@go-to-k/cdkd 0.286.0 → 0.286.2

package/dist/{program-BXXm1RTv.js → program-BuZzDR4s.js}

@@ -1,11 +1,11 @@
-import { $ as beginCommandInterruptScope, $n as resolveAutoAssetStorage, $r as isTransientServerError, $t as maskSecretsInError, A as formatResourceLine, An as ensureAssetStorage, At as requireConfigString, B as isExportAliasCollision, Bn as dockerSpawnEnvWithSensitive, Br as ResourceTimeoutError, Bt as INTRINSIC_KEYS, C as unsupportedFinalSnapshotError, Cn as loadPublishableAssetManifest, Cr as getAwsClients, Ct as coerceCfnBoolean, D as isStatefulRecreateTargetForReplace, Dn as AssetModeResolver, Dr as CdkdError, Dt as replayWarn, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as stripControlChars, Et as readConfigString, F as red, Fn as validateAssetBucketName, Fr as LocalStartServiceError, Ft as s3BucketDualStackDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as runDockerStreaming, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as stateKeySecretExposure, Hn as getDockerCmd, Hr as StackHasActiveImportsError, Ht as withRetry, I as yellow, In as validateContainerRepoName, It as s3BucketRegionalDomainName, J as findActionableSilentDrops, Jn as Synthesizer, Jr as normalizeAwsError, Jt as carriesSecretMask, K as clearOnUpdateRemoval, Kn as AssetManifestLoader, Kt as STATE_SOURCED_READBACK_RULES, L as collectDeclaredOutputNames, Ln as buildDenyExternalAccessPolicy, Lr as NestedStackChildDirectDestroyError, Lt as s3BucketWebsiteUrl, M as cyan, Mn as isCrossRegionRedirect, Mr as DynamicReferenceRegionAmbiguousError, Mt as producerRegionsFromState, N as gray, Nn as parseBootstrapMarker, Nr as IntrinsicResolutionRefusalError, Nt as s3BucketArn, O as isStatefulRecreateTargetSync, On as BOOTSTRAP_MARKER_PREFIX, Ot as requireConfigArray, P as green, Pn as readBootstrapMarkerBody, Pr as LocalInvokeBuildError$1, Pt as s3BucketDomainName, Q as maskerOrIdentity, Qn as resolveApp, Qr as isThrottlingError, Qt as isSingleDynamicReferenceToken, R as collectPublishedOutputNames, Rn as describeAwsFailure, Rr as PartialFailureError, Rt as applyRoleArnIfSet, S as refusesFinalSnapshot, Sn as createAssetRedirectResolver, Sr as AwsClients, St as assertRegionMatch, T as extractDeploymentEventError, Tn as escapeRegExp, Tr as setAwsClients, Tt as configStringRefusal, U as getCurrentResourceSecrets, Un as partitionSensitiveEnv, Ur as StackTerminationProtectionError, Ut as DagBuilder, V as secretBearingStateKeyWarning, Vn as formatDockerLoginError, Vr as ResourceUpdateNotSupportedError, Vt as describeTypeWithThrottleRetry, W as IAMRoleProvider, Wn as runDockerForeground, Wt as TemplateParser, X as createMaskedRetryLogger, Xn as getDefaultStateBucketName, Xr as isMarkedNonRetryable, Xt as dynamicReferenceTokens, Y as findSilentDropProperties, Yn as synthesisStatusMessage, Yr as withErrorHandling, Yt as createSecretMasker, Z as maskDeep, Zn as getLegacyStateBucketName, Zr as isRetryableTransientError, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shouldRetainResource, _r as derivePartitionAndUrlSuffix, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as LockManager, ar as stateBucketExistenceConfirmed, at as slowCcOperationTimeoutMs, b as createPreDeleteFinalSnapshot, bn as WorkGraph, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as UNRENDERABLE, cr as CFN_TEMPLATE_URL_LIMIT, ct as deleteSkipReason, d as updatePartialReason, dn as forceQuitRecoveryClause, dr as uploadCfnTemplate, dt as IntrinsicFunctionResolver, ei as markNonRetryable, en as maskSecretsInText, er as resolveCaptureObservedState, et as endCommandInterruptScope, f as withResourceDeadline, fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, fr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ft as carriesDynamicReference, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as importableOutputs, gr as canonicalizeRegion, gt as isUnboundTemplateParameter, h as computeImplicitDeleteEdges, hn as importableOutputKeys, hr as PARTITION_TABLE, ht as getAccountInfo, i as DeploymentEventsReader, in as scrubResourceRecord, ir as resolveUseCdkBootstrapAssets, it as CloudControlProvider, j as bold, jn as getBootstrapMarkerKey, jr as DeployCancelledError, jt as classifyReplaySecretRegion, k as renderStatefulReason, kn as assertAssetBucketRegion, kr as CrossAccountSecretRefusalError, kt as requireConfigObject, l as replayRollback, ln as buildForceUnlockCommand, lr as MIGRATE_TMP_PREFIX, lt as disableInstanceApiTermination, m as IMPLICIT_DELETE_DEPENDENCIES, mn as exportNamesCarriedFrom, mr as expectedOwnerParam, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as retryClassificationText, nn as recoverMaskedOutput, nr as resolveStateBucketWithDefault, nt as isInterruptedWaitError, o as planFailedOps, on as S3StateBackend, or as warnDeprecatedNoPrefixCliFlag, ot as UNSPECIFIED_SKIP_REASON, p as maskingRetryLogger, pn as DEFAULT_STATE_PREFIX, pr as displaySafe, pt as cfnRefValueFromPhysicalId, q as ProviderRegistry, qn as getDockerImageBySourceHash, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as redactSecretsForState, rr as resolveStateBucketWithDefaultAndSource, rt as startInterruptWatch, s as planRollback, sn as rebuildClientForBucketRegion, sr as CFN_TEMPLATE_BODY_LIMIT, st as deleteIndeterminateGuards, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as markRedactedCause, tn as recordMaskOnlyValue, tr as resolveSkipPrefix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as buildLockContentionMessage, ur as findLargeInlineResources, ut as isTerminationProtectionPropagationError, v as buildFinalSnapshotIdentifier, vn as AssetPublisher, vr as AssemblyReader, vt as refStateLookupFromResource, w as makeCanonicalizePropertiesFn, wn as rewriteTemplateAssetReferences, wr as resetAwsClients, wt as configBooleanRefusal, x as isFinalSnapshotError, xn as buildAssetRedirectMap, xr as resolveBucketRegion, xt as resolveExplicitPhysicalId, y as ccRoutedFinalSnapshotError, yn as stringifyValue, yr as processStackMessages, yt as WAFv2WebACLProvider, z as exportAliasCollisionScrubWarning, zn as buildDockerImage, zr as ProvisioningError, zt as DiffCalculator } from "./deploy-engine-DYYs56Gt.js";
+import { $ as beginCommandInterruptScope, $n as resolveAutoAssetStorage, $r as isTransientServerError, $t as maskSecretsInError, A as formatResourceLine, An as ensureAssetStorage, At as requireConfigString, B as isExportAliasCollision, Bn as dockerSpawnEnvWithSensitive, Br as ResourceTimeoutError, Bt as INTRINSIC_KEYS, C as unsupportedFinalSnapshotError, Cn as loadPublishableAssetManifest, Cr as getAwsClients, Ct as coerceCfnBoolean, D as isStatefulRecreateTargetForReplace, Dn as AssetModeResolver, Dr as CdkdError, Dt as replayWarn, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as stripControlChars, Et as readConfigString, F as red, Fn as validateAssetBucketName, Fr as LocalStartServiceError, Ft as s3BucketDualStackDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as runDockerStreaming, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as stateKeySecretExposure, Hn as getDockerCmd, Hr as StackHasActiveImportsError, Ht as withRetry, I as yellow, In as validateContainerRepoName, It as s3BucketRegionalDomainName, J as findActionableSilentDrops, Jn as Synthesizer, Jr as normalizeAwsError, Jt as carriesSecretMask, K as clearOnUpdateRemoval, Kn as AssetManifestLoader, Kt as STATE_SOURCED_READBACK_RULES, L as collectDeclaredOutputNames, Ln as buildDenyExternalAccessPolicy, Lr as NestedStackChildDirectDestroyError, Lt as s3BucketWebsiteUrl, M as cyan, Mn as isCrossRegionRedirect, Mr as DynamicReferenceRegionAmbiguousError, Mt as producerRegionsFromState, N as gray, Nn as parseBootstrapMarker, Nr as IntrinsicResolutionRefusalError, Nt as s3BucketArn, O as isStatefulRecreateTargetSync, On as BOOTSTRAP_MARKER_PREFIX, Ot as requireConfigArray, P as green, Pn as readBootstrapMarkerBody, Pr as LocalInvokeBuildError$1, Pt as s3BucketDomainName, Q as maskerOrIdentity, Qn as resolveApp, Qr as isThrottlingError, Qt as isSingleDynamicReferenceToken, R as collectPublishedOutputNames, Rn as describeAwsFailure, Rr as PartialFailureError, Rt as applyRoleArnIfSet, S as refusesFinalSnapshot, Sn as createAssetRedirectResolver, Sr as AwsClients, St as assertRegionMatch, T as extractDeploymentEventError, Tn as escapeRegExp, Tr as setAwsClients, Tt as configStringRefusal, U as getCurrentResourceSecrets, Un as partitionSensitiveEnv, Ur as StackTerminationProtectionError, Ut as DagBuilder, V as secretBearingStateKeyWarning, Vn as formatDockerLoginError, Vr as ResourceUpdateNotSupportedError, Vt as describeTypeWithThrottleRetry, W as IAMRoleProvider, Wn as runDockerForeground, Wt as TemplateParser, X as createMaskedRetryLogger, Xn as getDefaultStateBucketName, Xr as isMarkedNonRetryable, Xt as dynamicReferenceTokens, Y as findSilentDropProperties, Yn as synthesisStatusMessage, Yr as withErrorHandling, Yt as createSecretMasker, Z as maskDeep, Zn as getLegacyStateBucketName, Zr as isRetryableTransientError, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shouldRetainResource, _r as derivePartitionAndUrlSuffix, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as LockManager, ar as stateBucketExistenceConfirmed, at as slowCcOperationTimeoutMs, b as createPreDeleteFinalSnapshot, bn as WorkGraph, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as UNRENDERABLE, cr as CFN_TEMPLATE_URL_LIMIT, ct as deleteSkipReason, d as updatePartialReason, dn as forceQuitRecoveryClause, dr as uploadCfnTemplate, dt as IntrinsicFunctionResolver, ei as markNonRetryable, en as maskSecretsInText, er as resolveCaptureObservedState, et as endCommandInterruptScope, f as withResourceDeadline, fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, fr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ft as carriesDynamicReference, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as importableOutputs, gr as canonicalizeRegion, gt as isUnboundTemplateParameter, h as computeImplicitDeleteEdges, hn as importableOutputKeys, hr as PARTITION_TABLE, ht as getAccountInfo, i as DeploymentEventsReader, in as scrubResourceRecord, ir as resolveUseCdkBootstrapAssets, it as CloudControlProvider, j as bold, jn as getBootstrapMarkerKey, jr as DeployCancelledError, jt as classifyReplaySecretRegion, k as renderStatefulReason, kn as assertAssetBucketRegion, kr as CrossAccountSecretRefusalError, kt as requireConfigObject, l as replayRollback, ln as buildForceUnlockCommand, lr as MIGRATE_TMP_PREFIX, lt as disableInstanceApiTermination, m as IMPLICIT_DELETE_DEPENDENCIES, mn as exportNamesCarriedFrom, mr as expectedOwnerParam, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as retryClassificationText, nn as recoverMaskedOutput, nr as resolveStateBucketWithDefault, nt as isInterruptedWaitError, o as planFailedOps, on as S3StateBackend, or as warnDeprecatedNoPrefixCliFlag, ot as UNSPECIFIED_SKIP_REASON, p as maskingRetryLogger, pn as DEFAULT_STATE_PREFIX, pr as displaySafe, pt as cfnRefValueFromPhysicalId, q as ProviderRegistry, qn as getDockerImageBySourceHash, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as redactSecretsForState, rr as resolveStateBucketWithDefaultAndSource, rt as startInterruptWatch, s as planRollback, sn as rebuildClientForBucketRegion, sr as CFN_TEMPLATE_BODY_LIMIT, st as deleteIndeterminateGuards, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as markRedactedCause, tn as recordMaskOnlyValue, tr as resolveSkipPrefix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as buildLockContentionMessage, ur as findLargeInlineResources, ut as isTerminationProtectionPropagationError, v as buildFinalSnapshotIdentifier, vn as AssetPublisher, vr as AssemblyReader, vt as refStateLookupFromResource, w as makeCanonicalizePropertiesFn, wn as rewriteTemplateAssetReferences, wr as resetAwsClients, wt as configBooleanRefusal, x as isFinalSnapshotError, xn as buildAssetRedirectMap, xr as resolveBucketRegion, xt as resolveExplicitPhysicalId, y as ccRoutedFinalSnapshotError, yn as stringifyValue, yr as processStackMessages, yt as WAFv2WebACLProvider, z as exportAliasCollisionScrubWarning, zn as buildDockerImage, zr as ProvisioningError, zt as DiffCalculator } from "./deploy-engine-BoSlW08T.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Dkd6KwPz.js";
-import { t as ASGProvider } from "./asg-provider-D9Lc_ngz.js";
+import { t as getCdkdVersion } from "./version-Crg_SdRh.js";
+import { t as ASGProvider } from "./asg-provider-CSEPihOt.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRoleCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -1232,6 +1232,69 @@ function regionNeedsReconciliation(effective) {
 	if (effective.source === "flag" || effective.source === "env") return false;
 	return effective.region !== LEGACY_DEFAULT_REGION;
 }
+/**
+* Give a `cdkd local start-*` shim the SAME `--region` contract every other
+* cdkd command has, and fold it before cdk-local's handler runs.
+*
+* The four `start-*` shims (`service` / `alb` / `cloudfront` / `agentcore`)
+* arrive with cdk-local's own visible, undeprecated `--region <region>`, and
+* three of the four hand their whole options bag straight to cdk-local — so
+* there is no cdkd-owned line inside the handler to fold at, and issue
+* [#2522](https://github.com/go-to-k/cdkd/issues/2522) measured what that
+* costs: `--region US-EAST-1` reached cdk-local's SDK clients, the ECR host it
+* synthesizes for an image pull, the SigV4 credential scope and the
+* `AWS_REGION` handed to every container it starts. Same class as
+* [#1795](https://github.com/go-to-k/cdkd/issues/1795), in the command set that
+* shipped after #1795 fixed the then-existing four.
+*
+* Two halves, and BOTH are needed:
+*
+* 1. cdk-local's `--region` declaration is spliced out and cdkd's shared
+*    {@link deprecatedRegionOption} takes its place — hidden from `--help` and
+*    warned about at runtime, exactly as on every other cdkd command that
+*    accepts the flag. The flag keeps WORKING; only its advertisement changes.
+* 2. A `preAction` hook folds the parsed bag. commander runs the hook after
+*    parsing and before the action, and `opts()` returns the LIVE option
+*    object, so the fold is visible to cdk-local and to everything downstream
+*    of it.
+*
+* `--stack-region` is folded here too, and its RAW spelling captured FIRST.
+* That capture is load-bearing rather than symmetric: `local-state-source.ts`'s
+* `--from-state` factory falls back to `opts.stackRegion` when
+* `opts.rawStackRegion` is absent, on the (previously true) reasoning that an
+* engine command's `--stack-region` had passed no cdkd fold. Folding it here
+* without capturing first would silently collapse that fallback onto the
+* folded value and disable the exact-spelling state-record match
+* ([#1836](https://github.com/go-to-k/cdkd/issues/1836) round 3).
+*
+* Returns the same command so it can tail a factory's option-adding chain.
+*/
+function adoptDeprecatedRegionFlag(cmd) {
+	const registered = cmd.options;
+	const inherited = registered.findIndex((option) => option.long === "--region");
+	if (inherited !== -1) {
+		registered.splice(inherited, 1);
+		const emitter = cmd;
+		emitter.removeAllListeners("option:region");
+		emitter.removeAllListeners("optionEnv:region");
+		if (cmd.getOptionValueSource("region") === "default") {
+			const internals = cmd;
+			delete internals._optionValues["region"];
+			delete internals._optionValueSources["region"];
+		}
+	}
+	cmd.addOption(deprecatedRegionOption);
+	cmd.hook("preAction", (_thisCommand, actionCommand) => {
+		const options = actionCommand.opts();
+		warnIfDeprecatedRegion(options);
+		if (options.stackRegion !== void 0) {
+			options.rawStackRegion = options.stackRegion;
+			options.stackRegion = canonicalizeRegion(options.stackRegion);
+		}
+		foldRegionOption(options);
+	});
+	return cmd;
+}
 
 //#endregion
 //#region src/cli/commands/bootstrap-destroy.ts
@@ -2756,6 +2819,13 @@ function foldRegion(region) {
 */
 async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getLogger().child("recreate-targets")) {
 	const promoted = [];
+	const probeRetryOptions = {
+		maxRetries: 3,
+		initialDelayMs: 500,
+		logger,
+		isRetryable: (_message, error) => isThrottlingError(error),
+		...clients.sleep && { sleep: clients.sleep }
+	};
 	for (const target of targets) {
 		if (target.statefulReason !== null) {
 			promoted.push({ ...target });
@@ -2763,29 +2833,43 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 		}
 		if (target.resourceType === "AWS::S3::Bucket") {
 			try {
-				const result = await clients.s3.send(new ListObjectVersionsCommand({
+				const result = await withRetry(() => clients.s3.send(new ListObjectVersionsCommand({
 					Bucket: target.physicalId,
 					MaxKeys: 1
-				}));
+				})), target.logicalId, probeRetryOptions);
 				const hasVersions = (result.Versions?.length ?? 0) > 0;
 				const hasDeleteMarkers = (result.DeleteMarkers?.length ?? 0) > 0;
+				const truncated = result.IsTruncated === true || !!result.NextKeyMarker || !!result.NextVersionIdMarker;
 				if (hasVersions || hasDeleteMarkers) promoted.push({
 					...target,
 					statefulReason: "has-objects"
 				});
-				else promoted.push({ ...target });
+				else if (truncated) {
+					logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: S3 answered the emptiness probe for ${target.logicalId} (bucket ${target.physicalId}) without settling it (an empty page carrying a continuation marker); treating the bucket as NOT provably empty. Re-run to retry the probe, or — only if the bucket really is disposable — re-run with --force-stateful-recreation (that flag has NO per-resource granularity and clears the guard for every target in the run).`);
+					promoted.push({
+						...target,
+						statefulReason: "has-objects"
+					});
+				} else promoted.push({ ...target });
 			} catch (e) {
+				if (e instanceof NoSuchBucket || e instanceof NotFound) {
+					promoted.push({ ...target });
+					continue;
+				}
 				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live S3 probe failed for ${target.logicalId} (bucket ${target.physicalId}); leaving stateful guard at the sync result. If the bucket might be non-empty, re-run with --force-stateful-recreation. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
-				promoted.push({ ...target });
+				promoted.push({
+					...target,
+					probeUnresolved: true
+				});
 			}
 			continue;
 		}
 		if (target.resourceType === "AWS::Logs::LogGroup") {
 			try {
-				const result = await clients.cloudWatchLogs.send(new DescribeLogStreamsCommand({
+				const result = await withRetry(() => clients.cloudWatchLogs.send(new DescribeLogStreamsCommand({
 					logGroupName: target.physicalId,
 					limit: 1
-				}));
+				})), target.logicalId, probeRetryOptions);
 				const streams = result.logStreams;
 				if (streams !== void 0 && streams.length === 0 && !result.nextToken) promoted.push({ ...target });
 				else if (streams !== void 0 && streams.length > 0) promoted.push({
@@ -2994,9 +3078,11 @@ async function promptRecreateConfirm(input) {
 		const stateful = reason !== null;
 		const dataLossPrefix = stateful ? "**DATA LOSS** " : "";
 		const directionTag = t.direction === "to-cc-api" ? " [SDK → CC]" : " [CC → SDK]";
-		const stateNote = stateful ? ` — stateful (${rederived ? "emptiness not established — --force-stateful-recreation skips the probe" : renderStatefulReason(reason)}); --force-stateful-recreation acknowledged` : "";
+		const unresolved = !stateful && t.probeUnresolved === true;
+		const stateNote = stateful ? ` — stateful (${rederived ? "emptiness not established — --force-stateful-recreation skips the probe" : renderStatefulReason(reason)}); --force-stateful-recreation acknowledged` : unresolved ? " — emptiness NOT established: the live probe failed, so cdkd does not know whether this resource holds data" : "";
 		logger.warn(`  - ${dataLossPrefix}${t.logicalId} (${t.resourceType})${directionTag}${stateNote}`);
 		if (stateful) logger.warn(`    DATA: all data in ${t.logicalId} will be lost (no automatic data migration)`);
+		else if (unresolved) logger.warn(`    UNKNOWN: if ${t.logicalId} holds data, the destroy + recreate loses it (no automatic data migration)`);
 	}
 	if (input.downstreamConsumers && input.downstreamConsumers.length > 0) {
 		const rendered = renderDownstreamConsumers(input.stackName, input.downstreamConsumers);
@@ -23061,7 +23147,10 @@ var LogsLogGroupProvider = class {
 		const normalizeClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 		const prevClass = normalizeClass(previousProperties["LogGroupClass"]);
 		const nextClass = normalizeClass(properties["LogGroupClass"]);
-		if (prevClass !== nextClass) throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. Re-deploy with --replace --force-stateful-recreation to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change. Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
+		if (prevClass !== nextClass) {
+			const replaceFlags = "--replace --force-stateful-recreation";
+			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
+		}
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -80381,7 +80470,7 @@ var S3LocalStateProvider = class {
 *   - `--from-state` (S3-backed; reads cdkd's state for a stack
 *     deployed via `cdkd deploy`). cdkd-specific.
 *   - `--from-cfn-stack [<cfn-stack-name>]` (CFn-backed; reads a
-*     deployed CloudFormation stack via `DescribeStackResources`).
+*     deployed CloudFormation stack via `ListStackResources`).
 *     Inherited from `cdk-local`.
 *
 * This module is a thin shim around `cdk-local`'s state-source
@@ -81648,9 +81737,9 @@ function isCdkAssetImageUri(uri, cdkAssetContainerRepo) {
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
-*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — same-account
-*     same-region ECR. Cross-account/region is hard-errored (matches
-*     `cdkd local invoke`'s ECR-pull semantics).
+*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — an ECR image
+*     URI. Cross-account and cross-region are BOTH supported; see the #455
+*     paragraph below for how each is authenticated.
 *   - `Fn::Sub` / `Fn::Join` / `Ref` referencing a `Code.fromAsset`-style
 *     CDK asset image. Surfaces `kind: 'cdk-asset'` with the optional
 *     asset hash so the runner can route through `docker-build.ts`.
@@ -84323,10 +84412,13 @@ function warnIamRoutes(routesWithAuth) {
 *          `--from-state` / `--from-cfn-stack` is active, via the same
 *          shared helper `cdkd local invoke`'s bare-form uses
 *          (`resolveExecutionRoleArnFromState`).
-*   - flag absent / `--no-assume-role-auto` — returns `undefined`
-*     (per-Lambda map and global default already filtered out by the
-*     null-check at the top; bare-auto-resolve = false short-circuits
-*     before the state lookup).
+*   - flag absent — returns `undefined` (per-Lambda map and global
+*     default already filtered out by the null-check at the top;
+*     bare-auto-resolve = false short-circuits before the state lookup).
+*     There is no `--no-assume-role-auto`: `--assume-role-auto` is a plain
+*     boolean defaulting to `false`, so omitting it IS the off state, and an
+*     earlier revision of this list named a negation commander never
+*     registered (the issue-#2523 shape, one file over).
 *
 * The shape-level mutual exclusion (bare-auto-resolve + global ARN
 * together) is caught at boot by `normalizeStartApiAssumeRole`; this
@@ -84477,16 +84569,20 @@ async function buildContainerSpec(args) {
 * need the no-build flag (deterministic-tag cache reuse is automatic
 * across reloads because the per-Lambda tag is content-addressed).
 *
-* Same-account / same-region only on the ECR-pull path (matches the
-* `cdkd local invoke` PR 5 of #224 boundary). Cross-account /
-* cross-region ECR pull is the W2-1 deferred follow-up.
+* NOT same-region-only on the ECR-pull path: `pullEcrImage` authenticates
+* against the image URI's OWN region, so a cross-region image pulls fine. The
+* real limit here is cross-ACCOUNT — unlike `local invoke` / `run-task` /
+* `invoke-agentcore` this command declares no `--ecr-role-arn`, so it can only
+* use credentials already granted `ecr:GetAuthorizationToken` +
+* `ecr:BatchGetImage` on the repository (issue #2536 corrected the message and
+* this comment; the earlier "W2-1 deferred" wording predated #455).
 */
 async function resolveContainerImageForStartApi(lambda, skipPull) {
 	const logger = getLogger();
 	const localBuild = await resolveLocalBuildPlan$1(lambda);
 	if (localBuild) return { imageRef: await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, { architecture: lambda.architecture }) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI cdkd can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
-	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (same-acct/region only)...`);
+	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (uses your own credentials — this command has no --ecr-role-arn, so a cross-account image needs cross-account ECR permissions)...`);
 	return { imageRef: await pullEcrImage(lambda.imageUri, { skipPull }) };
 }
 /**
@@ -85212,7 +85308,7 @@ function resolveMtlsConfig(options) {
 * Builder for the `start-api` subcommand. Wired up by `local.ts`.
 */
 function createLocalStartApiCommand() {
-	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated; see https://github.com/go-to-k/cdkd/blob/main/docs/local-emulation.md). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: watch the CDK app source tree and re-synth + re-discover routes on a source edit (cdk.out / node_modules / .git excluded; honors cdk.json watch.include / watch.exclude). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn DescribeStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: enforce strict AWS_IAM SigV4 verification. When set, requests whose signature cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) are denied. DEFAULT off — warn-and-pass with a placeholder principalId, matching cdk-local's `cdkl start-api`. Enable this when you want local parity with the deployed API Gateway's signature enforcement.").default(false)).action(withErrorHandling(localStartApiCommand));
+	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated; see https://github.com/go-to-k/cdkd/blob/main/docs/local-emulation.md). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: watch the CDK app source tree and re-synth + re-discover routes on a source edit (cdk.out / node_modules / .git excluded; honors cdk.json watch.include / watch.exclude). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives BOTH event.stageVariables and requestContext.stage, for REST v1 and HTTP API v2 alike: when a route's API has a matching templated Stage, the selected StageName is threaded into requestContext.stage. An HTTP API v2 route reports '$default' only when its API carries no AWS::ApiGatewayV2::Stage in the template — that is v2's auto-deployed stage, not a limit on what this flag can select (AWS's CreateStage accepts named stages on v2 too). An API with no Stage matching the selected name is warned about at start-up and its routes get stageVariables: null.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: enforce strict AWS_IAM SigV4 verification. When set, requests whose signature cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) are denied. DEFAULT off — warn-and-pass with a placeholder principalId, matching cdk-local's `cdkl start-api`. Enable this when you want local parity with the deployed API Gateway's signature enforcement.").default(false)).action(withErrorHandling(localStartApiCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -86448,7 +86544,7 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 	if (options.profile) return resolveProfileCredentials(options.profile);
 }
 function createLocalRunTaskCommand() {
-	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn DescribeStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
+	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -86501,7 +86597,7 @@ function createLocalStartServiceCommand() {
 		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
-	return addCommonEcsServiceOptions(cmd);
+	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
 //#endregion
@@ -87872,7 +87968,7 @@ function readEnvOverridesFile$1(filePath) {
 	return parsed;
 }
 function createLocalInvokeAgentCoreCommand() {
-	const cmd = new Command("invoke-agentcore").description("Run a Bedrock AgentCore Runtime container locally and invoke it once over its protocol contract: HTTP (POST /invocations + GET /ping on 8080) or MCP (POST /mcp Streamable HTTP on 8000). Resolves the AWS::BedrockAgentCore::Runtime, pulls/builds its container, injects env vars + AWS credentials, and prints the response. For an MCP runtime, runs the session handshake then sends one JSON-RPC request (tools/list by default, or the method/params from --event). Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID (MyStack:MyAgentRuntime1234). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal to pick from a list. Supports the container artifact and the CodeConfiguration managed-runtime artifact (fromCodeAsset, built from source) on the HTTP + MCP protocols; the agent calls real AWS for managed services.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to invoke (omit to pick interactively in a TTY)").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--session-id <id>", "AgentCore runtime session id header value (default: a random UUID)")).addOption(new Option("--ws", "Stream over the HTTP-protocol agent's bidirectional /ws WebSocket endpoint (on 8080) instead of POST /invocations: send --event as the first frame and print every received frame to stdout until the agent closes. When stdin is a TTY, auto-enters a REPL — each typed line is sent as a follow-up text frame until Ctrl-D / agent close; pipe from /dev/null to force one-shot in a TTY. Ignored for an MCP runtime.").default(false)).addOption(new Option("--watch", "Re-synth and reload the agent container on CDK source changes (follows cdk-local #270). Supported on the HTTP / AGUI protocols, both the --ws session AND the default one-shot POST /invocations (the reload re-runs the single shot). An interpreted-language source edit inside a CodeConfiguration source tree takes a soft-reload fast path (docker cp + docker restart, no rebuild); Dockerfile / compiled-source / asset-hash-changed / ambiguous edits force a full rebuild. For MCP / A2A runtimes --watch is a no-op WARN and the single shot proceeds.").default(false)).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime OIDC discovery URL (signature / issuer / expiry / audience) before the container starts, then forwarded to /invocations as Authorization: Bearer <jwt>.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign the /invocations POST with AWS SigV4 (service bedrock-agentcore) using the resolved credentials, matching the cloud default when the runtime declares no customJwtAuthorizer. Opt-in: default unsigned. Mutually exclusive with --bearer-token; ignored on a JWT-protected runtime.").default(false)).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64)").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host to bind the agent port to").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Per-request timeout in milliseconds. Applied to POST /invocations, POST /mcp, and the /ws open-to-close window. Raise this for long-running agent calls that exceed the default.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container so the agent runs with the deployed role. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's RoleArn when it is a literal ARN; (3) `--no-assume-role` opts out. Off by default — the developer's shell credentials are forwarded unchanged.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-state", "Load cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue in env vars with the deployed physical IDs / cross-stack exports. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. For CDK apps deployed via the upstream CDK CLI. Bare form uses the resolved stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.").argParser(parseStackRegion)).action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("invoke-agentcore").description("Run a Bedrock AgentCore Runtime container locally and invoke it once over its protocol contract: HTTP (POST /invocations + GET /ping on 8080) or MCP (POST /mcp Streamable HTTP on 8000). Resolves the AWS::BedrockAgentCore::Runtime, pulls/builds its container, injects env vars + AWS credentials, and prints the response. For an MCP runtime, runs the session handshake then sends one JSON-RPC request (tools/list by default, or the method/params from --event). Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID (MyStack:MyAgentRuntime1234). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal to pick from a list. Supports the container artifact and the CodeConfiguration managed-runtime artifact (fromCodeAsset, built from source) on the HTTP + MCP protocols; the agent calls real AWS for managed services.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to invoke (omit to pick interactively in a TTY)").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--session-id <id>", "AgentCore runtime session id header value (default: a random UUID)")).addOption(new Option("--ws", "Stream over the HTTP-protocol agent's bidirectional /ws WebSocket endpoint (on 8080) instead of POST /invocations: send --event as the first frame and print every received frame to stdout until the agent closes. When stdin is a TTY, auto-enters a REPL — each typed line is sent as a follow-up text frame until Ctrl-D / agent close; pipe from /dev/null to force one-shot in a TTY. Ignored for an MCP runtime.").default(false)).addOption(new Option("--watch", "Re-synth and reload the agent container on CDK source changes (follows cdk-local #270). Supported on the HTTP / AGUI protocols, both the --ws session AND the default one-shot POST /invocations (the reload re-runs the single shot). An interpreted-language source edit inside a CodeConfiguration source tree takes a soft-reload fast path (docker cp + docker restart, no rebuild); Dockerfile / compiled-source / asset-hash-changed / ambiguous edits force a full rebuild. For MCP / A2A runtimes --watch is a no-op WARN and the single shot proceeds.").default(false)).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime OIDC discovery URL (signature / issuer / expiry / audience) before the container starts, then forwarded to /invocations as Authorization: Bearer <jwt>.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign the /invocations POST with AWS SigV4 (service bedrock-agentcore) using the resolved credentials, matching the cloud default when the runtime declares no customJwtAuthorizer. Opt-in: default unsigned. Mutually exclusive with --bearer-token; ignored on a JWT-protected runtime.").default(false)).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64)").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host to bind the agent port to").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Per-request timeout in milliseconds. Applied to POST /invocations, POST /mcp, and the /ws open-to-close window. Raise this for long-running agent calls that exceed the default.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container so the agent runs with the deployed role. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's RoleArn when it is a literal ARN; (3) `--no-assume-role` opts out. Off by default — the developer's shell credentials are forwarded unchanged.")).addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the runtime's execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged even when --from-state / --from-cfn-stack is set.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--from-state", "Load cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue in env vars with the deployed physical IDs / cross-stack exports. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. For CDK apps deployed via the upstream CDK CLI. Bare form uses the resolved stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.").argParser(parseStackRegion)).action(withErrorHandling(async (target, options) => {
 		await localInvokeAgentCoreCommand(target, options);
 	}));
 	[
@@ -87946,7 +88042,8 @@ function createLocalStartAgentCoreCommand$1() {
 	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in the AgentCore runtime container image and environment variables. Mutually exclusive with --from-cfn-stack.").default(false));
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
-	return cmd;
+	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
+	return adoptDeprecatedRegionFlag(cmd);
 }
 
 //#endregion
@@ -87963,7 +88060,7 @@ function createLocalStartAlbCommand() {
 		await runEcsServiceEmulator(targets, options, albStrategy(options), cdkdExtraStateProviders);
 	}));
 	addAlbSpecificOptions(cmd);
-	return addCommonEcsServiceOptions(cmd);
+	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
 }
 
 //#endregion
@@ -87985,17 +88082,43 @@ function createLocalStartAlbCommand() {
 * binding a Function URL origin's backing Lambda + a deployed-S3 origin's bucket
 * name to deployed state) live in cdk-local and are auto-inherited.
 *
-* As of cdk-local 0.128.0 (go-to-k/cdk-local#426 / #436) the start-cloudfront
-* factory accepts the `extraStateProviders` seam — the same one
-* `start-agentcore` / `start-alb` / `start-service` use — so cdkd now threads
-* its S3-backed `--from-state` factory in via `cdkdExtraStateProviders` and
-* layers the cdkd-specific `--from-state` / `--state-bucket` / `--state-prefix`
-* flags on top of cdk-local's inherited `--from-cfn-stack` / `--stack-region`
-* (issue #766). The factory's internal `createLocalStateProvider` calls pick
-* cdkd's `fromState` factory transparently when `--from-state` is passed, so a
-* Function URL origin's backing Lambda + a deployed-S3 origin's bucket name can
-* be bound to cdkd-managed state (after a prior `cdkd deploy`), not just to a
-* CloudFormation stack.
+* `--region` is the ONE inherited option cdkd replaces rather than accepts as
+* given: cdk-local declares it visibly and undeprecated, while every other cdkd
+* command carries the hidden, warned, folded `deprecatedRegionOption`. See
+* {@link adoptDeprecatedRegionFlag} — the flag keeps working, disappears from
+* `--help`, prints the removal warning, and (the reason it exists) is folded to
+* its canonical spelling before cdk-local's handler builds an SDK client from it
+* ([#2522](https://github.com/go-to-k/cdkd/issues/2522)).
+*
+* ## Why cdkd's own state-source flags are REFUSED here
+*
+* The `extraStateProviders` seam cdk-local's factory accepts (go-to-k/cdk-local#426)
+* is wired in below, and cdkd's S3-backed `--from-state` factory reaches it — but
+* NOTHING in this command's code path consults it. Verified against the installed
+* `cdk-local@0.147.7` bundle (`dist/local-studio-BBtUAVNy.js`), all three consumers
+* miss, for two independent reasons:
+*
+*   1. `resolveDeployedS3Origins` (`:30872`) and `attachKvsModules` (`:30680`)
+*      both gate on `isCfnFlagPresent(options)` — i.e. `--from-cfn-stack`
+*      specifically — rather than on the "any state source is active" predicate
+*      `start-api` uses (`:15830`). With `--from-state` alone they return before
+*      a provider is constructed.
+*   2. `bootLambdaUrlOrigins` (`:30764`) and `bootLambdaEdgeFunctions` (`:30813`)
+*      call `resolveLambdaContainerEnv` WITHOUT its fourth `extraStateProviders`
+*      parameter, and the `envOptions` bag they hand it (`:30982`) is an
+*      allow-list of five keys that drops cdkd's state fields anyway.
+*
+* So the flags parse and do nothing, on exactly the command where a user is
+* already troubleshooting a `502` from an unresolved origin. Issue
+* [#2528](https://github.com/go-to-k/cdkd/issues/2528) settles that a flag that
+* parses and does nothing is worse than one that errors, so they are declared
+* (to keep the error actionable, and to keep the option set discoverable) and
+* REFUSED at `preAction` with a message naming `--from-cfn-stack` as today's
+* working state source. The upstream fix is go-to-k/cdk-local#699; when it
+* lands, delete {@link refuseUnwiredCdkdStateFlags} and the `[not supported…]`
+* prefixes — nothing else has to change, because the seam below is already
+* correct. Tracked for cdkd as
+* [#2600](https://github.com/go-to-k/cdkd/issues/2600).
 *
 * The active cdkd embed config is re-handed to the factory so branding stays
 * cdkd: cdk-local's factory calls `setEmbedConfig(opts.embedConfig)`, and
@@ -88008,10 +88131,38 @@ function createLocalStartCloudFrontCommand$1() {
 		embedConfig: getEmbedConfig(),
 		extraStateProviders: cdkdExtraStateProviders
 	});
-	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics when binding a Lambda Function URL origin's backing Lambda and a deployed-S3 origin's bucket name. Mutually exclusive with --from-cfn-stack.").default(false));
-	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket."));
-	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
-	return cmd;
+	cmd.addOption(new Option("--from-state", "[not supported on start-cloudfront] Read cdkd's S3 state for the target stack. Refused at startup: the CloudFront emulator consults a state source only under --from-cfn-stack (go-to-k/cdkd#2528, upstream go-to-k/cdk-local#699). Use --from-cfn-stack instead.").default(false));
+	cmd.addOption(new Option("--state-bucket <bucket>", "[not supported on start-cloudfront] S3 bucket for --from-state. Refused at startup with --from-state."));
+	cmd.addOption(new Option("--state-prefix <prefix>", "[not supported on start-cloudfront] S3 key prefix for --from-state state files. Refused at startup with --from-state.").default("cdkd"));
+	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
+	refuseUnwiredCdkdStateFlags(cmd);
+	return adoptDeprecatedRegionFlag(cmd);
+}
+/**
+* Refuse cdkd's three state-source flags on `start-cloudfront` before anything
+* runs, rather than accepting them and silently emulating against nothing.
+*
+* `commander`'s `Command.error` is used rather than a thrown `CdkdError`
+* because the check runs in a `preAction` hook, OUTSIDE the `withErrorHandling`
+* wrapper cdk-local puts around its action — a throw there escapes to
+* `main().catch`, which prints `Fatal error:` plus a stack. `error()` prints the
+* message the way every other option error on this CLI is printed and exits 1.
+*
+* `--state-prefix` carries a commander default, so its presence is decided by
+* `getOptionValueSource` (`'cli'` only when the user typed it) rather than by
+* the value — pinning the default string here would go inert the moment the
+* default changed.
+*/
+function refuseUnwiredCdkdStateFlags(cmd) {
+	cmd.hook("preAction", (_thisCommand, actionCommand) => {
+		const options = actionCommand.opts();
+		const passed = [];
+		if (options.fromState === true) passed.push("--from-state");
+		if (options.stateBucket !== void 0) passed.push("--state-bucket");
+		if (actionCommand.getOptionValueSource("statePrefix") === "cli") passed.push("--state-prefix");
+		if (passed.length === 0) return;
+		actionCommand.error(`error: ${passed.join(" / ")} ${passed.length === 1 ? "is" : "are"} not supported by \`cdkd local start-cloudfront\`. The CloudFront emulator resolves its deployed-S3 origins, its cf.kvs() bindings and its Function URL / Lambda@Edge containers' environment through cdk-local, which consults a state source only under --from-cfn-stack. DROP the flag(s) above, then use --from-cfn-stack <name> for a CloudFormation-deployed stack, or --origin <originId>=<dir> to serve an origin from a local directory. Adding --from-cfn-stack while leaving these on hits this same refusal. Tracked as go-to-k/cdkd#2528 (upstream go-to-k/cdk-local#699).`, { code: "cdkd.startCloudFrontStateFlagUnsupported" });
+	});
 }
 
 //#endregion
@@ -88201,7 +88352,7 @@ async function localInvokeCommand(target, options) {
 				logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
 			} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 		}
-		else if (options.assumeRole === void 0 && options.fromState && stateForRoleHint) suggestAssumeRoleFromState(stateForRoleHint, lambda.logicalId);
+		else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
 		const event = await readEvent(options);
 		const dockerEnv = {
 			AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
@@ -88423,7 +88574,11 @@ function materializeLambdaLayers(layers) {
 /**
 * Container-Lambda branch (PR 5): try the local-build path first (asset
 * manifest lookup by hash; single-asset fallback when extraction fails),
-* then fall back to ECR pull (same-account / same-region only — D5.2).
+* then fall back to ECR pull. NOT same-region-only: `pullEcrImage` authenticates
+* against the image URI's OWN region, so a cross-region image pulls fine.
+* Cross-ACCOUNT needs either `--ecr-role-arn` or credentials already granted
+* `ecr:GetAuthorizationToken` + `ecr:BatchGetImage` on the repository (#455,
+* corrected in issue #2536).
 */
 async function resolveContainerImagePlan(lambda, options) {
 	const logger = getLogger();
@@ -88436,7 +88591,7 @@ async function resolveContainerImagePlan(lambda, options) {
 	});
 	else {
 		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI cdkd can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
-		logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (same-acct/region only)...`);
+		logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (cross-region is supported — the ECR client is built for the image URI's region; pass --ecr-role-arn for a cross-account image)...`);
 		imageRef = await pullEcrImage(lambda.imageUri, {
 			skipPull: options.pull === false,
 			...options.region !== void 0 && { region: options.region },
@@ -88816,6 +88971,39 @@ function suggestAssumeRoleFromState(state, logicalId) {
 	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${roleArn}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
+* Emit the "re-run with `--assume-role`" hint, if it applies.
+*
+* This is the ONE place where `--no-assume-role` (`false`) behaves differently
+* from omitting the flag (`undefined`), and therefore the whole behavioural
+* payoff of registering the negation
+* ([#2523](https://github.com/go-to-k/cdkd/issues/2523)): both forward the
+* caller's ambient credentials, but only the absent flag prints the hint.
+* Everywhere else the two collapse onto the same credential path.
+*
+* The DECISION and the EMISSION are deliberately in the same function, and
+* that shape was bought by a review probe. An earlier cut exported only the
+* predicate and left the `logger` call at the call site; the probe replaced
+* the handler's condition with the pre-fix `stateForRoleHint &&
+* options.fromState` — reintroducing the defect in full — and all 3217 tests
+* stayed green, because nothing pinned that the handler still consulted the
+* predicate. Split like that, the extraction moves the untested part rather
+* than removing it. Together, the only way to reintroduce the defect is to
+* edit this function, which the cases in
+* `tests/unit/cli/local-assume-role-negation.test.ts` read directly.
+*
+* `state` is `undefined` when no state source was loaded, which is its own
+* reason not to hint: there is no deployed role ARN to name.
+*
+* Returns whether it hinted, so a caller (and a test) can assert the decision
+* without having to scrape the log.
+*/
+function maybeSuggestAssumeRole(options, state, logicalId) {
+	if (options.assumeRole !== void 0) return false;
+	if (!options.fromState || !state) return false;
+	suggestAssumeRoleFromState(state, logicalId);
+	return true;
+}
+/**
 * Resolve the execution-role ARN for a Lambda from cdkd state. Used by
 * both the `--assume-role` auto-resolve path and the legacy hint path.
 *
@@ -88872,7 +89060,7 @@ function pickReferencedLogicalId(intrinsic) {
 function createLocalCommand() {
 	setEmbedConfig(CDKD_EMBED_CONFIG);
 	const local = new Command("local").description("Local execution of Lambda functions (RIE) and ECS task definitions (Docker required)");
-	const invoke = new Command("invoke").description("Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for IMAGE local-build path; `docker build` does not pull base layers by default")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions (closes the \"developer admin / function narrow\" skew). Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from cdkd state (requires --from-state); (3) `--no-assume-role` explicitly opts out (forces dev creds even with --from-state). Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub in env vars with the deployed physical IDs / attributes. Off by default — keep PR 1 warn-and-drop semantics; turn on for stacks already deployed via cdkd deploy.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn DescribeStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localInvokeCommand));
+	const invoke = new Command("invoke").description("Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for IMAGE local-build path; `docker build` does not pull base layers by default")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions (closes the \"developer admin / function narrow\" skew). Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from cdkd state (requires --from-state); (3) `--no-assume-role` explicitly opts out (forces dev creds even with --from-state). Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) even when --from-state is set, and suppress the \"run with --assume-role\" hint. Distinct from omitting the flag, which still prints that hint.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub in env vars with the deployed physical IDs / attributes. Off by default — keep PR 1 warn-and-drop semantics; turn on for stacks already deployed via cdkd deploy.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localInvokeCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -88940,4 +89128,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BXXm1RTv.js.map
+//# sourceMappingURL=program-BuZzDR4s.js.map