicyName");
 		if (explicit) {
 			if (explicit.startsWith("arn:")) {
-				if (explicit.startsWith("arn:aws:iam::aws:")) throw new Error(`Refusing to import AWS-managed policy ${explicit}: cdkd only adopts customer-managed policies. If you need to attach an AWS-managed policy to a role / user / group, reference it via ManagedPolicyArns on the principal instead.`);
+				if (AWS_MANAGED_POLICY_ARN_RE.test(explicit)) throw new Error(`Refusing to import AWS-managed policy ${explicit}: cdkd only adopts customer-managed policies. If you need to attach an AWS-managed policy to a role / user / group, reference it via ManagedPolicyArns on the principal instead.`);
 				try {
 					await this.iamClient.send(new GetPolicyCommand({ PolicyArn: explicit }));
 					return {
@@ -3468,7 +3490,7 @@ var IAMManagedPolicyProvider = class {
 	}
 };
 /**
-* Recover the policy name from `arn:aws:iam::<account>:policy/<path><name>`.
+* Recover the policy name from `arn:<partition>:iam::<account>:policy/<path><name>`.
 * Used to decide whether `ManagedPolicyName` was mutated relative to the
 * physical id we recorded — name + path are immutable on AWS, so any
 * difference is a replacement signal.
@@ -12354,6 +12376,47 @@ var LambdaUrlProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/lambda-eventsource-provider.ts
+/**
+* Captures the SERVICE segment of an ARN in ANY AWS partition (issue #1815).
+*
+* `arn:<partition>:<service>:<region>:<account>:<rest>` — group 1 is the
+* service. The partition segment is matched loosely as `aws[a-z0-9-]*`, the
+* same shape `IAM_ROLE_ARN_RE` (`src/utils/role-arn.ts`) uses, rather than
+* enumerated: this classifier previously hand-listed `aws` and `aws-cn` per
+* service and so returned `'unknown'` for every OTHER partition — GovCloud,
+* all four iso partitions and `aws-eusc` — which silently disabled the
+* type-discriminator gating below (see the `KINDS_WITH_*` sets) and let
+* `cdkd drift --revert` push `FunctionResponseTypes` / `SourceAccessConfigurations`
+* placeholders AWS rejects. A closed partition list is exactly what goes stale
+* when AWS adds a partition; reading the partition off the ARN cannot.
+*
+* Note the partition is not derived from a region via
+* `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`) because this
+* CLASSIFIES an ARN already in hand — the partition is in the input, and no
+* region reaches this function.
+*/
+const ARN_SERVICE_RE = /^arn:aws[a-z0-9-]*:([^:]+):/;
+/**
+* ARN service segment -> {@link EventSourceKind}. Replaces the per-partition
+* `startsWith` chain; every entry is partition-independent by construction.
+*/
+const ARN_SERVICE_TO_EVENT_SOURCE_KIND = {
+	sqs: "sqs",
+	kinesis: "kinesis",
+	dynamodb: "dynamodb",
+	kafka: "kafka",
+	mq: "mq",
+	rds: "documentdb"
+};
+/**
+* @internal EXPORTED for tests only (issue #1815). Every production consumer is a
+* `Set.has(kind)`, so the `Object.hasOwn` guard below is UNOBSERVABLE through
+* behavior — a prototype member and `'unknown'` both miss every set. That was
+* measured, not assumed: a behavior-level test for it passed with the guard
+* reverted. Rather than ship an unverifiable guard or a test that only looks
+* like one, the classifier's RETURN VALUE is asserted directly. Do not read the
+* export as an invitation to call this from outside the provider.
+*/
 function classifyEventSource(resp) {
 	if (resp.SelfManagedEventSource !== void 0) return "kafka";
 	if (resp.SelfManagedKafkaEventSourceConfig !== void 0) return "kafka";
@@ -12361,13 +12424,9 @@ function classifyEventSource(resp) {
 	if (resp.DocumentDBEventSourceConfig !== void 0) return "documentdb";
 	const arn = resp.EventSourceArn;
 	if (!arn) return "unknown";
-	if (arn.startsWith("arn:aws:sqs:") || arn.startsWith("arn:aws-cn:sqs:")) return "sqs";
-	if (arn.startsWith("arn:aws:kinesis:") || arn.startsWith("arn:aws-cn:kinesis:")) return "kinesis";
-	if (arn.startsWith("arn:aws:dynamodb:") || arn.startsWith("arn:aws-cn:dynamodb:")) return "dynamodb";
-	if (arn.startsWith("arn:aws:kafka:") || arn.startsWith("arn:aws-cn:kafka:")) return "kafka";
-	if (arn.startsWith("arn:aws:mq:") || arn.startsWith("arn:aws-cn:mq:")) return "mq";
-	if (arn.startsWith("arn:aws:rds:") || arn.startsWith("arn:aws-cn:rds:")) return "documentdb";
-	return "unknown";
+	const service = ARN_SERVICE_RE.exec(arn)?.[1];
+	if (!service) return "unknown";
+	return Object.hasOwn(ARN_SERVICE_TO_EVENT_SOURCE_KIND, service) ? ARN_SERVICE_TO_EVENT_SOURCE_KIND[service] : "unknown";
 }
 /**
 * Classify an event source mapping from its CFn property bag (as opposed to
@@ -55372,7 +55431,10 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
-		if (childResult.errorCount > 0) throw new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+		if (childResult.errorCount > 0) {
+			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+			throw childResult.interrupted ? markNonRetryable(failure) : failure;
+		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
 			const causes = [];
 			if (childResult.skippedCount > 0) causes.push(`skipped ${childResult.skippedCount} resource(s)`);
@@ -55410,7 +55472,7 @@ var NestedStackProvider = class {
 	}
 	requireContext() {
 		const ctx = getCurrentNestedStackContext();
-		if (!ctx) throw new Error("NestedStackProvider invoked outside withNestedStackContext() scope. The deploy / destroy CLI entry point must wrap its DeployEngine.deploy / runDestroyForStack call in withNestedStackContext(ctx, () => ...).");
+		if (!ctx) throw markNonRetryable(/* @__PURE__ */ new Error("NestedStackProvider invoked outside withNestedStackContext() scope. The deploy / destroy CLI entry point must wrap its DeployEngine.deploy / runDestroyForStack call in withNestedStackContext(ctx, () => ...)."));
 		return ctx;
 	}
 	requireDeployContext(ctx, op) {
@@ -68858,12 +68920,21 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 * `--stack-region`, bucket resolution failure) logs at warn and returns
 * `undefined`. Auth failures and other genuine errors propagate.
 *
-* Read-only against state — no lock acquisition or save path here.
+* No lock acquisition and no `state.json` write path here. That is NOT the
+* same as "read-only against the bucket", and the difference was mis-stated
+* until issue #1836: {@link buildCrossStackResolver}'s exports-index lookup
+* goes through {@link ExportIndexStore}, whose `load` REBUILDS the index from
+* the per-stack state files on a miss and PUTs the rebuilt object
+* (`cdkd/_index/{region}/exports.json`). So an `Fn::ImportValue` lookup from a
+* `cdkd local` command can write that one derived key. Keeping the index KEY
+* the same spelling the state records carry is what keeps that write CORRECT
+* rather than an empty index — see the note on `consumerRegion` below.
 */
 async function loadStateForStack(stackName, synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1";
+	const region = canonicalizeRegion(opts.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68872,7 +68943,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		return;
 	}
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68882,7 +68953,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		await stateBackend.verifyBucketExists();
@@ -68891,15 +68962,58 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			logger.warn(`${prefix}: no cdkd state found for stack '${stackName}' in bucket '${stateBucket}'. Was it deployed via 'cdkd deploy'? Falling back.`);
 			return;
 		}
+		/**
+		* Issue #1836: EXACT match first, case-insensitive second.
+		*
+		* `S3StateBackend.listStacks` dedupes on the EXACT `{stack}\0{region}` pair,
+		* so `cdkd/MyStack/US-EAST-1/state.json` and
+		* `cdkd/MyStack/us-east-1/state.json` are two DISTINCT refs — and
+		* ListObjectsV2 returns them in ASCII order, i.e. the upper-cased one FIRST.
+		* A fold-only `find` therefore hands `--stack-region us-east-1` the OTHER
+		* record, silently reading state the user did not name; the pre-fold `===`
+		* got that case right. So the fold is the RECOVERY for a case mismatch, never
+		* an override of a spelling that exists verbatim.
+		*
+		* `candidate` is therefore the spelling the USER supplied, not the folded
+		* one (round 3 of the #1836 review): the fold at each command's handler
+		* entry and at the `--from-state` factory is what an SDK client needs, but
+		* feeding it to this compare made the exact-match rule unreachable from any
+		* real CLI invocation — every candidate was already canonical, so `exact`
+		* could only ever match an already-canonical record and `--stack-region
+		* US-EAST-1` read the `us-east-1` one while REPORTING it as the exact
+		* spelling. `opts.rawStackRegion` carries the unfolded value here; the
+		* recovery arm folds both sides itself, so nothing upstream has to.
+		*
+		* When more than one ref is canonical-equal the choice is announced, because
+		* either answer reads some record the user did not spell out in full and the
+		* silence is what made the original miss hard to diagnose. The wording
+		* states which of the two rules decided it — and does so from the same
+		* `exact` binding the choice was made from, so it cannot claim an exact
+		* match the compare did not make.
+		*/
+		const findByRegion = (candidate, source) => {
+			const exact = refs.find((r) => r.region === candidate);
+			const folded = refs.filter((r) => canonicalizeRegion(r.region) === canonicalizeRegion(candidate));
+			const chosen = exact ?? folded[0];
+			if (folded.length > 1 && chosen) {
+				const how = exact ? `matches ${source} '${candidate}' exactly` : `no record spells ${source} '${candidate}' exactly, so this is a case-insensitive recovery`;
+				logger.warn(`${prefix}: stack '${stackName}' has state under ${folded.length} case-variant spellings of ${source} '${candidate}' (${folded.map((r) => r.region ?? "(legacy)").join(", ")}). Reading '${chosen.region ?? "(legacy)"}' — ${how}.`);
+			}
+			return chosen;
+		};
+		let synthMatch;
+		if (!opts.stackRegion && synthRegion) synthMatch = findByRegion(synthRegion, "the synth-derived stack region");
 		let targetRegion;
 		if (opts.stackRegion) {
-			if (!refs.find((r) => r.region === opts.stackRegion)) {
+			const requestedRegion = opts.rawStackRegion ?? opts.stackRegion;
+			const found = findByRegion(requestedRegion, "--stack-region");
+			if (!found) {
 				const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${opts.stackRegion}' (available: ${seen}). Falling back.`);
+				logger.warn(`${prefix}: stack '${stackName}' has no state in region '${requestedRegion}' (available: ${seen}). Falling back.`);
 				return;
 			}
-			targetRegion = opts.stackRegion;
-		} else if (synthRegion && refs.some((r) => r.region === synthRegion)) targetRegion = synthRegion;
+			targetRegion = found.region ?? requestedRegion;
+		} else if (synthRegion && synthMatch) targetRegion = synthMatch.region ?? synthRegion;
 		else if (refs.length === 1) targetRegion = refs[0].region ?? synthRegion ?? region;
 		else {
 			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
@@ -68948,7 +69062,8 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 async function loadBootstrapContainerRepo(synthRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
-	const region = opts.region ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const rawRegion = opts.region ?? opts.rawStackRegion ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	const region = canonicalizeRegion(rawRegion);
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
@@ -68956,8 +69071,9 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	setAwsClients(awsClients);
@@ -68967,16 +69083,25 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			prefix: opts.statePrefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-			...opts.region !== void 0 && { region: opts.region },
+			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
 		const markerKey = getBootstrapMarkerKey(region);
-		const body = await stateBackend.getRawObject(markerKey);
+		let resolvedKey = markerKey;
+		let body = await stateBackend.getRawObject(markerKey);
+		if (body === null && rawRegion !== region) {
+			const rawKey = getBootstrapMarkerKey(rawRegion);
+			body = await stateBackend.getRawObject(rawKey);
+			if (body !== null) {
+				resolvedKey = rawKey;
+				logger.debug(`${prefix}: bootstrap marker found at the un-folded key '${rawKey}' (no '${markerKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+			}
+		}
 		if (body === null) {
-			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}' in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}'${rawRegion !== region ? ` (nor '${getBootstrapMarkerKey(rawRegion)}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
 			return;
 		}
-		const marker = parseBootstrapMarker(body, markerKey);
+		const marker = parseBootstrapMarker(body, resolvedKey);
 		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
 		return marker.containerRepo;
 	} catch (err) {
@@ -69015,13 +69140,14 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 	const prefix = opts.logPrefix ?? "--from-state";
 	let stateBucket;
 	try {
-		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, consumerRegion);
+		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
 	} catch (err) {
 		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
 	const awsClients = new AwsClients({
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	const stateConfig = {
@@ -69029,7 +69155,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		prefix: opts.statePrefix
 	};
 	const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile }
 	});
 	try {
@@ -69061,9 +69187,10 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 					logger.debug(`${prefix}: failed to list stacks during Fn::ImportValue fallback for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
 					return;
 				}
+				const canonicalConsumerRegion = canonicalizeRegion(consumerRegion);
 				for (const ref of refs) {
 					const region = ref.region ?? consumerRegion;
-					if (region !== consumerRegion) continue;
+					if (canonicalizeRegion(region) !== canonicalConsumerRegion) continue;
 					try {
 						const got = await stateBackend.getState(ref.stackName, region);
 						if (!got || !got.state.outputs) continue;
@@ -69080,14 +69207,31 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 				}
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				try {
-					const got = await stateBackend.getState(producerStack, producerRegion);
+				const readOutput = (got) => {
 					if (!got || !got.state.outputs) return void 0;
 					if (!(outputName in got.state.outputs)) return void 0;
 					const value = got.state.outputs[outputName];
 					if (typeof value === "string") return value;
 					if (typeof value === "number" || typeof value === "boolean") return String(value);
 					return JSON.stringify(value);
+				};
+				try {
+					const got = await stateBackend.getState(producerStack, producerRegion);
+					if (got) return readOutput(got);
+					const canonicalProducerRegion = canonicalizeRegion(producerRegion);
+					const refs = await stateBackend.listStacks();
+					for (const ref of refs) {
+						if (ref.stackName !== producerStack) continue;
+						const region = ref.region ?? producerRegion;
+						if (region === producerRegion) continue;
+						if (canonicalizeRegion(region) !== canonicalProducerRegion) continue;
+						const recovered = readOutput(await stateBackend.getState(producerStack, region));
+						if (recovered !== void 0) {
+							logger.debug(`${prefix}: Fn::GetStackOutput '${producerStack}.${outputName}' resolved from the case-variant state record '${region}' (no record spells '${producerRegion}' exactly).`);
+							return recovered;
+						}
+					}
+					return;
 				} catch (err) {
 					logger.debug(`${prefix}: state read failed for Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}): ${err instanceof Error ? err.message : String(err)}`);
 					return;
@@ -69127,6 +69271,7 @@ var S3LocalStateProvider = class {
 		const loaded = await loadStateForStack(stackName, synthRegion, {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stackRegion !== void 0 && { stackRegion: this.opts.stackRegion },
+			...this.opts.rawStackRegion !== void 0 && { rawStackRegion: this.opts.rawStackRegion },
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
@@ -69193,12 +69338,16 @@ var S3LocalStateProvider = class {
 */
 const fromStateFactory = (options) => {
 	const opts = options;
+	const clientRegion = canonicalizeRegion(opts.region) || void 0;
+	const stackRegion = canonicalizeRegion(opts.stackRegion) || void 0;
+	const rawStackRegion = opts.rawStackRegion || opts.stackRegion || void 0;
 	return new S3LocalStateProvider({
 		statePrefix: opts.statePrefix,
 		...opts.stateBucket !== void 0 && { stateBucket: opts.stateBucket },
-		...opts.region !== void 0 && { region: opts.region },
+		...clientRegion !== void 0 && { region: clientRegion },
 		...opts.profile !== void 0 && { profile: opts.profile },
-		...opts.stackRegion !== void 0 && { stackRegion: opts.stackRegion }
+		...stackRegion !== void 0 && { stackRegion },
+		...rawStackRegion !== void 0 && { rawStackRegion }
 	});
 };
 /**
@@ -72380,6 +72529,10 @@ async function localStartApiCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let apiFilter = target;
 	if (options.api !== void 0) {
 		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
@@ -74722,6 +74875,10 @@ async function localRunTaskCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
@@ -74766,12 +74923,12 @@ async function localRunTaskCommand(target, options) {
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const candidate = pickCandidateStack(parseEcsTarget(target).stackPattern, stacks);
 		stateProvider = createLocalStateProvider$1(options, candidate?.stackName ?? "", candidate?.region);
-		const imageContext = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
+		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
-			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
+			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) await applyCrossStackResolverToTask(task, {
 				resources: imageContext?.stateResources ?? {},
@@ -74881,9 +75038,48 @@ async function assumeTaskRole(roleArn, region) {
 	}
 }
 /**
+* Region the cross-stack resolver is scoped to for `cdkd local run-task`
+* (issue #1836).
+*
+* This value does THREE things (round 3 said TWO and was wrong — corrected in
+* round 4), and the first is why the state record's own spelling outranks the env
+* chain:
+*
+* 1. it becomes the exports-index KEY `cdkd/_index/{region}/exports.json`;
+* 2. it is the same-region filter of the index-miss per-stack scan; and
+* 3. via `SubstitutionContext.consumerRegion`, it is cdk-local's DEFAULT producer
+*    region for an `Fn::GetStackOutput` that carries no explicit `Region` — i.e.
+*    it becomes the `cdkd/{producer}/{region}/state.json` key that intrinsic
+*    reads.
+*
+* All three land in `buildCrossStackResolver` (`local-state-loader.ts`), whose
+* `resolveImport` scan (2) and — since round 4 — `resolveGetStackOutput` (3) fold
+* BOTH sides for the comparison / recovery, while (1) is deliberately raw.
+*
+* `local invoke` / `local invoke-agentcore` both pass `loaded.region` there; this
+* command passed a FOLDED env-chain value instead, so the two commands keyed one
+* index differently — and a key the state records do not spell makes
+* `ExportIndexStore`'s rebuild filter match zero refs and PUT an EMPTY index,
+* permanently degrading every `Fn::ImportValue` to the O(N) scan. Keyed by a
+* record's spelling the filter always matches.
+*
+* The env-chain arm remains for the case where no state record was loaded at all
+* (nothing in the task needed one), and it stays FOLDED for the reason the rest
+* of this file folds: both env-var links escape the handler-entry `--region`
+* fold, and a raw upper-cased spelling reaches an S3 key and an SDK client.
+*
+* @internal exported for unit tests.
+*/
+function resolveEcsConsumerRegion(stateRecordRegion, options, synthRegion) {
+	if (stateRecordRegion) return stateRecordRegion;
+	return canonicalizeRegion((options.region || process.env["AWS_REGION"]) ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion ?? "us-east-1");
+}
+/**
 * Build the substitution context the ECS task resolver consumes (issue
-* #264). Returns `undefined` when no container's `Image` field needs
-* substitution — the resolver behaves as before in that case.
+* #264), plus the region of the state record it loaded (if any — issue #1836;
+* see {@link resolveEcsConsumerRegion} for what reads it). `context` is
+* `undefined` when no container's `Image` field needs substitution — the
+* resolver behaves as before in that case.
 *
 * Tier 1 (pseudo parameters) fires `sts:GetCallerIdentity` once for
 * `${AWS::AccountId}`; region / partition / URL suffix come from the CLI
@@ -74902,10 +75098,11 @@ async function assumeTaskRole(roleArn, region) {
 */
 async function buildEcsImageResolutionContext$1(candidate, stateProvider, options) {
 	const logger = getLogger();
-	if (!candidate) return void 0;
+	if (!candidate) return {};
 	const needs = detectEcsImageResolutionNeeds(candidate);
-	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return;
+	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return {};
 	const ctx = {};
+	let stateRecordRegion;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
 		const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
@@ -74929,13 +75126,17 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const wantsState = needs.needsStateResources || needs.needsEnvOrSecretSubstitution;
 	if (stateProvider && wantsState) {
 		const loaded = await stateProvider.load(candidate.stackName, candidate.region);
-		if (loaded) ctx.stateResources = loaded.resources;
+		if (loaded) {
+			ctx.stateResources = loaded.resources;
+			stateRecordRegion = loaded.region;
+		}
 	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	if (needs.needsAssetRepoMarker && options.fromState) {
 		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
 			statePrefix: options.statePrefix,
 			...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+			...options.rawStackRegion !== void 0 && { rawStackRegion: options.rawStackRegion },
 			...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
 			...options.region !== void 0 && { region: options.region },
 			...options.profile !== void 0 && { profile: options.profile },
@@ -74943,7 +75144,10 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 		});
 		if (containerRepo !== void 0) ctx.cdkAssetContainerRepo = containerRepo;
 	}
-	return ctx;
+	return {
+		context: ctx,
+		...stateRecordRegion !== void 0 && { stateRecordRegion }
+	};
 }
 function pickCandidateStack(stackPattern, stacks) {
 	if (stackPattern === null) {
@@ -75376,6 +75580,10 @@ async function localInvokeAgentCoreCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
@@ -76266,16 +76474,37 @@ function emitA2aResult(result) {
 function platformToArchitecture(platform) {
 	return platform === "linux/amd64" ? "x86_64" : "arm64";
 }
+/**
+* Copy the developer's AWS credentials + region into the container env for the
+* DEFAULT (no `--assume-role`) path.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in; the credentials
+* are copied verbatim (an AKID / session token is case-SENSITIVE, so lower-casing
+* the whole pass-through list would corrupt every one of them). The value lands
+* in the container's own `AWS_REGION`, i.e. in every SDK client the agent builds,
+* and SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition).
+*
+* Folding only inside `applyAgentCoreCredentialEnv`'s assume-role arm — which is
+* where issue #1814 stopped, and what round 3 of the #1836 review found still
+* open here after the same gap was closed in `local-invoke.ts` — made ONE command
+* yield two different container regions for the same shell: `cn-north-1` with
+* `--assume-role`, `CN-NORTH-1` without.
+*/
 function forwardAwsEnv$1(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
@@ -76578,6 +76807,10 @@ async function localInvokeCommand(target, options) {
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
+	if (options.stackRegion !== void 0) {
+		options.rawStackRegion = options.stackRegion;
+		options.stackRegion = canonicalizeRegion(options.stackRegion);
+	}
 	let imagePlan;
 	let containerId;
 	let stopLogs;
@@ -76731,29 +76964,12 @@ async function localInvokeCommand(target, options) {
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
 			...envResult.resolved
 		};
-		let assumeSucceeded = false;
-		if (resolvedAssumeRoleArn) {
-			const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-			try {
-				const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion);
-				dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
-				dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
-				dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
-				if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
-				assumeSucceeded = true;
-			} catch (err) {
-				const reason = err instanceof Error ? err.message : String(err);
-				logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
-			}
-		}
-		if (!assumeSucceeded) {
-			forwardAwsEnv(dockerEnv);
-			applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
-			if (profileCredsFile) {
-				dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
-				dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
-			}
-		}
+		await applyLambdaCredentialEnv(dockerEnv, {
+			...resolvedAssumeRoleArn && { assumeRoleArn: resolvedAssumeRoleArn },
+			...options.region !== void 0 && { region: options.region },
+			...profileCredentials && { profileCredentials },
+			...profileCredsFile && { profileCredsFile }
+		});
 		let debugPort;
 		if (options.debugPort) {
 			debugPort = Number(options.debugPort);
@@ -77153,6 +77369,55 @@ async function readStdin() {
 	return Buffer.concat(chunks).toString("utf-8");
 }
 /**
+* Inject AWS credentials into the container env. Precedence:
+*   1. `--assume-role` → STS-issued temp creds for the resolved ARN (on
+*      STS failure, warn + fall through to dev creds). Swapping the
+*      developer's credentials for the function's deployed execution role
+*      degrades rather than hard-errors: this is a developer-loop tool, not
+*      a security boundary, and the most common cause is the role's
+*      `AssumeRolePolicy` not trusting the developer's IAM principal (a
+*      config gap, not a cdkd bug).
+*   2. dev shell creds (`forwardAwsEnv` — which folds the region case for the
+*      same reason arm 1 does) + `--profile` overlay
+*      ({@link applyProfileCredentialsOverlay}) + the bind-mounted
+*      credentials-file env so handler `fromIni({ profile })` resolves.
+*      Applied in that order: the overlay intentionally wins over whatever
+*      `forwardAwsEnv` copied, and the credentials-file env is additive.
+*
+* Extracted from `localInvokeCommand`'s body by issue
+* [#1836](https://github.com/go-to-k/cdkd/issues/1836) and shaped to mirror
+* `applyAgentCoreCredentialEnv` in `local-invoke-agentcore.ts` (the sibling
+* issue [#1814](https://github.com/go-to-k/cdkd/issues/1814) fixed), so a unit
+* test can lock the STS-client region binding with a mocked STS instead of
+* driving the full synth + docker pipeline.
+*/
+async function applyLambdaCredentialEnv(dockerEnv, args) {
+	const logger = getLogger();
+	let assumeSucceeded = false;
+	if (args.assumeRoleArn) {
+		const stsRegion = canonicalizeRegion(args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
+		try {
+			const creds = await assumeLambdaExecutionRole(args.assumeRoleArn, stsRegion);
+			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+			dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+			dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
+			assumeSucceeded = true;
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+		}
+	}
+	if (!assumeSucceeded) {
+		forwardAwsEnv(dockerEnv);
+		applyProfileCredentialsOverlay(dockerEnv, args.profileCredentials, false);
+		if (args.profileCredsFile) {
+			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = args.profileCredsFile.containerPath;
+			dockerEnv["AWS_PROFILE"] = args.profileCredsFile.profileName;
+		}
+	}
+}
+/**
 * Assume the Lambda execution role and return temporary credentials.
 *
 * Closes the "developer has admin creds, the deployed function has narrow
@@ -77192,17 +77457,30 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 *
 * Region is inherited from `AWS_REGION` / `AWS_DEFAULT_REGION` so
 * `aws.config.region` inside the handler works without extra setup.
+*
+* Issue [#1836](https://github.com/go-to-k/cdkd/issues/1836): the two REGION
+* entries are folded through `canonicalizeRegion` on the way in, the credentials
+* are copied verbatim. This is the DEFAULT path — no `--assume-role` — and it
+* carries the same exposure the assume-role branch had: the value lands in the
+* container's own `AWS_REGION`, i.e. in every SDK client the handler builds, and
+* SDK endpoint resolution is case-SENSITIVE (`CN-NORTH-1` resolves the
+* COMMERCIAL partition). Folding only inside `applyLambdaCredentialEnv`'s
+* assume-role arm made ONE command yield two different container regions for the
+* same shell — `cn-north-1` with `--assume-role`, `CN-NORTH-1` without.
 */
 function forwardAwsEnv(env) {
-	for (const key of [
+	const passThrough = [
 		"AWS_ACCESS_KEY_ID",
 		"AWS_SECRET_ACCESS_KEY",
 		"AWS_SESSION_TOKEN",
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	const regionKeys = /* @__PURE__ */ new Set(["AWS_REGION", "AWS_DEFAULT_REGION"]);
+	for (const key of passThrough) {
 		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
+		if (value === void 0) continue;
+		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
 }
 /**
@@ -78448,7 +78726,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.13");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.15");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;