@go-to-k/cdkd 0.283.2 → 0.283.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-DuYBir2W.js";
+import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-C605sBVJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Cl4ATw1l.js";
+import { t as ASGProvider } from "./asg-provider-CZQewQcH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3032,7 +3032,8 @@ var IAMManagedPolicyProvider = class {
 			this.logger.debug(`${reason} changed, replacing managed policy: ${physicalId} (${reason} mutation)`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			try {
-				await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old managed policy ${physicalId} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
 			} catch (error) {
 				this.logger.warn(`Failed to delete old managed policy ${physicalId} during replacement: ${String(error)}. The old policy may be orphaned and require manual cleanup.`);
 			}
@@ -10399,11 +10400,16 @@ var SNSSubscriptionProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
+		let deleteResult = void 0;
 		try {
-			await this.delete(logicalId, physicalId, resourceType);
+			deleteResult = await this.delete(logicalId, physicalId, resourceType);
 		} catch (error) {
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${String(error)}`);
 		}
+		if (deleteResult?.outcome === "skipped") {
+			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${deleteResult.reason}`);
+			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Repair the state record for ${logicalId}, or remove the old subscription in AWS if it is still live, then re-run.`, resourceType, logicalId, physicalId));
+		}
 		const createResult = await this.create(logicalId, resourceType, properties);
 		return {
 			physicalId: createResult.physicalId,
@@ -10439,6 +10445,27 @@ var SNSSubscriptionProvider = class {
 	}
 	/**
 	* Log the CFn-parity skip for a pending-confirmation subscription delete.
+	*
+	* **Do NOT convert either caller into a `ResourceDeleteResult` skip** (the
+	* issue [#1770](https://github.com/go-to-k/cdkd/issues/1770) sweep) — the
+	* note lives here rather than only at `update()` because this is where a
+	* future converter looks. Both arms mean the resource is GONE as far as the
+	* stack is concerned: CloudFormation removes a pending-confirmation
+	* subscription from the stack without unsubscribing, and the pending record
+	* expires on its own, so `deleted` is the honest outcome and a skip would
+	* preserve state and fail an otherwise-clean destroy for no reason.
+	*
+	* There is a second consequence, and it is why the warning is this loud:
+	* `update()` ABORTS the DELETE-first replacement on a skip (issue
+	* [#1778](https://github.com/go-to-k/cdkd/issues/1778)). Reporting a skip
+	* here would therefore make every deploy of a subscription whose state
+	* physicalId is the `PendingConfirmation` placeholder — reachable via
+	* `cdkd import --resource <id>=PendingConfirmation` — throw permanently,
+	* with no flag to force it, and `cdkd drift --revert` would fail the same
+	* way. Exempting that placeholder from the abort was the alternative and
+	* was rejected: it would duplicate this method's knowledge of the
+	* placeholder inside `update()`, where a later change to the accepted set
+	* would silently un-fence the abort.
 	*/
 	logPendingConfirmationSkip(logicalId, physicalId) {
 		this.logger.warn(`SNS subscription ${logicalId} (${physicalId}) is pending confirmation and cannot be unsubscribed; skipping deletion to match CloudFormation behavior (the pending record expires automatically within 3 days)`);
@@ -53511,7 +53538,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 						} catch (retryError) {
 							lastDeleteError = retryError;
 							const msg = retryError instanceof Error ? retryError.message : String(retryError);
-							if (!(isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests")) || attempt >= maxAttempts) break;
+							if (!(!isMarkedNonRetryable(retryError) && (isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests"))) || attempt >= maxAttempts) break;
 							const delay = 5e3 * Math.pow(2, attempt);
 							logger.debug(`  ⏳ Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`);
 							await new Promise((resolve) => setTimeout(resolve, delay));
@@ -54209,7 +54236,8 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			try {
-				await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old ACM certificate ${physicalId} during replacement: ${deleteResult.reason}. The old certificate may be orphaned and require manual cleanup.`);
 			} catch (error) {
 				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${String(error)}. The old certificate may be orphaned and require manual cleanup.`);
 			}
@@ -67196,6 +67224,75 @@ function createLocalStateProvider$1(options, cdkdStackName, synthRegion) {
 	return createLocalStateProvider(options, cdkdStackName, synthRegion, cdkdExtraStateProviders);
 }
 
+//#endregion
+//#region src/local/intrinsic-image.ts
+/**
+* Boundary shim over cdk-local's container-image intrinsic resolver for
+* `cdkd local invoke` / `start-api` / `run-task` — resolves the canonical
+* CDK 2.x `Fn::Join` shape for ECR image URIs (`lambda.DockerImageCode.fromEcr`
+* / ECS `ContainerImage.fromEcrRepository`) and the same-stack ECR `Fn::GetAtt`
+* Arn / RepositoryUri synthesis. The implementation lives in cdk-local and
+* cdkd consumes it instead of carrying a byte-identical copy.
+* `ImageResolutionContext` is re-exported as a type. See cdk-local's
+* `src/local/intrinsic-image.ts`.
+*
+* Two of the three symbols are bare re-exports. `derivePseudoParametersFromRegion`
+* is NOT: it is wrapped, for the reason below.
+*/
+/**
+* Derive `${AWS::Region}` / `${AWS::AccountId}` / `${AWS::Partition}` /
+* `${AWS::URLSuffix}` for the `Fn::Join` `Code.ImageUri` path (issue #637),
+* with the region CANONICALIZED to its lower-case spelling first.
+*
+* ## Why this is a wrapper rather than a re-export
+*
+* Issue [#1795](https://github.com/go-to-k/cdkd/issues/1795) canonicalizes the
+* region inside `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`),
+* so every cdkd-OWNED region -> partition/suffix derivation inherits ONE
+* normalization point. This helper is a FOURTH derivation that the fix
+* structurally could not reach (issue
+* [#1814](https://github.com/go-to-k/cdkd/issues/1814)): the implementation is
+* cdk-local's, and it carries its own partition table whose prefix tests are
+* case-sensitive in the same direction. So an upper-cased `--region CN-NORTH-1`
+* still fell through to the commercial partition here and synthesized
+* `<acct>.dkr.ecr.CN-NORTH-1.amazonaws.com/...` — a `cn-` region carrying the
+* commercial suffix, a host that does not exist — at the five call sites, across
+* three files, that reach this symbol:
+*
+* - `src/cli/commands/local-start-api.ts` (the `Fn::Join` `Code.ImageUri` path)
+* - `src/cli/commands/local-invoke-agentcore.ts` (x3)
+* - `src/local/lambda-resolver.ts`
+*
+* The preferred fix is upstream — lower-casing the region inside cdk-local's
+* own implementation, which would keep exactly one normalization point. This
+* is the filed FALLBACK: a thin canonicalizing boundary over the re-export,
+* the same shape `docker-image-builder.ts` uses for its error-class boundary.
+* It stays correct if upstream later canonicalizes too, because
+* {@link canonicalizeRegion} is idempotent — double-folding is a no-op.
+*
+* Canonicalizing the INPUT (rather than post-processing the result) is what
+* makes this complete: the returned `region` is substituted as
+* `${AWS::Region}` into every ARN the resolver builds, so a raw upper-cased
+* value would misspell those too, not just the derived suffix.
+*
+* `undefined` passes through untouched — upstream answers `undefined` for a
+* missing region and that verdict is not this shim's to change.
+*
+* ## What this deliberately does NOT fix
+*
+* Case is only half the agreement between the two tables. cdk-local's table
+* predates the three rows cdkd's issue #1764 added, so `us-isof-` / `eu-isoe-` /
+* `eusc-` regions resolve COMMERCIAL here even when spelled canonically — a
+* table-COVERAGE divergence, orthogonal to case, filed as issue
+* [#1821](https://github.com/go-to-k/cdkd/issues/1821). Widening this wrapper
+* into a second partition authority would fix it, but that is a design call of
+* its own; the divergence is pinned by a unit case so it fails loudly rather
+* than staying latent.
+*/
+function derivePseudoParametersFromRegion$1(region, accountId) {
+	return derivePseudoParametersFromRegion(canonicalizeRegion(region), accountId);
+}
+
 //#endregion
 //#region src/local/lambda-resolver.ts
 var LocalInvokeResolutionError = class LocalInvokeResolutionError extends Error {
@@ -67405,7 +67502,7 @@ function extractImageUri$1(value, logicalId, stackName, resources, region) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const pseudoParameters = derivePseudoParametersFromRegion$1(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local invoke cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
@@ -71371,7 +71468,7 @@ function extractImageUri(value, logicalId, stackName, resources, region) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const pseudoParameters = derivePseudoParametersFromRegion$1(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
@@ -73448,6 +73545,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	warnIfDeprecatedRegion(options);
+	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
@@ -73868,7 +73966,7 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 		getLogger().warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
 		return;
 	}
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	if (!region) throw new CdkdError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
 	const signed = await signAgentCoreInvocation({
 		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region),
@@ -74014,7 +74112,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		key: s3Source.key,
 		...s3Source.versionId !== void 0 && { versionId: s3Source.versionId }
 	};
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
 	let credentials;
 	if (assumeRoleArn) try {
@@ -74069,7 +74167,7 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 			resources: imageContext?.stateResources ?? loaded.resources,
 			consumerRegion: loaded.region
 		};
-		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion(loaded.region);
+		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 		if (pseudo) subContext.pseudoParameters = pseudo;
 		if (imageContext?.stateParameters) subContext.parameters = imageContext.stateParameters;
 		if (imageContext?.stateSensitiveParameters?.length) subContext.sensitiveParameters = new Set(imageContext.stateSensitiveParameters);
@@ -74125,7 +74223,7 @@ async function resolveFromS3BucketIntrinsic(resolved, stateProvider, loaded, ima
 		resources: imageContext?.stateResources ?? loaded.resources,
 		consumerRegion: loaded.region
 	};
-	const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion(loaded.region);
+	const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion$1(loaded.region);
 	if (pseudo) subContext.pseudoParameters = pseudo;
 	const crossStackResolver = await stateProvider.buildCrossStackResolver(loaded.region);
 	if (crossStackResolver) subContext.crossStackResolver = crossStackResolver;
@@ -74153,7 +74251,7 @@ function describeIntrinsic(value) {
 */
 async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+	const region = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region);
 	let accountId;
 	try {
 		accountId = await resolveCallerAccountId(region, options.profile);
@@ -74161,7 +74259,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		logger.warn(`--from-cfn-stack: STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. A same-stack ECR image URI referencing \${AWS::AccountId} may not resolve.`);
 	}
 	const context = {};
-	const pseudo = derivePseudoParametersFromRegion(region, accountId);
+	const pseudo = derivePseudoParametersFromRegion$1(region, accountId);
 	if (pseudo) context.pseudoParameters = pseudo;
 	const loaded = await stateProvider.load(candidate.stackName, candidate.region);
 	if (loaded) {
@@ -74205,7 +74303,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 	const logger = getLogger();
 	let assumeSucceeded = false;
 	if (args.assumeRoleArn) {
-		const stsRegion = args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+		const stsRegion = canonicalizeRegion(args.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"]);
 		try {
 			const creds = await assumeAgentCoreExecutionRole(args.assumeRoleArn, stsRegion);
 			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
@@ -76520,7 +76618,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;