@go-to-k/cdkd 0.284.3 → 0.284.4

package/dist/{deploy-engine-DJ-CgH80.js → deploy-engine-3Z7P1hKs.js}

@@ -1045,7 +1045,7 @@ var aws_clients_exports = /* @__PURE__ */ __exportAll({
 /**
 * AWS clients manager
 */
-var AwsClients = class {
+var AwsClients = class AwsClients {
 	s3Client;
 	cloudControlClient;
 	iamClient;
@@ -1080,6 +1080,87 @@ var AwsClients = class {
 		};
 	}
 	/**
+	* The region this instance was EXPLICITLY configured with, or `undefined`.
+	*
+	* Deliberately reads only `config.region` and consults NO environment
+	* variable, which is the opposite of what an earlier revision did and the
+	* difference matters (issue #1957). An env read here is not merely
+	* incomplete, it is UNSTABLE in the one direction that is dangerous: the SDK
+	* memoizes a region-less client's region at its first resolution
+	* (`@smithy/node-config-provider`'s `loadConfig` wraps the provider chain in
+	* `memoize`), while `deploy.ts`'s `switchRegion` keeps mutating
+	* `process.env.AWS_REGION` per stack and restores it in each stack's
+	* `finally`. So an env-derived answer can report region X for a client that
+	* long ago pinned itself to region P — letting a caller conclude "these
+	* clients already point at my region" and use the WRONG ones, which is worse
+	* than not knowing.
+	*
+	* When this returns `undefined` the region is not merely unknown to us, it is
+	* NOT YET DECIDED — and that is the important part. {@link clientOptions}
+	* omits `region` entirely in that case, so each service client resolves and
+	* MEMOIZES its own region independently, at its own first construction, from
+	* an environment `deploy.ts`'s `switchRegion` is actively mutating. The
+	* members of one region-less bag can therefore disagree with each other:
+	* `ssm` can pin `us-west-2` and `secretsManager` pin `us-east-1` a moment
+	* later, because the getters are lazy and each samples a different instant.
+	*
+	* So there is deliberately NO method here that reports "the region of these
+	* clients" for an unconfigured instance. An earlier revision had one — it
+	* asked `this.ssm.config.region()` — and it was unsound for exactly this
+	* reason: it measured ONE member of a bag whose members need not agree, and
+	* the caller then reused the whole bag on the strength of it. A caller that
+	* needs a region it can rely on must build a CONFIGURED bag
+	* ({@link withRegion} always sets `region`, so every member of a derived bag
+	* agrees by construction).
+	*/
+	get configuredRegion() {
+		return this.config.region || void 0;
+	}
+	/**
+	* The CREDENTIAL half of this instance's configuration — `profile` plus any
+	* explicitly supplied `credentials` — deliberately WITHOUT `region`.
+	*
+	* This is the half that must survive a region override. Note what it is and
+	* is NOT worth: `--profile` ALSO reaches a freshly constructed client through
+	* the environment, because `src/cli/program.ts` sets `process.env.AWS_PROFILE`
+	* in a `preAction` hook for every command — so carrying `profile` here is
+	* belt-and-braces rather than the thing standing between a user and the wrong
+	* account. What genuinely has no environment path is an explicit
+	* `credentials` object: nothing exports it, so a sibling built without it
+	* falls back to the default chain. The same is true of any library caller
+	* that constructs `AwsClients` directly and therefore never runs the CLI's
+	* `preAction` hook. `--role-arn` needs nothing carried at all —
+	* `applyRoleArnIfSet` exports `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
+	* `AWS_SESSION_TOKEN` into the process environment.
+	*
+	* The `credentials` object is CLONED rather than aliased: the returned bag is
+	* handed to every derived sibling, and sharing one mutable object would let a
+	* caller reach through it and rewrite the ambient instance's credentials.
+	*/
+	get credentialConfig() {
+		return {
+			...this.config.profile && { profile: this.config.profile },
+			...this.config.credentials && { credentials: { ...this.config.credentials } }
+		};
+	}
+	/**
+	* Derive a sibling bound to `region`, carrying this instance's credential
+	* configuration (see {@link credentialConfig}) and overriding ONLY the region.
+	*
+	* Used by {@link IntrinsicFunctionResolver} to pin a dynamic-reference lookup
+	* (`{{resolve:secretsmanager:...}}` / `{{resolve:ssm:...}}`) to the stack's own
+	* region instead of whichever region the process-global singleton happens to
+	* hold at that moment (issue #1957). The returned instance owns its own lazily
+	* constructed clients and its own `destroy()`; it is NOT registered as the
+	* global, so nothing else in the process can observe it.
+	*/
+	withRegion(region) {
+		return new AwsClients({
+			...this.credentialConfig,
+			region
+		});
+	}
+	/**
 	* Get S3 client
 	*
 	* Note: If region and credentials are not provided, AWS SDK will use:
@@ -12283,6 +12364,44 @@ const MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES = 4;
 * without real waits (mirrors `describeTypeRetryDelays`).
 */
 const dynamicReferenceRetryDelays = {};
+/**
+* Is `region` safe to build an AWS SDK client from?
+*
+* This is a SECURITY gate, not an AWS region registry, and the distinction
+* decides how strict it is. The SDK turns a region into a hostname by
+* substitution — `https://ssm.{region}.amazonaws.com` — so a value carrying a
+* host delimiter escapes the label and re-points the endpoint: the measured
+* case is `evil.example.com#`, which yields
+* `https://ssm.evil.example.com/#.amazonaws.com` and sends a SigV4-SIGNED
+* request (access key id + signature) to an attacker-controlled host.
+*
+* The reachable input is `Fn::GetAZs`, whose argument is TEMPLATE-DERIVED and
+* can arrive through an `Fn::ImportValue` or a parameter — i.e. it is not
+* necessarily written by whoever runs the deploy. Before issue #1957 that value
+* only fed the `region-name` FILTER of a `DescribeAvailabilityZones` call and
+* never built a client, so binding lookups to a region is exactly what made it
+* reachable; the gate ships with the binding.
+*
+* So the predicate is CHARSET-based rather than shape-based: lowercase
+* alphanumerics and hyphens only, which cannot express `.`, `/`, `:`, `@`, `?`
+* or `#` and therefore cannot leave the hostname label. It deliberately does
+* NOT try to enumerate real regions — AWS keeps adding them
+* (`ap-southeast-7`, `il-central-1`, `mx-central-1`, `eusc-de-east-1`), and a
+* pattern tight enough to reject `----` would also reject the next one. A
+* region-shaped-but-nonexistent value is not a security problem: it resolves to
+* a hostname that does not exist and the SDK fails loudly.
+*
+* Note the sibling pattern in `src/cli/commands/state-file-keys.ts` is NOT
+* reusable here: it requires `^[a-z]{2}(-[a-z]+)+-\d+$`, which rejects
+* `eusc-de-east-1` (the European Sovereign Cloud partition's four-letter
+* prefix).
+*
+* Callers must {@link canonicalizeRegion} first — `US-EAST-1` is a documented
+* input and is lowercase-canonical, not invalid.
+*/
+function isClientSafeRegion(region) {
+	return /^[a-z0-9][a-z0-9-]{0,30}$/.test(region);
+}
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
 let fabricatedAccountIdentity = null;
@@ -12421,6 +12540,63 @@ function stringifyParameterForLog(paramDef, value) {
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
+	/**
+	* The region the CONSTRUCTOR was given, or `undefined` when it was called
+	* without one — unlike {@link resolverRegion}, which substitutes
+	* `AWS_REGION` / `us-east-1` so every consumer has a string to work with.
+	*
+	* The distinction is load-bearing for {@link clientsForRegion} and for
+	* nothing else: re-pointing an AWS lookup away from the ambient clients is
+	* only safe when a caller SAID which region this resolver stands for.
+	*
+	* IN PRODUCTION THIS IS ALWAYS SET, and saying so matters more than the
+	* guard it enables. Every construction site defaults the region BEFORE the
+	* constructor and passes a `string` — `deploy.ts`, `scrub.ts`, `drift.ts`,
+	* `import.ts`, `export.ts`, `diff-recursive.ts`, `rollback-executor.ts` —
+	* so the `undefined` arm is reachable only through the no-argument
+	* constructor, which nothing but tests uses. It is kept because the
+	* parameter is optional and the arm must therefore exist, not because a
+	* shipped path depends on it.
+	*
+	* That has a USER-VISIBLE consequence, deliberately accepted (issue #1957
+	* review). For a REGION-AGNOSTIC stack (no `env.region`) run with neither
+	* `--region` nor `AWS_REGION`, the region those callers compute is the
+	* hard-coded `us-east-1` fallback, so the lookup now goes there — where
+	* before it followed the ambient clients to whatever `~/.aws/config` said.
+	* The new behaviour is the consistent one: `us-east-1` is already the region
+	* cdkd keys that stack's state file, its lock and its export index under, so
+	* the resolved value and the record that stores it now agree. Previously
+	* they did not, which is the same class of defect this issue is about, one
+	* layer up. A stack WITH an explicit `env.region` is unaffected — every
+	* caller prefers it (`scrub.ts` does `stack.region || region`).
+	*/
+	explicitRegion;
+	/**
+	* AWS clients pinned to a region OTHER than the ambient singleton's, built
+	* lazily on first mismatch and keyed by region (issue #1957).
+	*
+	* Lifetime is deliberately the resolver's own, matching {@link cfnClients}
+	* two fields down: both are per-region SDK clients this instance builds for
+	* itself, and neither is destroyed, because `IntrinsicFunctionResolver` has
+	* no teardown hook and every construction site (`DeployEngine`, `scrub`,
+	* `drift`, `import`, `diff-recursive`, `export`, `rollback-executor`) would
+	* have to grow one. The bound on what that costs is small and worth stating:
+	* an entry exists only when a resolver's region DIFFERS from the ambient
+	* one — i.e. only on a genuinely cross-region run — and at most one per
+	* foreign region per resolver, versus the ambient clients which are already
+	* created and destroyed per stack by `deploy.ts`.
+	*
+	* KEYED BY REGION ALONE, which means an entry also pins the CREDENTIAL
+	* configuration of whichever ambient instance was current at the first
+	* mismatch for that region. That is sound today because the credential half
+	* is process-wide rather than per-stack: `--profile` comes from one CLI
+	* option and `--role-arn` lands in `process.env`, so every ambient instance
+	* a run installs carries the same one. Widen the key to include
+	* {@link AwsClients.credentialConfig} the moment that stops being true —
+	* per-stack credentials would otherwise let one stack's lookups run under
+	* another's identity, which is a worse bug than the one this cache serves.
+	*/
+	regionScopedClients = /* @__PURE__ */ new Map();
 	strictGetAtt;
 	cfnFallback;
 	/**
@@ -12511,24 +12687,17 @@ var IntrinsicFunctionResolver = class {
 	* nested stacks ship or that pass starts recording secrets; a resolver per
 	* node is the fix then, not a wider key here.
 	*
-	* What this does NOT settle — issue
-	* [#1957](https://github.com/go-to-k/cdkd/issues/1957) owns it: the lookups
-	* themselves still go through the process-ambient `getAwsClients()` singleton
-	* (see `resolveSecretsManagerReference` / `resolveSSMReference`), whose region
-	* is whichever the process installed last. So a resolver constructed for
-	* region B while the ambient clients point at region A still reads A on its
-	* FIRST resolution — no cache involved, so nothing here can prevent it.
-	* `cdkd deploy` re-pins the singleton per stack, which makes a SERIAL
-	* multi-region deploy correct end to end, but the default
-	* `--stack-concurrency 4` races for it (a hazard `deploy.ts` already
-	* documents) and `cdkd scrub` installs its clients once while resolving
-	* stacks in several regions. The split of ownership is therefore: THIS field
-	* closes the cache as a cross-region / cross-stack carrier, while #1957 owns
-	* the wrong-region READ — which is the outcome #1933's title names, so #1933
-	* is not fully resolved until #1957 lands. Pinning the lookup to
-	* {@link resolverRegion} means constructing region-scoped clients, which is a
-	* credentials decision (a bare `new SSMClient({ region })` drops the ambient
-	* profile / assume-role config) and belongs to #1957 rather than here.
+	* The OTHER half of the same outcome — the lookups themselves reading the
+	* process-ambient `getAwsClients()` singleton, whose region is whichever the
+	* process installed last — was issue
+	* [#1957](https://github.com/go-to-k/cdkd/issues/1957) and is now closed by
+	* {@link clientsForRegion}: a resolver whose region differs from the ambient
+	* one builds its own region-pinned clients (carrying the ambient profile /
+	* credentials) instead of reading whatever the singleton currently holds.
+	* The two halves remain SEPARATE mechanisms and both are needed — this field
+	* stops a resolved value from travelling between regions or stacks, while
+	* the scoped clients stop the FIRST resolution from reading the wrong region
+	* (no cache involved, so nothing here could ever have prevented it).
 	*/
 	cachedDynamicReferences = /* @__PURE__ */ new Map();
 	/**
@@ -12554,6 +12723,7 @@ var IntrinsicFunctionResolver = class {
 	warnedUnrecognizedSsmTypes = /* @__PURE__ */ new Set();
 	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
+		this.explicitRegion = region || void 0;
 		this.strictGetAtt = options?.strictGetAtt ?? false;
 		this.cfnFallback = options?.cfnFallback ?? true;
 	}
@@ -12566,6 +12736,133 @@ var IntrinsicFunctionResolver = class {
 		this.physicalIdFallbackCount = 0;
 	}
 	/**
+	* AWS clients for a REGION-SENSITIVE lookup, pinned to `targetRegion`
+	* (issue [#1957](https://github.com/go-to-k/cdkd/issues/1957)).
+	*
+	* Every lookup in this class used to read `getAwsClients()` — the
+	* PROCESS-GLOBAL singleton, whose region is whichever one the process
+	* installed last. That is not the same thing as the region this resolver
+	* stands for, and the gap is reachable on main:
+	*
+	* - `cdkd deploy` defaults to `--stack-concurrency 4` and re-points the
+	*   singleton per stack, so two stacks in different regions race for one
+	*   mutable global and stack B's `GetSecretValue` / `GetParameter` can run
+	*   against stack A's client. The resolved value is redacted on its way into
+	*   state, so nothing downstream records which region answered.
+	* - `cdkd scrub --all` installs the clients ONCE while resolving per-stack
+	*   regions, so a region-B `SecureString` whose region-A namesake is a plain
+	*   `String` is classified PUBLIC and left in PLAINTEXT in state.json — the
+	*   same disclosure class as GHSA-p5qg-v9gv-hc7w, not merely a wrong value.
+	* - `cdkd drift --revert` WRITES the resolved value to a live resource, so
+	*   there the wrong region is a wrong write rather than a wrong report.
+	*
+	* Fixing it here rather than at the ~10 `setAwsClients` call sites is what
+	* makes it one mechanism instead of a per-command patch: this class already
+	* knows its own region, and every construction site already passes the
+	* per-stack one.
+	*
+	* REUSING THE AMBIENT CLIENTS REQUIRES PROOF THAT THEY ALREADY POINT AT
+	* `targetRegion`, and the direction of that test is the whole correctness
+	* argument. CloudFormation semantics say a stack's dynamic references resolve
+	* in the STACK's region, and every construction site passes exactly that — so
+	* once a region has been named, sending the lookup there is not an
+	* optimisation to be justified, it is the requirement. Whether the ambient
+	* singleton happens to agree only decides whether an object allocation can be
+	* skipped.
+	*
+	* An earlier revision had this backwards twice over, and both failures are
+	* worth naming because each looks reasonable in isolation.
+	*
+	* It first declined to override whenever the ambient region was UNKNOWN,
+	* reasoning that overriding on an unproven mismatch might re-point a lookup
+	* that works today. That fails OPEN, on the COMMON configuration: `aws
+	* configure` writes the region to `~/.aws/config`, and `cdkd scrub` sets a
+	* client region only when `--region` is passed. The disclosure this issue
+	* exists to close stayed reachable — profile region `us-east-1`, stack B in
+	* `ap-northeast-1`, a name that is `String` in A and `SecureString` in B,
+	* `cdkd scrub --all` with no flags: B's reference answered by A, classified
+	* public, plaintext left in `state.json`.
+	*
+	* It then determined the ambient region by reading `process.env` here, which
+	* is worse than not knowing: the SDK memoizes a region-less client's region
+	* at its first resolution while `deploy.ts`'s `switchRegion` keeps mutating
+	* `AWS_REGION` per stack and restores it in each stack's `finally`, so the
+	* environment could say `baseRegion` for a client long since pinned
+	* elsewhere — and this method would conclude MATCH and hand back clients
+	* pointing somewhere else.
+	*
+	* The fix for THAT was to ask the SDK (`ssm.config.region()`), and it was
+	* still wrong, in a way worth writing down because it looks airtight. An
+	* unconfigured `AwsClients` is not a bag of clients, it is a bag of DEFERRED
+	* client constructions: `clientOptions` omits `region`, the getters are lazy,
+	* and each member therefore samples the mutating environment at its own
+	* instant and memoizes a possibly DIFFERENT region. Asking `ssm` measures one
+	* member and says nothing about `secretsManager`, so the seam could short-
+	* circuit on a us-west-2 `ssm` and then hand out a bag whose `secretsManager`
+	* pins us-east-1 a moment later — issue #1957's Site 1 surviving inside the
+	* arm meant to fix it.
+	*
+	* So the short-circuit is taken ONLY when the ambient's region is
+	* CONFIGURED. That is not a heuristic: a configured bag passes `region` to
+	* every member ({@link AwsClients.clientOptions}), so its members agree by
+	* construction, and {@link AwsClients.withRegion} always sets one, so every
+	* derived bag is internally consistent too. An unconfigured ambient is not
+	* "of unknown region", it is "of not-yet-decided region", and there is
+	* nothing to compare against — so it SCOPES. That is the same "unknown means
+	* SCOPE, not skip" rule as above, applied one level deeper.
+	*
+	* Three arms return the ambient instance, each for a reason that is not
+	* "we could not prove a mismatch":
+	*
+	* 1. No `targetRegion` — no region was ever named (see
+	*    {@link explicitRegion}), so there is nothing to bind to.
+	* 2. `targetRegion` is not safe to build a client from (see
+	*    {@link isClientSafeRegion}) — which THROWS. An earlier revision warned
+	*    and fell back to the ambient clients, reasoning that a malformed region
+	*    reaching here is a cdkd bug and failing every lookup would turn it into
+	*    an outage. That put this arm on the wrong side of the two-severity
+	*    design: falling back to the ambient means READING ANOTHER REGION, which
+	*    for `scrub` / `drift` / `import` — whose region is state-derived — is
+	*    the disclosure this issue exists to close (a region-B `SecureString`
+	*    classified against a region-A `String`). A stopped command is strictly
+	*    better than a silent wrong-region read. The `Fn::GetAZs` entry still
+	*    validates EARLIER so it can give a message naming the template
+	*    construct; this arm is the backstop that guarantees no call site,
+	*    present or future, routes unvalidated input into an SDK endpoint.
+	* 3. The installed clients cannot DERIVE a sibling — `withRegion` is absent.
+	*    In production that never happens: `getAwsClients()` returns an
+	*    `AwsClients`. It is true only of a test double, and it is checked
+	*    EXPLICITLY rather than left to emerge, for a reason the review of this
+	*    change made concrete. The ~260 suites that stub `getAwsClients()` with a
+	*    plain object used to stay on the ambient path as a side effect of the
+	*    `undefined`-region guard above — the very guard that made the disclosure
+	*    reachable. Removing that guard without putting something deliberate in
+	*    its place would have traded a security hole for ~260 `TypeError`s, so
+	*    the test-double case is now its own named arm and the security arm no
+	*    longer has a testing job to do. Suites that are ABOUT region scoping use
+	*    a real `AwsClients` and are unaffected by it.
+	*
+	* Regions are canonicalised on both sides before comparing, because
+	* `--region US-EAST-1` is a documented input and the repo lowercases
+	* elsewhere (`canonicalizeRegion`, issues #1795 / #1850). Without it an
+	* uppercase spelling would build a second client for the same physical
+	* region — benign, but wasteful and confusing in a debug log.
+	*/
+	clientsForRegion(targetRegion) {
+		const ambient = getAwsClients();
+		if (!targetRegion) return ambient;
+		const target = canonicalizeRegion(targetRegion);
+		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(target).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
+		if (typeof ambient.withRegion !== "function") return ambient;
+		const cached = this.regionScopedClients.get(target);
+		if (cached) return cached;
+		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
+		const scoped = ambient.withRegion(target);
+		this.regionScopedClients.set(target, scoped);
+		this.logger.debug(`Using region-scoped AWS clients for ${target}`);
+		return scoped;
+	}
+	/**
 	* Resolve parameter values from template Parameters section
 	*
 	* Merges default values from template with user-provided parameter values.
@@ -12617,7 +12914,7 @@ var IntrinsicFunctionResolver = class {
 	* Used for parameters with type AWS::SSM::Parameter::Value<...>.
 	*/
 	async resolveSSMParameter(parameterName) {
-		return (await getAwsClients().ssm.send(new GetParameterCommand({ Name: parameterName }))).Parameter?.Value ?? "";
+		return (await this.clientsForRegion(this.explicitRegion).ssm.send(new GetParameterCommand({ Name: parameterName }))).Parameter?.Value ?? "";
 	}
 	/**
 	* Coerce parameter value to the correct type based on parameter definition
@@ -13190,7 +13487,7 @@ var IntrinsicFunctionResolver = class {
 				const cached = cachedEc2InstanceAttributes[cacheKey];
 				if (cached !== void 0) return cached;
 				try {
-					const instance = (await getAwsClients().ec2.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+					const instance = (await this.clientsForRegion(this.explicitRegion).ec2.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
 					let value;
 					switch (attributeName) {
 						case "PrivateIp":
@@ -13224,7 +13521,7 @@ var IntrinsicFunctionResolver = class {
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
 				try {
-					const lt = (await getAwsClients().ec2.send(new DescribeLaunchTemplatesCommand({ LaunchTemplateIds: [physicalId] }))).LaunchTemplates?.[0];
+					const lt = (await this.clientsForRegion(this.explicitRegion).ec2.send(new DescribeLaunchTemplatesCommand({ LaunchTemplateIds: [physicalId] }))).LaunchTemplates?.[0];
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
@@ -13873,7 +14170,9 @@ var IntrinsicFunctionResolver = class {
 		if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
-			region = resolvedRegion;
+			const requestedRegion = canonicalizeRegion(resolvedRegion);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${stripControlChars(resolvedRegion).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			region = requestedRegion;
 		}
 		let roleArn;
 		if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
@@ -14056,28 +14355,52 @@ var IntrinsicFunctionResolver = class {
 	async resolveGetAZs(value, context) {
 		const resolvedValue = await this.resolveValue(value, context);
 		let region;
-		if (typeof resolvedValue === "string" && resolvedValue !== "") region = resolvedValue;
-		else region = (await getAccountInfo(this.resolverRegion)).region;
+		/**
+		* Which region's clients answer the `DescribeAvailabilityZones` below.
+		*
+		* `DescribeAvailabilityZones` lists the AZs of the region the CLIENT is
+		* pointed at; the `region-name` filter narrows that listing, it does not
+		* widen it to another region. So a foreign-region client returns an EMPTY
+		* list, which this method then caches and hands back as the resolved value
+		* of `Fn::GetAZs` — silently, since an empty list is not an error here
+		* (issue #1957).
+		*
+		* When the template names a region explicitly, THAT is the region to talk
+		* to. Otherwise fall back to the resolver's own — but only when it was
+		* given explicitly (see {@link explicitRegion}).
+		*/
+		let clientRegion;
+		if (typeof resolvedValue === "string" && resolvedValue !== "") {
+			const requested = canonicalizeRegion(resolvedValue);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${stripControlChars(resolvedValue).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			region = requested;
+			clientRegion = requested;
+		} else {
+			region = (await getAccountInfo(this.resolverRegion)).region;
+			clientRegion = this.explicitRegion;
+		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
 			this.logger.debug(`Resolved Fn::GetAZs from cache: ${region} -> ${JSON.stringify(cached)}`);
 			return cached;
 		}
-		const ec2Client = getAwsClients().ec2;
+		const ec2Client = this.clientsForRegion(clientRegion).ec2;
+		let azNames;
 		try {
-			const azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
+			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
 				Name: "region-name",
 				Values: [region]
 			}, {
 				Name: "state",
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
-			cachedAvailabilityZones[region] = azNames;
-			this.logger.debug(`Resolved Fn::GetAZs: ${region} -> ${JSON.stringify(azNames)}`);
-			return azNames;
 		} catch (error) {
 			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${region}': ${error instanceof Error ? error.message : String(error)}`);
 		}
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${region}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		cachedAvailabilityZones[region] = azNames;
+		this.logger.debug(`Resolved Fn::GetAZs: ${region} -> ${JSON.stringify(azNames)}`);
+		return azNames;
 	}
 	/**
 	* Resolve pseudo parameters
@@ -14226,7 +14549,7 @@ var IntrinsicFunctionResolver = class {
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
 		this.logger.debug(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`);
-		const client = getAwsClients().secretsManager;
+		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
@@ -14354,10 +14677,13 @@ var IntrinsicFunctionResolver = class {
 	* - It says NOTHING about concurrency. The client is captured before the
 	*   first attempt, so a sibling stack's teardown (`stackAwsClients.destroy()`
 	*   in `deploy.ts`) during a backoff surfaces as a raw, non-throttle-shaped
-	*   failure on the next attempt. That is a property of the ambient-singleton
-	*   design this PR deliberately does not touch (issue
-	*   [#1957](https://github.com/go-to-k/cdkd/issues/1957)), not something the
-	*   retry makes safe.
+	*   failure on the next attempt, and the retry does not make that safe. Issue
+	*   [#1957](https://github.com/go-to-k/cdkd/issues/1957) NARROWED this rather
+	*   than removing it: a lookup whose region differs from the ambient one now
+	*   runs on {@link clientsForRegion}'s own clients, which no sibling stack can
+	*   destroy because nothing else in the process holds a reference to them. A
+	*   sibling in the SAME region still shares the ambient instance, so the
+	*   window survives exactly where the two stacks agree on the region.
 	*/
 	sendWithThrottleRetry(operation, label) {
 		return withRetry(operation, label, {
@@ -14386,7 +14712,7 @@ var IntrinsicFunctionResolver = class {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error("Dynamic reference: ssm PARAMETER_NAME is required");
 		this.logger.debug(`Resolving dynamic reference: ssm:${parameterName}`);
-		const client = getAwsClients().ssm;
+		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
@@ -15269,7 +15595,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-iHWEv4gN.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C0L3_pHn.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -22814,7 +23140,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.3";
+	return "0.284.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25282,4 +25608,4 @@ var DeployEngine = class {
 
 //#endregion
 export { IntrinsicFunctionResolver as $, StackTerminationProtectionError as $n, buildDenyExternalAccessPolicy as $t, formatResourceLine as A, processStackMessages as An, withRetry as At, isExportAliasCollision as B, DependencyError as Bn, buildAssetRedirectMap as Bt, refusesFinalSnapshot as C, findLargeInlineResources as Cn, s3BucketDualStackDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, canonicalizeRegion as Dn, DiffCalculator as Dt, extractDeploymentEventError as E, PARTITION_TABLE as En, applyRoleArnIfSet as Et, red as F, resetAwsClients as Fn, rebuildClientForBucketRegion as Ft, clearOnUpdateRemoval as G, LockError as Gn, stripControlChars as Gt, stateKeySecretExposure as H, LocalInvokeBuildError as Hn, loadPublishableAssetManifest as Ht, yellow as I, setAwsClients as In, shouldRetainResource as It, findSilentDropProperties as J, PartialFailureError as Jn, ensureAssetStorage as Jt, ProviderRegistry as K, MissingCdkCliError as Kn, AssetModeResolver as Kt, collectDeclaredOutputNames as L, AssetError as Ln, AssetPublisher as Lt, cyan as M, resolveBucketRegion as Mn, TemplateParser as Mt, gray as N, AwsClients as Nn, LockManager as Nt, isStatefulRecreateTargetSync as O, derivePartitionAndUrlSuffix as On, INTRINSIC_KEYS as Ot, green as P, getAwsClients as Pn, S3StateBackend as Pt, isTerminationProtectionPropagationError as Q, StackHasActiveImportsError as Qn, validateContainerRepoName as Qt, collectPublishedOutputNames as R, CdkdError as Rn, stringifyValue as Rt, isFinalSnapshotError as S, MIGRATE_TMP_PREFIX as Sn, s3BucketDomainName as St, makeCanonicalizePropertiesFn as T, expectedOwnerParam as Tn, s3BucketWebsiteUrl as Tt, IAMRoleProvider as U, LocalMigrateError as Un, rewriteTemplateAssetReferences as Ut, secretBearingStateKeyWarning as V, DeployCancelledError as Vn, createAssetRedirectResolver as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalStartServiceError as Wn, escapeRegExp$1 as Wt, slowCcOperationTimeoutMs as X, ResourceTimeoutError as Xn, parseBootstrapMarker as Xt, CloudControlProvider as Y, ProvisioningError as Yn, getBootstrapMarkerKey as Yt, disableInstanceApiTermination as Z, ResourceUpdateNotSupportedError as Zn, validateAssetBucketName as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveUseCdkBootstrapAssets as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, AssetManifestLoader as an, withErrorHandling as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, CFN_TEMPLATE_BODY_LIMIT as bn, scrubResourceRecord as bt, replayFailedOperations as c, synthesisStatusMessage as cn, isThrottlingError as cr, configBooleanRefusal as ct, updatePartialReason as d, resolveApp as dn, replayWarn as dt, buildDockerImage as en, StateError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveAutoAssetStorage as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefaultAndSource as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveStateBucketWithDefault as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerStreaming as in, normalizeAwsError as ir, normalizeAwsTagsToCfn as it, bold as j, clearBucketRegionCache as jn, DagBuilder as jt, renderStatefulReason as k, AssemblyReader as kn, describeTypeWithThrottleRetry as kt, replayRollback as l, getDefaultStateBucketName as ln, markNonRetryable as lr, configStringRefusal as lt, withResourceDeadline as m, resolveSkipPrefix as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDockerCmd as nn, formatError as nr, refStateLookupFromResource as nt, planFailedOps as o, getDockerImageBySourceHash as on, isMarkedNonRetryable as or, assertRegionMatch as ot, deleteSkipReason as p, resolveCaptureObservedState as pn, requireConfigObject as pt, findActionableSilentDrops as q, NestedStackChildDirectDestroyError as qn, BOOTSTRAP_MARKER_PREFIX as qt, DeployEngine as r, runDockerForeground as rn, isCdkdError as rr, WAFv2WebACLProvider as rt, planRollback as s, Synthesizer as sn, isRetryableTransientError as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatDockerLoginError as tn, SynthesisError as tr, getAccountInfo as tt, updatePartialMessage as u, getLegacyStateBucketName as un, __exportAll as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, stateBucketExistenceConfirmed as vn, maskSecretsInText as vt, unsupportedFinalSnapshotError as w, uploadCfnTemplate as wn, s3BucketRegionalDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_URL_LIMIT as xn, s3BucketArn as xt, buildFinalSnapshotIdentifier as y, warnDeprecatedNoPrefixCliFlag as yn, redactSecretsForState as yt, exportAliasCollisionScrubWarning as z, ConfigError as zn, WorkGraph as zt };
-//# sourceMappingURL=deploy-engine-DJ-CgH80.js.map
+//# sourceMappingURL=deploy-engine-3Z7P1hKs.js.map